skills.rest
lauhon
lauhonCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

audit-logs

Query and analyze Datadog Audit Trail events for compliance and security auditing.

5|2|Updated Mar 9, 2026
Search Tags:#monitoring#api#compliance#query#audit trail#datadog#security auditing
One-click install
npx skills add https://github.com/lauhon/pi --skill audit-logs-lauhon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-logs
Source: https://github.com/lauhon/pi/tree/main/skills/audit-logs
Command: npx skills add https://github.com/lauhon/pi --skill audit-logs-lauhon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Tracking who did what and when across a Datadog organization is difficult without a structured way to search audit events, making compliance reporting and security investigations slow and error-prone. ## Core Features & Use Cases - Audit Event Search: Query Datadog Audit Trail events with filters for event type, user, IP address, outcome, and time range via the Audit API v2. - Security & Compliance Monitoring: Track failed logins, API key usage, configuration changes, and deletions to support HIPAA, SOC 2, PCI DSS, and GDPR reporting. - Use Case: A security engineer notices a production dashboard was deleted. They ask who modified it, and the agent queries audit events filtered by dashboard name, returning a timeline of users, IP addresses, and change details. ## Quick Start Show me all failed login attempts and dashboard deletions from the last 7 days in my Datadog organization.

Frequently Asked Questions about audit-logs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I search Datadog audit logs by user?▼

Filter audit events using the @usr.email attribute, for example @usr.email:[email protected], combined with a time range like now-7d. The Audit API v2 search endpoint returns matching events with timestamps, actions, and outcomes.

How to track who modified a Datadog dashboard?▼

Query audit events with @evt.name:dashboard and @asset.name set to the dashboard identifier. Results show each modification with the acting user, IP address, HTTP method, and timestamp, and full JSON diffs are available in the Datadog UI.

What permissions are required to read Datadog audit logs via API?▼

The Application key needs the audit_logs_read scope and the user needs the Audit Trail Read permission. Set DD_API_KEY, DD_APP_KEY, and DD_SITE environment variables before querying the Audit API v2.

Can I export Datadog audit events for compliance reporting?▼

Yes, the Datadog UI supports CSV exports of up to 100,000 events, and archival to S3, GCS, or Azure Blob Storage provides long-term retention. API-based export and retention configuration are not available programmatically.

Why does my Datadog audit query return no events?▼

Common causes include Audit Trail not being enabled in Organization Settings, missing audit_logs_read permission on the Application key, or invalid query syntax. Verify the feature is enabled and check attribute names and boolean operators.

What is the default retention period for Datadog Audit Trail?▼

The default retention is 90 days, with configurable options of 3, 7, 15, 30, or 90 days. For longer retention required by regulations, configure archival to cloud storage such as AWS S3, GCS, or Azure Blob Storage.

Related Skills

Explore More Software Engineering Skills→
alexmaruccialexmarucci

audit-logs

Query and manage Datadog Audit Trail events through the Datadog API.

Community
Advanced
alexmaruccialexmarucci

security

Query and manage Datadog security monitoring signals and rules via API.

Community
Intermediate
nexu-ionexu-io
3.2k

datadog

Query the Datadog Logs API to fetch, filter, and correlate log events.

Official
Intermediate
olimpus-softolimpus-soft

arch-frontend

Review MercadoLibre frontend projects against Nordic SSR, Andes UI, and Kraken auth standards.

Official
Advanced