dd-audit-security-investigation
by datadog-labs
Answer "who did what" security questions from Audit Trail — deletions, config changes, login activity, permission changes, actions from a specific user or IP.
npx skills add https://github.com/datadog-labs/agent-skills --skill dd-audit-security-investigationMore skills from datadog-labs
agent-install
datadog-labs
agent-install — an installable skill for AI agents, published by datadog-labs/agent-skills.
official
agent-skills
datadog-labs
Datadog skills for AI agents. Essential monitoring, logging, tracing and observability.
official
dd-apm
datadog-labs
APM - install, onboard, instrument, enable, set up, configure, traces, services, dependencies, performance analysis. Use for any request involving Datadog APM…
official
dd-audit
datadog-labs
Audit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing.
official
dd-audit-ai-activity
datadog-labs
Audit what the Bits AI assistant (MCP server) has done in your Datadog org — tool calls by user, resources accessed, and anomaly flags for AI governance.
official
dd-audit-compliance-report
datadog-labs
Generate auditor-ready compliance evidence from Datadog Audit Trail for SOC 2 and PCI DSS. Maps framework controls to specific query patterns and produces…
official
dd-audit-cost-spike-investigation
datadog-labs
Investigate a Datadog product usage or cost spike by correlating Usage Metering data (when/what spiked) with Audit Trail config changes (who changed what in…
official
dd-audit-key-compromise
datadog-labs
Investigate a potentially compromised Datadog API key — timeline of actions, geo/IP breakdown, endpoints called, anomaly flags, and remediation steps.
official