OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add datadog-labs/agent-skills --skill dd-audit-security-investigation
Answer "who did what" security questions from Audit Trail — deletions, config changes, login activity, permission changes, actions from a specific user or IP.
npx skills add datadog-labs/agent-skills --skill dd-audit-security-investigation
Answer common security investigation questions using pup audit-logs.
jq to group or summarize.Category (@evt.name) | What it covers |
|---|---|
Authentication | Logins, API key create/delete/modify |
Access Management | Roles, user add/remove, restriction policies |
Dashboard | Create, modify, delete, share |
Monitor | Create, modify, delete, resolve |
Log Management | Pipelines, indexes, archives, exclusion filters |
Integration | Add/modify/delete integrations |
Metrics | Custom metric create/modify/delete |
Organization Management | Child org creation, org settings |
Notebook | Create, modify, delete |
APM | Retention filters, sampling config |
Cloud Security Platform | CWS rules, security signal state changes |
Bits AI SRE | MCP tool calls, AI investigations |
When presenting investigation results, call out:
SUPPORT_USER — Datadog support accessed the org@network.client.geoip.as.name)pup audit-logs search --query "@asset.id:RESOURCE_ID" --from 7d -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
action: .attributes.attributes.action,
event: .attributes.attributes.evt.name
}]'pup audit-logs search --query "@usr.email:user@example.com" --from 7d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
action: .attributes.attributes.action,
event: .attributes.attributes.evt.name,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id,
ip: .attributes.attributes.network.client.ip,
country: .attributes.attributes.network.client.geoip.country.name
}]'pup audit-logs search --query "@evt.name:Authentication @action:login" --from 7d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
status: .attributes.attributes.status,
ip: .attributes.attributes.network.client.ip,
city: .attributes.attributes.network.client.geoip.city.name,
country: .attributes.attributes.network.client.geoip.country.name,
asn: .attributes.attributes.network.client.geoip.as.name
}]'pup audit-logs search --query "@evt.name:Authentication @action:login @status:error" --from 7d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
ip: .attributes.attributes.network.client.ip,
country: .attributes.attributes.network.client.geoip.country.name
}]'pup audit-logs search --query "@evt.name:\"Access Management\"" --from 30d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
action: .attributes.attributes.action,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id
}]'pup audit-logs search --query "@network.client.ip:1.2.3.4" --from 30d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
actor_type: .attributes.attributes.evt.actor.type,
action: .attributes.attributes.action,
event: .attributes.attributes.evt.name,
resource_type: .attributes.attributes.asset.type
}]'pup audit-logs search --query "@evt.name:Authentication @asset.type:api_key" --from 90d --limit 200 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
action: .attributes.attributes.action,
key_id: .attributes.attributes.asset.id,
ip: .attributes.attributes.network.client.ip,
country: .attributes.attributes.network.client.geoip.country.name
}]'