AutoGineer
Generated banner for Dd Audit Key Compromise
Generated logo for Dd Audit Key Compromise

Dd Audit Key Compromise

DatadogOfficialCreated by datadog-labs

  • Skill
  • Review and audit
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

Investigate a potentially compromised Datadog API key — timeline of actions, geo/IP breakdown, endpoints called, anomaly flags, and remediation steps.
— the description by datadog-labs

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured investigation workflow to audit the activity of a specific Datadog API key. It guides users through reconstructing a timeline of actions, analyzing geographic and network origins, identifying frequently accessed endpoints, and detecting potentially destructive operations. The skill includes a set of anomaly flags to help identify signs of compromise and provides steps for key revocation.

What it does

  • Reconstructs a chronological timeline of actions performed by a specific API key.
  • Groups activity by geographic location, ASN, and IP address to identify unusual origins.
  • Summarizes the most frequently accessed API endpoints.
  • Filters for destructive actions such as resource deletions.
  • Retrieves creation details for the suspect API key.
  • Provides a template for summarizing investigation findings and remediation steps.

When to use it

  • When you suspect a Datadog API key has been compromised or misused.
  • To perform a security audit on the usage patterns of a specific API key.
  • When investigating unauthorized resource deletions or unexpected API activity.
  • To verify the origin and creator of a specific API key.

Advantages

  • Standardizes the investigation process for Datadog API key incidents.
  • Helps identify common indicators of compromise like unexpected geolocations or VPN usage.
  • Facilitates quick identification of affected resources and destructive actions.
  • Provides clear, actionable steps for remediation and key revocation.

Usage examples

“Investigate the activity of Datadog API key with ID 12345-abcde.”
The agent will execute a series of audit log queries to map the key's timeline, geographic origins, and endpoint usage, returning a summary of potential anomalies.
“Did the compromised API key perform any deletions?”
The agent will filter the audit logs for the specified key ID specifically for delete actions and report the timestamp and resource type of any found events.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/datadog-labs/dd-audit-key-compromise/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip dd-audit-key-compromise.zip -d .agents/skills

Documentation by datadog-labs

Audit Trail: API Key Compromise Investigation

Reconstruct what a Datadog API key did, where requests originated, and which resources were affected.

Prerequisites

pup auth login   # OAuth2 (recommended)
# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

You need the key ID of the suspect key (not the key value). Find it in Datadog UI under Organization Settings > API Keys, or from context showing @metadata.api_key.id.

Investigation Workflow

Step 1 — Establish timeline
pup audit-logs search --query "@metadata.api_key.id:KEY_ID" --from 90d --limit 200 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      action: .attributes.attributes.action,
      event: .attributes.attributes.evt.name,
      resource_type: .attributes.attributes.asset.type,
      resource_id: .attributes.attributes.asset.id,
      endpoint: .attributes.attributes.http.url_details.path,
      method: .attributes.attributes.http.method,
      ip: .attributes.attributes.network.client.ip,
      city: .attributes.attributes.network.client.geoip.city.name,
      country: .attributes.attributes.network.client.geoip.country.name,
      asn: .attributes.attributes.network.client.geoip.as.name
    }]'
Step 2 — Geo/IP breakdown
pup audit-logs search --query "@metadata.api_key.id:KEY_ID" --from 90d --limit 500 -o json \
  | jq '[.data[] | {
      country: .attributes.attributes.network.client.geoip.country.name,
      asn: .attributes.attributes.network.client.geoip.as.name,
      ip: .attributes.attributes.network.client.ip
    }]
    | group_by(.country)
    | map({
        country: .[0].country,
        count: length,
        asns: [.[].asn] | unique,
        ips: [.[].ip] | unique
      })
    | sort_by(-.count)'
Step 3 — Endpoint breakdown
pup audit-logs search --query "@metadata.api_key.id:KEY_ID" --from 90d --limit 500 -o json \
  | jq '[.data[] | {
      method: .attributes.attributes.http.method,
      path: .attributes.attributes.http.url_details.path
    }]
    | group_by(.path)
    | map({path: .[0].path, methods: [.[].method] | unique, count: length})
    | sort_by(-.count)'
Step 4 — Destructive action check
pup audit-logs search --query "@metadata.api_key.id:KEY_ID @action:deleted" --from 90d -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      resource_type: .attributes.attributes.asset.type,
      resource_id: .attributes.attributes.asset.id,
      ip: .attributes.attributes.network.client.ip,
      country: .attributes.attributes.network.client.geoip.country.name
    }]'
Step 5 — When was the key created and by whom?
pup audit-logs search --query "@asset.type:api_key @asset.id:KEY_ID @action:created" --from 90d -o json \
  | jq '[.data[] | {
      created_at: .attributes.timestamp,
      created_by: .attributes.attributes.usr.email,
      creator_ip: .attributes.attributes.network.client.ip,
      creator_country: .attributes.attributes.network.client.geoip.country.name
    }]'

Anomaly Flags

SignalWhy it matters
Country not in org's normal baselinePossible exfiltration from unexpected region
ASN is a cloud/VPN provider (AWS, Cloudflare, NordVPN, etc.)Proxied traffic; obscured origin
DELETE actions on monitors, dashboards, or log pipelinesPotential sabotage
Burst of activity in short windowAutomated scraping or bulk exfiltration
Activity outside business hoursOff-hours access
Key used from multiple IPs simultaneouslyKey shared or stolen

Investigation Output Format

Key ID: <key_id>
Created: <timestamp> by <user_email>
Active period: <first_seen> to <last_seen>
Total events: <N>

Origins:
  - <Country> (<ASN>): <N> events — [NORMAL / FLAG: first-time origin]

Endpoints called (top 5):
  - <METHOD> <path>: <N> calls

Destructive actions: <N> deletions — [resource types affected]

Recommended actions:
  1. Revoke the key immediately if not already done
  2. Review affected resources: [list]
  3. Check if any deleted resources need restoration
  4. Audit who else had access to this key

Remediation

Revoke in Datadog UI: Organization Settings > API Keys > Revoke.

Or via API (requires manage_api_keys scope):

pup api-keys delete KEY_ID

References

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
datadog-labs
Publisher
Datadog (Official)
Source
datadog-labs/agent-skills · dd-audit/key-compromise · commit 8e1306a
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by datadog-labs or Datadog.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download dd-audit-key-compromise.zip