Dd Audit Security Investigation
DatadogOfficialCreated by datadog-labs
- Skill
- Tool integration
- Security
- MIT
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
This skill provides a structured approach to investigating security events within Datadog. It leverages the audit logs to answer critical 'who did what' questions, such as tracking resource deletions, configuration changes, login activity, and permission modifications. The skill includes a set of pre-defined query patterns for common scenarios, guidance on anomaly detection, and a reference for event categories, enabling users to efficiently audit their environment and identify potential security concerns.
What it does
- Searches audit logs for specific actions like deletions or configuration changes.
- Tracks user activity, including logins, permission changes, and API key management.
- Filters audit events by resource ID, user email, IP address, or time window.
- Provides patterns for summarizing large result sets using data processing tools.
- Highlights security anomalies such as bulk operations, unusual geo-locations, and off-hours activity.
- Maps audit events to specific categories for easier investigation.
When to use it
- When you need to identify who performed a specific action on a resource.
- During security incident response to trace unauthorized changes or access.
- When auditing user access management and role changes.
- To investigate suspicious login activity or failed authentication attempts.
- When reviewing the lifecycle of API keys or integration configurations.
Advantages
- Standardizes the investigation process for common security questions.
- Reduces manual effort by providing ready-to-use query templates.
- Helps surface critical anomalies like support user access or unexpected geo-locations.
- Facilitates clear reporting by structuring raw audit log data.
Usage examples
- “Who deleted resources in the last 24 hours?”
- The agent executes a search for deletion actions and returns a summarized list of timestamps, users, resource types, and the country of origin.
- “Show me all failed login attempts from the last week.”
- The agent queries the authentication logs for status errors and provides a report of users, IPs, and locations associated with the failed attempts.
- “What actions were performed by [email removed] recently?”
- The agent retrieves a detailed log of all actions, events, and resources touched by the specified user over the last 7 days.
- “List all changes to roles or permissions in the last month.”
- The agent filters audit logs for Access Management events and outputs a list of users and the specific resources or roles they modified.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/datadog-labs/dd-audit-security-investigation/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip dd-audit-security-investigation.zip -d .agents/skills
Documentation by datadog-labs
Audit Trail: Security Investigation
Answer common security investigation questions using pup audit-logs.
Prerequisites
pup auth login # OAuth2 (recommended)
# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scopeCommand Execution Order
Clarify the investigation scope: who, what resource type, what time window.
Run the most specific query first; broaden only if results are empty.
If results are large, pipe to
jqto group or summarize.Highlight anomalies: bulk operations, unusual geo, off-hours activity, support user actions.
Common Investigation Queries
Who deleted resources in a time window?
pup audit-logs search --query "@action:deleted" --from 24h -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
actor_type: .attributes.attributes.evt.actor.type,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id,
country: .attributes.attributes.network.client.geoip.country.name
}]'Who modified a specific resource (by ID)?
pup audit-logs search --query "@asset.id:RESOURCE_ID" --from 7d -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
action: .attributes.attributes.action,
event: .attributes.attributes.evt.name
}]'What did a specific user do?
pup audit-logs search --query "@usr.email:[email protected]" --from 7d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
action: .attributes.attributes.action,
event: .attributes.attributes.evt.name,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id,
ip: .attributes.attributes.network.client.ip,
country: .attributes.attributes.network.client.geoip.country.name
}]'Login activity — all logins with geo
pup audit-logs search --query "@evt.name:Authentication @action:login" --from 7d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
status: .attributes.attributes.status,
ip: .attributes.attributes.network.client.ip,
city: .attributes.attributes.network.client.geoip.city.name,
country: .attributes.attributes.network.client.geoip.country.name,
asn: .attributes.attributes.network.client.geoip.as.name
}]'Failed logins only
pup audit-logs search --query "@evt.name:Authentication @action:login @status:error" --from 7d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
ip: .attributes.attributes.network.client.ip,
country: .attributes.attributes.network.client.geoip.country.name
}]'Who changed roles or permissions?
pup audit-logs search --query "@evt.name:\"Access Management\"" --from 30d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
action: .attributes.attributes.action,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id
}]'What actions came from a specific IP?
pup audit-logs search --query "@network.client.ip:1.2.3.4" --from 30d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
actor_type: .attributes.attributes.evt.actor.type,
action: .attributes.attributes.action,
event: .attributes.attributes.evt.name,
resource_type: .attributes.attributes.asset.type
}]'Who created or deleted API keys?
