Dd Audit

作者 datadog-labs5b40c73824ec無授權條款177 個星標收錄於 2026年10月8日更新於 2026年10月8日儲存庫今天更新

Audit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing.

僅含說明Security Business & Finance

AI 產生的概覽

調查 Datadog Audit Trail 記錄，涵蓋使用者活動、金鑰外洩、成本暴增、合規證據與 AI 活動稽核。

功能: 此技能引導代理使用 pup audit-logs 命令列工具調查 Datadog Audit Trail 事件。它包含五個子技能：調查誰變更了什麼的安全調查、API 金鑰外洩排查、成本暴增根因分析、SOC 2 與 PCI 等合規證據報告，以及 AI 活動稽核。它提供事件欄位結構、Lucene 風格搜尋語法、保留期限與疑難排解說明，用來執行與解讀查詢。
適用情境: 當需要回答誰變更了 Datadog 資源、某個 API 金鑰是否外洩、用量或 LLM 成本為何暴增，或 AI 助理與 MCP 工具呼叫做了什麼時使用。它也適合為合規稽核人員產出稽核證據。
執行需求: 需要 pup CLI 並完成 Datadog 身分驗證，可透過 pup auth login（OAuth2）或設定具備 audit_logs_read 權限的 DD_API_KEY 與 DD_APP_KEY，同時需要存取 Datadog 的網路。查詢超過預設 90 天保留期的資料需設定封存。不含指令碼，僅為說明文件。

Datadog Audit Trail

Investigate user activity, configuration changes, access patterns, and compliance evidence using pup audit-logs.

Sub-Skills

Sub-skill	Use when
security-investigation	"Who changed X?", "What did this user do?", "Show me deletions in the last 24h"
key-compromise	"Was this API key compromised?", "What did key XYZ do?", "Investigate suspicious key activity"
cost-spike-investigation	"Why did my bill go up?", "What caused this usage spike?", "Investigate LLM cost increase"
compliance-report	"Generate SOC 2 evidence", "PCI audit log", "User provisioning report for auditor"
ai-activity-audit	"What did the AI assistant do?", "Audit MCP tool calls", "AI governance report"

Prerequisites

bash

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

Commands

bash

# List recent eventspup audit-logs list --from 1h --limit 100
# Search with a querypup audit-logs search --query "@action:deleted" --from 24h
# JSON output for piping to jqpup audit-logs search --query "@usr.email:[email protected]" --from 7d -o json | jq '.data[].attributes'

# List recent eventspup audit-logs list --from 1h --limit 100
# Search with a querypup audit-logs search --query "@action:deleted" --from 24h
# JSON output for piping to jqpup audit-logs search --query "@usr.email:[email protected]" --from 7d -o json | jq '.data[].attributes'

Event Schema Quick Reference

Field	Description	Example values
`@usr.email`	Actor email	`[email protected]`
`@evt.actor.type`	How action was taken	`USER`, `API_KEY`, `SUPPORT_USER`
`@action`	Verb	`created`, `modified`, `deleted`, `accessed`, `login`
`@evt.name`	Event category	`Dashboard`, `Monitor`, `Authentication`, `Access Management`
`@asset.type`	Resource type	`dashboard`, `monitor`, `api_key`, `role`, `user`
`@asset.id`	Resource identifier	`abc-123`
`@metadata.api_key.id`	API key used (if applicable)	`key_abc123`
`@metadata.app_key.id`	App key used (if applicable)	`app_abc123`
`@network.client.ip`	Client IP address	`1.2.3.4`
`@network.client.geoip.country.name`	Country	`United States`
`@network.client.geoip.as.name`	ASN name	`Amazon.com`
`@http.url_details.path`	API endpoint path	`/api/v1/dashboard/xyz`

Search Syntax

Same Lucene-style syntax as Log Explorer:

Query	Meaning
`@evt.name:Dashboard`	Exact field match
`@action:deleted`	Action filter
`@usr.email:[email protected]`	Specific user
`@evt.name:Monitor AND @action:modified`	Compound
`-@action:deleted`	Negation
`@usr.email:*`	Field exists
`@network.client.ip:1.2.3.4`	IP filter

Retention

Default retention is 90 days. If querying beyond 90 days, archive to S3/GCS/Azure Blob must be configured. Always check whether the requested time window falls within retention before running a query.

Troubleshooting

Problem	Cause	Fix
403 Forbidden	Missing `audit_logs_read` scope	Add scope to app key in Datadog UI
Empty results	Time window outside retention	Check archive config; default max is 90 days
Timeout	Query too broad	Narrow time window or add more filters
No IP data	Internal action or pre-enrichment event	Not all events have geo data

References

來源與署名

來源：datadog-labs/agent-skills位於dd-audit提交5b40c73

授權條款：無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Dd Audit

Datadog Audit Trail

Sub-Skills

Prerequisites

Commands

Event Schema Quick Reference

Search Syntax

Retention

Troubleshooting

References

來源與署名

更多來自 datadog-labs/agent-skills 的技能

Upgrade Browser Sdk V7

Upgrade Browser Sdk V6

Dd Audit Security Investigation

Upgrade Browser Sdk V5

Dd Audit Key Compromise

Dd Audit Cost Spike Investigation

更多Security技能

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt

Secops Cases