Dd Audit Compliance Report

DatadogOfficialCreated by datadog-labs

Skill
Content generator
Security
MIT
No issues found

From the author

Generate auditor-ready compliance evidence from Datadog Audit Trail for SOC 2 and PCI DSS. Maps framework controls to specific query patterns and produces formatted output.

— the description by datadog-labs

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured workflow to extract, format, and report on compliance evidence from Datadog Audit Trail. It maps specific compliance controls from SOC 2 and PCI DSS frameworks to corresponding Datadog query patterns. The process includes a mandatory retention check to ensure data availability for audit periods, followed by targeted queries for user management, authentication events, and privileged access. It concludes with a standardized reporting template to help organizations present audit-ready documentation.

What it does

Maps SOC 2 and PCI DSS compliance controls to specific Datadog Audit Trail queries.
Performs a retention check to verify if audit logs cover the requested audit period.
Executes automated queries to extract logs for user provisioning, role changes, and logins.
Captures privileged user actions and system object modifications for audit trails.
Provides a standardized template for generating formal compliance evidence reports.
Highlights scope boundaries to ensure auditors understand the platform-level focus of the evidence.

When to use it

When preparing for a SOC 2 or PCI DSS audit and needing evidence of platform access controls.
When performing periodic internal compliance reviews of Datadog administrative activity.
When verifying that administrative actions and authentication events are being logged correctly.
When assessing whether current log retention settings meet the 12-month requirement for PCI DSS.

Advantages

Reduces manual effort in gathering evidence for common compliance frameworks.
Ensures consistency in reporting by using standardized query patterns and templates.
Proactively identifies potential data gaps due to default log retention limits.
Clearly defines the scope of evidence to prevent auditor confusion regarding monitored systems.

Usage examples

“Generate a PCI DSS compliance report for the last 6 months.”: The agent will run the retention check, execute the specific PCI 10.2 queries for the requested timeframe, and populate the evidence report template with the extracted log data.
“Show me all failed login attempts for the SOC 2 audit.”: The agent executes the CC6.6 query pattern, returning a formatted list of timestamps, users, IPs, and geographic locations of failed authentication attempts.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/datadog-labs/dd-audit-compliance-report/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip dd-audit-compliance-report.zip -d .agents/skills

Documentation by datadog-labs

Audit Trail: Compliance Evidence Report

Generate auditor-ready evidence from Datadog Audit Trail for SOC 2 and PCI DSS control requirements.

Prerequisites

pup auth login   # OAuth2 (recommended)
# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

Read First

See references/control-mapping.md for the full control → query mapping table and retention requirements by framework.

Retention Check (Run First)

PCI requires 12 months. Datadog default retention is 90 days. Check whether archive is configured:

pup audit-logs search --query "@evt.name:\"Audit Trail\" @action:modified" --from 90d -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      resource: .attributes.attributes.asset.type
    }]'

If the requested time window exceeds 90 days and no archive is confirmed, surface this gap in the report header.

Workflow

Confirm: framework (SOC 2 / PCI DSS), time window, org scope
Run retention check
Run each relevant control query
Format output using the Evidence Report template

SOC 2 Queries

CC6.2 — User Provisioning / Deprovisioning

pup audit-logs search \
  --query "@evt.name:\"Access Management\" @asset.type:user @action:(created OR deleted OR modified)" \
  --from PERIOD_START --to PERIOD_END --limit 500 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      actor: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      affected_user: .attributes.attributes.asset.id
    }]'

CC6.3 — Role and Permission Changes

pup audit-logs search \
  --query "@evt.name:\"Access Management\" @asset.type:role" \
  --from PERIOD_START --to PERIOD_END --limit 500 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      actor: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      role_id: .attributes.attributes.asset.id
    }]'

CC6.6 — Failed Logins and Suspicious Access

pup audit-logs search \
  --query "@evt.name:Authentication @action:login @status:error" \
  --from PERIOD_START --to PERIOD_END --limit 500 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      ip: .attributes.attributes.network.client.ip,
      country: .attributes.attributes.network.client.geoip.country.name
    }]'

CC7.2 — Privileged / Support User Actions

pup audit-logs search \
  --query "@evt.actor.type:SUPPORT_USER" \
  --from PERIOD_START --to PERIOD_END --limit 500 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      support_actor: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      resource_type: .attributes.attributes.asset.type,
      resource_id: .attributes.attributes.asset.id
    }]'

PCI DSS Queries

PCI 10.2.2 — Actions by Privileged Users

Same as CC7.2 above. Also include org-level admin actions:

pup audit-logs search \
  --query "@evt.name:\"Organization Management\"" \
  --from PERIOD_START --to PERIOD_END --limit 200 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      actor: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      resource_type: .attributes.attributes.asset.type
    }]'

PCI 10.2.3 — Access to Audit Trail Itself

pup audit-logs search \
  --query "@evt.name:\"Audit Trail\"" \
  --from PERIOD_START --to PERIOD_END --limit 200 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      actor: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      resource_type: .attributes.attributes.asset.type
    }]'

PCI 10.2.4 — Invalid Access Attempts

Same as CC6.6 failed logins above.

