Dd Audit Compliance Report

作者 datadog-labs5b40c73824ec無授權條款177 個星標收錄於 2026年10月8日更新於 2026年10月8日儲存庫今天更新

Generate auditor-ready compliance evidence from Datadog Audit Trail for SOC 2 and PCI DSS. Maps framework controls to specific query patterns and produces formatted output.

僅含說明Security Business & Finance

AI 產生的概覽

根據 Datadog Audit Trail 日誌產生可供稽核使用的 SOC 2 與 PCI DSS 合規證據報告。

功能: 此技能引導代理從 Datadog Audit Trail 產生合規證據報告。它將 SOC 2 與 PCI DSS 控制項對應到特定的 Datadog 稽核日誌查詢模式，執行保留期檢查，並把蒐集到的事件整理成結構化證據報告，包含依控制項分列的事件表格與缺口段落。它也說明範圍界線，指出證據涵蓋的是 Datadog 平台，而非持卡人資料環境。
適用情境: 適用於需要從 Datadog Audit Trail 準備 SOC 2 或 PCI DSS 稽核證據的情況，例如依指定期間蒐集使用者開通與停用、角色變更、登入失敗或特權操作紀錄。適合需要控制項與查詢對應並產出格式化報告的合規與稽核準備工作。
執行需求: 需要 Datadog pup 命令列工具並完成身分驗證（建議透過 pup auth login 使用 OAuth2，或設定具備 audit_logs_read 權限的 DD_API_KEY 與 DD_APP_KEY），需要 jq 處理 JSON，並需要連線至 Datadog 的網路存取。此技能未附帶指令碼，僅為說明文件，另含一份控制項與查詢對應及保留期要求的參考檔案。

Audit Trail: Compliance Evidence Report

Generate auditor-ready evidence from Datadog Audit Trail for SOC 2 and PCI DSS control requirements.

Prerequisites

bash

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

pup auth login   # OAuth2 (recommended)# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

Read First

See references/control-mapping.md for the full control → query mapping table and retention requirements by framework.

Retention Check (Run First)

PCI requires 12 months. Datadog default retention is 90 days. Check whether archive is configured:

bash

pup audit-logs search --query "@evt.name:\"Audit Trail\" @action:modified" --from 90d -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource: .attributes.attributes.asset.type    }]'

pup audit-logs search --query "@evt.name:\"Audit Trail\" @action:modified" --from 90d -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource: .attributes.attributes.asset.type    }]'

If the requested time window exceeds 90 days and no archive is confirmed, surface this gap in the report header.

Workflow

Confirm: framework (SOC 2 / PCI DSS), time window, org scope
Run retention check
Run each relevant control query
Format output using the Evidence Report template

SOC 2 Queries

CC6.2 — User Provisioning / Deprovisioning

bash

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:user @action:(created OR deleted OR modified)" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      affected_user: .attributes.attributes.asset.id    }]'

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:user @action:(created OR deleted OR modified)" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      affected_user: .attributes.attributes.asset.id    }]'

CC6.3 — Role and Permission Changes

bash

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:role" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      role_id: .attributes.attributes.asset.id    }]'

pup audit-logs search \  --query "@evt.name:\"Access Management\" @asset.type:role" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      role_id: .attributes.attributes.asset.id    }]'

CC6.6 — Failed Logins and Suspicious Access

bash

pup audit-logs search \  --query "@evt.name:Authentication @action:login @status:error" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

pup audit-logs search \  --query "@evt.name:Authentication @action:login @status:error" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

CC7.2 — Privileged / Support User Actions

bash

pup audit-logs search \  --query "@evt.actor.type:SUPPORT_USER" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      support_actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id    }]'

pup audit-logs search \  --query "@evt.actor.type:SUPPORT_USER" \  --from PERIOD_START --to PERIOD_END --limit 500 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      support_actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id    }]'

PCI DSS Queries

PCI 10.2.2 — Actions by Privileged Users

Same as CC7.2 above. Also include org-level admin actions:

bash

pup audit-logs search \  --query "@evt.name:\"Organization Management\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

pup audit-logs search \  --query "@evt.name:\"Organization Management\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

PCI 10.2.3 — Access to Audit Trail Itself

bash

pup audit-logs search \  --query "@evt.name:\"Audit Trail\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

pup audit-logs search \  --query "@evt.name:\"Audit Trail\"" \  --from PERIOD_START --to PERIOD_END --limit 200 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      actor: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type    }]'

PCI 10.2.4 — Invalid Access Attempts

Same as CC6.6 failed logins above.