pup audit-logs search --query "@evt.name:Authentication @asset.type:api_key" --from 90d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
action: .attributes.attributes.action,
key_id: .attributes.attributes.asset.id,
ip: .attributes.attributes.network.client.ip,
country: .attributes.attributes.network.client.geoip.country.name
}]'Event Category Reference
Category (@evt.name) | What it covers |
|---|---|
Authentication | Logins, API key create/delete/modify |
Access Management | Roles, user add/remove, restriction policies |
Dashboard | Create, modify, delete, share |
Monitor | Create, modify, delete, resolve |
Log Management | Pipelines, indexes, archives, exclusion filters |
Integration | Add/modify/delete integrations |
Metrics | Custom metric create/modify/delete |
Organization Management | Child org creation, org settings |
Notebook | Create, modify, delete |
APM | Retention filters, sampling config |
Cloud Security Platform | CWS rules, security signal state changes |
Bits AI SRE | MCP tool calls, AI investigations |
Anomaly Flags to Surface
When presenting investigation results, call out:
Actor type
SUPPORT_USER— Datadog support accessed the orgBulk deletions — same user, same action, many resources in a short window
Unexpected geography — country not seen in prior logins for this user
Off-hours activity — actions at unusual times for the user's typical timezone
First-time ASN — action from a cloud provider or VPN not seen before (
@network.client.geoip.as.name)
References
Files
- ATTRIBUTION.mdAdded by AutoGineer992 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SKILL.md6.1 KiB
SKILL.md
Audit Trail: Security Investigation
Answer common security investigation questions using pup audit-logs.
Prerequisites
pup auth login # OAuth2 (recommended)
# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scopeCommand Execution Order
Clarify the investigation scope: who, what resource type, what time window.
Run the most specific query first; broaden only if results are empty.
If results are large, pipe to
jqto group or summarize.Highlight anomalies: bulk operations, unusual geo, off-hours activity, support user actions.
Common Investigation Queries
Who deleted resources in a time window?
pup audit-logs search --query "@action:deleted" --from 24h -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
actor_type: .attributes.attributes.evt.actor.type,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id,
country: .attributes.attributes.network.client.geoip.country.name
}]'Who modified a specific resource (by ID)?
pup audit-logs search --query "@asset.id:RESOURCE_ID" --from 7d -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
action: .attributes.attributes.action,
event: .attributes.attributes.evt.name
}]'What did a specific user do?
pup audit-logs search --query "@usr.email:[email protected]" --from 7d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
action: .attributes.attributes.action,
event: .attributes.attributes.evt.name,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id,
ip: .attributes.attributes.network.client.ip,
country: .attributes.attributes.network.client.geoip.country.name
}]'Login activity — all logins with geo
pup audit-logs search --query "@evt.name:Authentication @action:login" --from 7d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
status: .attributes.attributes.status,
ip: .attributes.attributes.network.client.ip,
city: .attributes.attributes.network.client.geoip.city.name,
country: .attributes.attributes.network.client.geoip.country.name,
asn: .attributes.attributes.network.client.geoip.as.name
}]'Failed logins only
pup audit-logs search --query "@evt.name:Authentication @action:login @status:error" --from 7d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
ip: .attributes.attributes.network.client.ip,
country: .attributes.attributes.network.client.geoip.country.name
}]'Who changed roles or permissions?
pup audit-logs search --query "@evt.name:\"Access Management\"" --from 30d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
action: .attributes.attributes.action,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id
}]'What actions came from a specific IP?
pup audit-logs search --query "@network.client.ip:1.2.3.4" --from 30d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
actor_type: .attributes.attributes.evt.actor.type,
action: .attributes.attributes.action,
event: .attributes.attributes.evt.name,
resource_type: .attributes.attributes.asset.type
}]'Who created or deleted API keys?
pup audit-logs search --query "@evt.name:Authentication @asset.type:api_key" --from 90d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
action: .attributes.attributes.action,
key_id: .attributes.attributes.asset.id,
ip: .attributes.attributes.network.client.ip,
country: .attributes.attributes.network.client.geoip.country.name
}]'Event Category Reference
Category (@evt.name) | What it covers |
|---|---|
Authentication | Logins, API key create/delete/modify |
Access Management | Roles, user add/remove, restriction policies |
Dashboard | Create, modify, delete, share |
Monitor | Create, modify, delete, resolve |
Log Management | Pipelines, indexes, archives, exclusion filters |
Integration | Add/modify/delete integrations |
Metrics | Custom metric create/modify/delete |
Organization Management | Child org creation, org settings |
Notebook | Create, modify, delete |
APM | Retention filters, sampling config |
Cloud Security Platform | CWS rules, security signal state changes |
Bits AI SRE | MCP tool calls, AI investigations |
Anomaly Flags to Surface
When presenting investigation results, call out:
Actor type
SUPPORT_USER— Datadog support accessed the orgBulk deletions — same user, same action, many resources in a short window
Unexpected geography — country not seen in prior logins for this user
Off-hours activity — actions at unusual times for the user's typical timezone
First-time ASN — action from a cloud provider or VPN not seen before (
@network.client.geoip.as.name)
References
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an API key
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- datadog-labs
- Publisher
- Datadog (Official)
- Source
- datadog-labs/agent-skills · dd-audit/security-investigation · commit 8e1306a
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by datadog-labs or Datadog.
Related skills
Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude CodeMITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download dd-audit-security-investigation.zip