AutoGineer
Generated banner for Dd Audit Security Investigation
Generated logo for Dd Audit Security Investigation

Dd Audit Security Investigation

DatadogOfficialCreated by datadog-labs

  • Skill
  • Tool integration
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

Answer "who did what" security questions from Audit Trail — deletions, config changes, login activity, permission changes, actions from a specific user or IP.
— the description by datadog-labs

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured approach to investigating security events within Datadog. It leverages the audit logs to answer critical 'who did what' questions, such as tracking resource deletions, configuration changes, login activity, and permission modifications. The skill includes a set of pre-defined query patterns for common scenarios, guidance on anomaly detection, and a reference for event categories, enabling users to efficiently audit their environment and identify potential security concerns.

What it does

  • Searches audit logs for specific actions like deletions or configuration changes.
  • Tracks user activity, including logins, permission changes, and API key management.
  • Filters audit events by resource ID, user email, IP address, or time window.
  • Provides patterns for summarizing large result sets using data processing tools.
  • Highlights security anomalies such as bulk operations, unusual geo-locations, and off-hours activity.
  • Maps audit events to specific categories for easier investigation.

When to use it

  • When you need to identify who performed a specific action on a resource.
  • During security incident response to trace unauthorized changes or access.
  • When auditing user access management and role changes.
  • To investigate suspicious login activity or failed authentication attempts.
  • When reviewing the lifecycle of API keys or integration configurations.

Advantages

  • Standardizes the investigation process for common security questions.
  • Reduces manual effort by providing ready-to-use query templates.
  • Helps surface critical anomalies like support user access or unexpected geo-locations.
  • Facilitates clear reporting by structuring raw audit log data.

Usage examples

“Who deleted resources in the last 24 hours?”
The agent executes a search for deletion actions and returns a summarized list of timestamps, users, resource types, and the country of origin.
“Show me all failed login attempts from the last week.”
The agent queries the authentication logs for status errors and provides a report of users, IPs, and locations associated with the failed attempts.
“What actions were performed by [email removed] recently?”
The agent retrieves a detailed log of all actions, events, and resources touched by the specified user over the last 7 days.
“List all changes to roles or permissions in the last month.”
The agent filters audit logs for Access Management events and outputs a list of users and the specific resources or roles they modified.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/datadog-labs/dd-audit-security-investigation/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip dd-audit-security-investigation.zip -d .agents/skills

Documentation by datadog-labs

Audit Trail: Security Investigation

Answer common security investigation questions using pup audit-logs.

Prerequisites

pup auth login   # OAuth2 (recommended)
# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

Command Execution Order

  1. Clarify the investigation scope: who, what resource type, what time window.

  2. Run the most specific query first; broaden only if results are empty.

  3. If results are large, pipe to jq to group or summarize.

  4. Highlight anomalies: bulk operations, unusual geo, off-hours activity, support user actions.

Common Investigation Queries

Who deleted resources in a time window?
pup audit-logs search --query "@action:deleted" --from 24h -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      actor_type: .attributes.attributes.evt.actor.type,
      resource_type: .attributes.attributes.asset.type,
      resource_id: .attributes.attributes.asset.id,
      country: .attributes.attributes.network.client.geoip.country.name
    }]'
Who modified a specific resource (by ID)?
pup audit-logs search --query "@asset.id:RESOURCE_ID" --from 7d -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      event: .attributes.attributes.evt.name
    }]'
What did a specific user do?
pup audit-logs search --query "@usr.email:[email protected]" --from 7d --limit 200 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      action: .attributes.attributes.action,
      event: .attributes.attributes.evt.name,
      resource_type: .attributes.attributes.asset.type,
      resource_id: .attributes.attributes.asset.id,
      ip: .attributes.attributes.network.client.ip,
      country: .attributes.attributes.network.client.geoip.country.name
    }]'
Login activity — all logins with geo
pup audit-logs search --query "@evt.name:Authentication @action:login" --from 7d --limit 200 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      status: .attributes.attributes.status,
      ip: .attributes.attributes.network.client.ip,
      city: .attributes.attributes.network.client.geoip.city.name,
      country: .attributes.attributes.network.client.geoip.country.name,
      asn: .attributes.attributes.network.client.geoip.as.name
    }]'
Failed logins only
pup audit-logs search --query "@evt.name:Authentication @action:login @status:error" --from 7d --limit 200 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      ip: .attributes.attributes.network.client.ip,
      country: .attributes.attributes.network.client.geoip.country.name
    }]'
Who changed roles or permissions?
pup audit-logs search --query "@evt.name:\"Access Management\"" --from 30d --limit 200 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      resource_type: .attributes.attributes.asset.type,
      resource_id: .attributes.attributes.asset.id
    }]'
What actions came from a specific IP?
pup audit-logs search --query "@network.client.ip:1.2.3.4" --from 30d --limit 200 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      actor_type: .attributes.attributes.evt.actor.type,
      action: .attributes.attributes.action,
      event: .attributes.attributes.evt.name,
      resource_type: .attributes.attributes.asset.type
    }]'
Who created or deleted API keys?
pup audit-logs search --query "@evt.name:Authentication @asset.type:api_key" --from 90d --limit 200 -o json \
  | jq '[.data[] | {
      timestamp: .attributes.timestamp,
      user: .attributes.attributes.usr.email,
      action: .attributes.attributes.action,
      key_id: .attributes.attributes.asset.id,
      ip: .attributes.attributes.network.client.ip,
      country: .attributes.attributes.network.client.geoip.country.name
    }]'

Event Category Reference

Category (@evt.name)What it covers
AuthenticationLogins, API key create/delete/modify
Access ManagementRoles, user add/remove, restriction policies
DashboardCreate, modify, delete, share
MonitorCreate, modify, delete, resolve
Log ManagementPipelines, indexes, archives, exclusion filters
IntegrationAdd/modify/delete integrations
MetricsCustom metric create/modify/delete
Organization ManagementChild org creation, org settings
NotebookCreate, modify, delete
APMRetention filters, sampling config
Cloud Security PlatformCWS rules, security signal state changes
Bits AI SREMCP tool calls, AI investigations

Anomaly Flags to Surface

When presenting investigation results, call out:

  • Actor type SUPPORT_USER — Datadog support accessed the org

  • Bulk deletions — same user, same action, many resources in a short window

  • Unexpected geography — country not seen in prior logins for this user

  • Off-hours activity — actions at unusual times for the user's typical timezone

  • First-time ASN — action from a cloud provider or VPN not seen before (@network.client.geoip.as.name)

References

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
datadog-labs
Publisher
Datadog (Official)
Source
datadog-labs/agent-skills · dd-audit/security-investigation · commit 8e1306a
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by datadog-labs or Datadog.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download dd-audit-security-investigation.zip