PCI 10.2.5 — All Authentication Events

bash

pup audit-logs search \  --query "@evt.name:Authentication @action:login" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      auth_method: .attributes.attributes.auth_method,      result: .attributes.attributes.status,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

pup audit-logs search \  --query "@evt.name:Authentication @action:login" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      auth_method: .attributes.attributes.auth_method,      result: .attributes.attributes.status,      ip: .attributes.attributes.network.client.ip,      country: .attributes.attributes.network.client.geoip.country.name    }]'

PCI 10.2.7 — Object Creation and Deletion

bash

pup audit-logs search \  --query "@action:(created OR deleted)" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id,      ip: .attributes.attributes.network.client.ip    }]'

pup audit-logs search \  --query "@action:(created OR deleted)" \  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \  | jq '[.data[] | {      timestamp: .attributes.timestamp,      user: .attributes.attributes.usr.email,      action: .attributes.attributes.action,      resource_type: .attributes.attributes.asset.type,      resource_id: .attributes.attributes.asset.id,      ip: .attributes.attributes.network.client.ip    }]'

Evidence Report Template

# Datadog Audit Trail — Compliance Evidence ReportFramework: [SOC 2 / PCI DSS]Organization: [org name]Period: [start] to [end]Generated: [date]
## Scope BoundaryThis report covers administrative actions within the Datadog platform.It does not cover actions taken within systems that Datadog monitors.
## Retention Status[✓ Full period covered by Audit Trail retention][⚠ Requested period exceeds 90-day default. Archive config required for complete coverage.]
---
## [Control ID] — [Control Name]Events found: [N]
| Timestamp | Actor | Action | Resource Type | Resource ID | IP | Country ||-----------|-------|--------|---------------|-------------|-----|---------|| ...       | ...   | ...    | ...           | ...         | ... | ...     |
[Repeat per control]
---
## Gaps[List any controls where data was unavailable or incomplete, and why]

# Datadog Audit Trail — Compliance Evidence ReportFramework: [SOC 2 / PCI DSS]Organization: [org name]Period: [start] to [end]Generated: [date]
## Scope BoundaryThis report covers administrative actions within the Datadog platform.It does not cover actions taken within systems that Datadog monitors.
## Retention Status[✓ Full period covered by Audit Trail retention][⚠ Requested period exceeds 90-day default. Archive config required for complete coverage.]
---
## [Control ID] — [Control Name]Events found: [N]
| Timestamp | Actor | Action | Resource Type | Resource ID | IP | Country ||-----------|-------|--------|---------------|-------------|-----|---------|| ...       | ...   | ...    | ...           | ...         | ... | ...     |
[Repeat per control]
---
## Gaps[List any controls where data was unavailable or incomplete, and why]

Scope Caveat

Datadog Audit Trail covers the Datadog platform as the system being audited. For PCI purposes, this is evidence that the monitoring platform's access controls are functioning — not direct evidence about the cardholder data environment (CDE) itself. Auditors should understand this scope boundary.

References

來源與署名

來源：datadog-labs/agent-skills位於dd-audit/compliance-report提交5b40c73

授權條款：無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Dd Audit Compliance Report

Audit Trail: Compliance Evidence Report

Prerequisites

Read First

Retention Check (Run First)

Workflow

SOC 2 Queries

CC6.2 — User Provisioning / Deprovisioning

CC6.3 — Role and Permission Changes

CC6.6 — Failed Logins and Suspicious Access

CC7.2 — Privileged / Support User Actions

PCI DSS Queries

PCI 10.2.2 — Actions by Privileged Users

PCI 10.2.3 — Access to Audit Trail Itself

PCI 10.2.4 — Invalid Access Attempts

PCI 10.2.5 — All Authentication Events

PCI 10.2.7 — Object Creation and Deletion

Evidence Report Template

Scope Caveat

References

來源與署名

更多來自 datadog-labs/agent-skills 的技能

Upgrade Browser Sdk V7

Upgrade Browser Sdk V6

Dd Audit Security Investigation

Upgrade Browser Sdk V5

Dd Audit Key Compromise

Dd Audit Cost Spike Investigation

更多Security技能

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt