Dd Audit Compliance Report — Agent Skill by Datadog

From the author

Generate auditor-ready compliance evidence from Datadog Audit Trail for SOC 2 and PCI DSS. Maps framework controls to specific query patterns and produces formatted output.

— the description by datadog-labs

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured workflow to extract, format, and report on compliance evidence from Datadog Audit Trail. It maps specific compliance controls from SOC 2 and PCI DSS frameworks to corresponding Datadog query patterns. The process includes a mandatory retention check to ensure data availability for audit periods, followed by targeted queries for user management, authentication events, and privileged access. It concludes with a standardized reporting template to help organizations present audit-ready documentation.

What it does

Maps SOC 2 and PCI DSS compliance controls to specific Datadog Audit Trail queries.
Performs a retention check to verify if audit logs cover the requested audit period.
Executes automated queries to extract logs for user provisioning, role changes, and logins.
Captures privileged user actions and system object modifications for audit trails.
Provides a standardized template for generating formal compliance evidence reports.
Highlights scope boundaries to ensure auditors understand the platform-level focus of the evidence.

When to use it

When preparing for a SOC 2 or PCI DSS audit and needing evidence of platform access controls.
When performing periodic internal compliance reviews of Datadog administrative activity.
When verifying that administrative actions and authentication events are being logged correctly.
When assessing whether current log retention settings meet the 12-month requirement for PCI DSS.

Advantages

Reduces manual effort in gathering evidence for common compliance frameworks.
Ensures consistency in reporting by using standardized query patterns and templates.
Proactively identifies potential data gaps due to default log retention limits.
Clearly defines the scope of evidence to prevent auditor confusion regarding monitored systems.

Usage examples

“Generate a PCI DSS compliance report for the last 6 months.”: The agent will run the retention check, execute the specific PCI 10.2 queries for the requested timeframe, and populate the evidence report template with the extracted log data.
“Show me all failed login attempts for the SOC 2 audit.”: The agent executes the CC6.6 query pattern, returning a formatted list of timestamps, users, IPs, and geographic locations of failed authentication attempts.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/datadog-labs/dd-audit-compliance-report/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip dd-audit-compliance-report.zip -d .agents/skills

Documentation by datadog-labs

Audit Trail: Compliance Evidence Report

Generate auditor-ready evidence from Datadog Audit Trail for SOC 2 and PCI DSS control requirements.

Prerequisites

pup auth login   # OAuth2 (recommended)
# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

Read First

See references/control-mapping.md for the full control → query mapping table and retention requirements by framework.

Retention Check (Run First)

PCI requires 12 months. Datadog default retention is 90 days. Check whether archive is configured:

pup audit-logs search --query "@evt.name:\"Audit Trail\" @action:modified" --from 90d -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      resource: .attributes.attributes.asset.type
    }]'

If the requested time window exceeds 90 days and no archive is confirmed, surface this gap in the report header.

Workflow

Confirm: framework (SOC 2 / PCI DSS), time window, org scope
Run retention check
Run each relevant control query
Format output using the Evidence Report template

SOC 2 Queries

CC6.2 — User Provisioning / Deprovisioning

pup audit-logs search \
  --query "@evt.name:\"Access Management\" @asset.type:user @action:(created OR deleted OR modified)" \
  --from PERIOD_START --to PERIOD_END --limit 500 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      actor: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      affected_user: .attributes.attributes.asset.id
    }]'

CC6.3 — Role and Permission Changes

pup audit-logs search \
  --query "@evt.name:\"Access Management\" @asset.type:role" \
  --from PERIOD_START --to PERIOD_END --limit 500 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      actor: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      role_id: .attributes.attributes.asset.id
    }]'

CC6.6 — Failed Logins and Suspicious Access

pup audit-logs search \
  --query "@evt.name:Authentication @action:login @status:error" \
  --from PERIOD_START --to PERIOD_END --limit 500 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      ip: .attributes.attributes.network.client.ip,
      country: .attributes.attributes.network.client.geoip.country.name
    }]'

CC7.2 — Privileged / Support User Actions

pup audit-logs search \
  --query "@evt.actor.type:SUPPORT_USER" \
  --from PERIOD_START --to PERIOD_END --limit 500 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      support_actor: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      resource_type: .attributes.attributes.asset.type,
      resource_id: .attributes.attributes.asset.id
    }]'

PCI DSS Queries

PCI 10.2.2 — Actions by Privileged Users

Same as CC7.2 above. Also include org-level admin actions:

pup audit-logs search \
  --query "@evt.name:\"Organization Management\"" \
  --from PERIOD_START --to PERIOD_END --limit 200 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      actor: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      resource_type: .attributes.attributes.asset.type
    }]'

PCI 10.2.3 — Access to Audit Trail Itself

pup audit-logs search \
  --query "@evt.name:\"Audit Trail\"" \
  --from PERIOD_START --to PERIOD_END --limit 200 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      actor: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      resource_type: .attributes.attributes.asset.type
    }]'

PCI 10.2.4 — Invalid Access Attempts

Same as CC6.6 failed logins above.

PCI 10.2.5 — All Authentication Events

pup audit-logs search \
  --query "@evt.name:Authentication @action:login" \
  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      auth_method: .attributes.attributes.auth_method,
      result: .attributes.attributes.status,
      ip: .attributes.attributes.network.client.ip,
      country: .attributes.attributes.network.client.geoip.country.name
    }]'

PCI 10.2.7 — Object Creation and Deletion

pup audit-logs search \
  --query "@action:(created OR deleted)" \
  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      resource_type: .attributes.attributes.asset.type,
      resource_id: .attributes.attributes.asset.id,
      ip: .attributes.attributes.network.client.ip
    }]'

Evidence Report Template

# Datadog Audit Trail — Compliance Evidence Report
Framework: [SOC 2 / PCI DSS]
Organization: [org name]
Period: [start] to [end]
Generated: [date]

## Scope Boundary
This report covers administrative actions within the Datadog platform.
It does not cover actions taken within systems that Datadog monitors.

## Retention Status
[✓ Full period covered by Audit Trail retention]
[⚠ Requested period exceeds 90-day default. Archive config required for complete coverage.]

---

## [Control ID] — [Control Name]
Events found: [N]

| Timestamp | Actor | Action | Resource Type | Resource ID | IP | Country |
|-----------|-------|--------|---------------|-------------|-----|---------|
| ...       | ...   | ...    | ...           | ...         | ... | ...     |

[Repeat per control]

---

## Gaps
[List any controls where data was unavailable or incomplete, and why]

Scope Caveat

Datadog Audit Trail covers the Datadog platform as the system being audited. For PCI purposes, this is evidence that the monitoring platform's access controls are functioning — not direct evidence about the cardholder data environment (CDE) itself. Auditors should understand this scope boundary.

References

Files

ATTRIBUTION.mdAdded by AutoGineer977 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md6.8 KiB
references/control-mapping.md3.7 KiB

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude Code
MITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download dd-audit-compliance-report.zip