PCI 10.2.5 — All Authentication Events

pup audit-logs search \
  --query "@evt.name:Authentication @action:login" \
  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      auth_method: .attributes.attributes.auth_method,
      result: .attributes.attributes.status,
      ip: .attributes.attributes.network.client.ip,
      country: .attributes.attributes.network.client.geoip.country.name
    }]'

PCI 10.2.7 — Object Creation and Deletion

pup audit-logs search \
  --query "@action:(created OR deleted)" \
  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      resource_type: .attributes.attributes.asset.type,
      resource_id: .attributes.attributes.asset.id,
      ip: .attributes.attributes.network.client.ip
    }]'

Evidence Report Template

# Datadog Audit Trail — Compliance Evidence Report
Framework: [SOC 2 / PCI DSS]
Organization: [org name]
Period: [start] to [end]
Generated: [date]

## Scope Boundary
This report covers administrative actions within the Datadog platform.
It does not cover actions taken within systems that Datadog monitors.

## Retention Status
[✓ Full period covered by Audit Trail retention]
[⚠ Requested period exceeds 90-day default. Archive config required for complete coverage.]

---

## [Control ID] — [Control Name]
Events found: [N]

| Timestamp | Actor | Action | Resource Type | Resource ID | IP | Country |
|-----------|-------|--------|---------------|-------------|-----|---------|
| ...       | ...   | ...    | ...           | ...         | ... | ...     |

[Repeat per control]

---

## Gaps
[List any controls where data was unavailable or incomplete, and why]

Scope Caveat

Datadog Audit Trail covers the Datadog platform as the system being audited. For PCI purposes, this is evidence that the monitoring platform's access controls are functioning — not direct evidence about the cardholder data environment (CDE) itself. Auditors should understand this scope boundary.

References

Files

ATTRIBUTION.mdAdded by AutoGineer977 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md6.8 KiB
references/control-mapping.md3.7 KiB

references/control-mapping.md

Compliance Control → Audit Trail Query Mapping

Scope Boundary

Datadog Audit Trail documents actions within the Datadog platform:

Who logged in, from where
Who changed monitors, dashboards, log pipelines, integrations, roles, API keys
What the Bits AI assistant did on behalf of users

It does not document:

Actions within systems that Datadog monitors (AWS, GCP, application servers)
Content of data ingested by Datadog (logs, traces, metrics values)
Network activity between user systems and Datadog

SOC 2 Trust Services Criteria

Control	Description	Audit Trail Query	Fields Used
CC6.1	Logical access controls implemented	Review role assignments	`@evt.name:"Access Management" @asset.type:role`
CC6.2	User registration and deprovisioning	User lifecycle events	`@evt.name:"Access Management" @asset.type:user @action:(created OR deleted)`
CC6.3	Role-based access	Permission change log	`@evt.name:"Access Management" @asset.type:role`
CC6.6	Logical access boundaries	Failed logins, geo anomalies	`@evt.name:Authentication @action:login @status:error`
CC6.8	Prevent unauthorized access	API key management	`@evt.name:Authentication @asset.type:api_key`
CC7.2	System monitoring — anomaly detection	Privileged/support access	`@evt.actor.type:SUPPORT_USER`
CC7.3	Event response	Changes during incident window	Time-scoped `@action:modified` + `@evt.name` filter
A1.1	Availability monitoring	Monitor create/delete events	`@evt.name:Monitor`

PCI DSS Requirement 10 — Audit Logging

Req	Description	Audit Trail Query	PCI Field Mapping
10.2.1	Access to cardholder data	Dashboard/resource access events	`@http.method:GET @asset.type:dashboard`
10.2.2	Actions by root/privileged users	Support user and org admin events	`@evt.actor.type:SUPPORT_USER`
10.2.3	Access to audit trail	Audit Trail config events	`@evt.name:"Audit Trail"`
10.2.4	Invalid access attempts	Failed authentication events	`@evt.name:Authentication @status:error`
10.2.5	Use of identification/auth mechanisms	All login events	`@evt.name:Authentication @action:login`
10.2.6	Initialization/stopping of audit logs	Audit retention setting changes	`@evt.name:"Audit Trail" @action:modified`
10.2.7	Creation/deletion of system objects	All create/delete events	`@action:(created OR deleted)`
10.3.1	User identification	`@usr.email` field	Present on all user-initiated events
10.3.2	Event type	`@action`, `@evt.name` fields	Present on all events
10.3.3	Date and time	`timestamp` field	ISO 8601 UTC on all events
10.3.4	Success/failure indication	`@status` field	`info`/`error`/`warn`
10.3.5	Origination of event	`@network.client.ip` field	Present on most events
10.3.6	Identity of affected data/component	`@asset.type`, `@asset.id` fields	Present on resource events
10.7	Retain audit logs ≥12 months	Check archive config	Default 90 days — must configure archive

Retention Requirements by Framework

Framework	Required retention	Datadog default	Gap?
SOC 2	Auditor discretion (typically 12 months)	90 days	Yes — configure archive
PCI DSS	12 months minimum	90 days	Yes — configure archive
ISO 27001	3 years typical	90 days	Yes — configure archive
HIPAA	6 years	90 days	Yes — configure archive

To configure archive: Datadog UI > Security > Audit Trail > Configure > Archive to S3/GCS/Azure Blob.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

datadog-labs

Publisher

Datadog (Official)

Source

datadog-labs/agent-skills · dd-audit/compliance-report · commit 8e1306a

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

AutoGineer is not affiliated with or endorsed by datadog-labs or Datadog.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download dd-audit-compliance-report.zip