AutoGineer
Generated banner for Dd Audit
Generated logo for Dd Audit

Dd Audit

DatadogOfficialCreated by datadog-labs

  • Skill
  • Review and audit
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

Audit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing.
— the description by datadog-labs

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The dd-audit skill provides a structured interface for querying and analyzing audit logs within Datadog. It enables users to perform security investigations, troubleshoot cost spikes, verify compliance evidence, and monitor AI-related activity. By leveraging the Audit Trail API, the skill allows for granular searches of user actions, API key usage, and configuration changes, supporting both operational debugging and security auditing requirements.

What it does

  • Investigates user activity and configuration changes to identify who performed specific actions.
  • Analyzes API key usage to detect potential compromises or suspicious access patterns.
  • Identifies root causes for cost spikes and usage increases, including LLM-related activity.
  • Generates compliance evidence for frameworks like SOC 2 and PCI.
  • Audits AI assistant interactions and tool calls for governance reporting.
  • Provides a search interface using Lucene-style syntax for precise log filtering.

When to use it

  • When you need to determine who modified or deleted a specific resource.
  • During a security incident to investigate potential API key compromise.
  • When investigating unexpected increases in service costs or usage.
  • When preparing audit logs for compliance reporting or user provisioning reviews.
  • When auditing AI agent behavior or governance logs.

Advantages

  • Centralizes audit data for security, compliance, and operational visibility.
  • Supports complex queries using familiar Lucene-style syntax.
  • Enables programmatic access to audit logs for automated reporting.
  • Provides clear event schema references for consistent log interpretation.

Usage examples

“Show me all dashboard deletions that occurred in the last 24 hours.”
The agent executes a search query for @evt.name:Dashboard and @action:deleted over the specified time range.
“Why did my bill increase? Investigate recent LLM usage.”
The agent queries audit logs for relevant resource activity to identify potential cost drivers.
“Generate a report of all actions taken by [email removed] over the last week.”
The agent retrieves and formats audit logs filtered by the specific user email for the requested duration.
“Was the API key key_abc123 used for any suspicious activity?”
The agent filters audit logs by the specified API key ID to display all associated actions.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/datadog-labs/dd-audit/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip dd-audit.zip -d .agents/skills

Documentation by datadog-labs

Datadog Audit Trail

Investigate user activity, configuration changes, access patterns, and compliance evidence using pup audit-logs.

Sub-Skills

Sub-skillUse when
security-investigation"Who changed X?", "What did this user do?", "Show me deletions in the last 24h"
key-compromise"Was this API key compromised?", "What did key XYZ do?", "Investigate suspicious key activity"
cost-spike-investigation"Why did my bill go up?", "What caused this usage spike?", "Investigate LLM cost increase"
compliance-report"Generate SOC 2 evidence", "PCI audit log", "User provisioning report for auditor"
ai-activity-audit"What did the AI assistant do?", "Audit MCP tool calls", "AI governance report"

Prerequisites

pup auth login   # OAuth2 (recommended)
# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

Commands

# List recent events
pup audit-logs list --from 1h --limit 100

# Search with a query
pup audit-logs search --query "@action:deleted" --from 24h

# JSON output for piping to jq
pup audit-logs search --query "@usr.email:[email protected]" --from 7d -o json | jq '.data[].attributes'

Event Schema Quick Reference

FieldDescriptionExample values
@usr.emailActor email[email protected]
@evt.actor.typeHow action was takenUSER, API_KEY, SUPPORT_USER
@actionVerbcreated, modified, deleted, accessed, login
@evt.nameEvent categoryDashboard, Monitor, Authentication, Access Management
@asset.typeResource typedashboard, monitor, api_key, role, user
@asset.idResource identifierabc-123
@metadata.api_key.idAPI key used (if applicable)key_abc123
@metadata.app_key.idApp key used (if applicable)app_abc123
@network.client.ipClient IP address1.2.3.4
@network.client.geoip.country.nameCountryUnited States
@network.client.geoip.as.nameASN nameAmazon.com
@http.url_details.pathAPI endpoint path/api/v1/dashboard/xyz

Search Syntax

Same Lucene-style syntax as Log Explorer:

QueryMeaning
@evt.name:DashboardExact field match
@action:deletedAction filter
@usr.email:[email protected]Specific user
@evt.name:Monitor AND @action:modifiedCompound
-@action:deletedNegation
@usr.email:*Field exists
@network.client.ip:1.2.3.4IP filter

Retention

Default retention is 90 days. If querying beyond 90 days, archive to S3/GCS/Azure Blob must be configured. Always check whether the requested time window falls within retention before running a query.

Troubleshooting

ProblemCauseFix
403 ForbiddenMissing audit_logs_read scopeAdd scope to app key in Datadog UI
Empty resultsTime window outside retentionCheck archive config; default max is 90 days
TimeoutQuery too broadNarrow time window or add more filters
No IP dataInternal action or pre-enrichment eventNot all events have geo data

References

Files

ATTRIBUTION.md

Attribution

This folder is an unmodified copy of the Agent Skill "dd-audit", distributed by AutoGineer (https://autogineer.com/agent-skills).

The skill's own files are unmodified copies. AutoGineer is not affiliated with or endorsed by the author or the publisher.

Files added by AutoGineer

  • ATTRIBUTION.md: this file, written by AutoGineer

  • LICENSE: copied from LICENSE

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
datadog-labs
Publisher
Datadog (Official)
Source
datadog-labs/agent-skills · dd-audit · commit 8e1306a
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by datadog-labs or Datadog.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download dd-audit.zip