What problem does it solve? Investigating who changed or deleted a cloud resource requires tenant-level audit log access, correct region selection, and careful handling of identities and permissions. This Skill performs explicit, bounded Nebius Control Plane Audit Log investigations using the existing Nebius CLI configuration, verifying the caller and effective audit-read access before returning sanitized evidence. ## Core Features & Use Cases - Scoped investigations: Query audit events by resource ID, subject ID, current subject, or an explicitly authorized tenant-wide scope, filtered by service, action, status, region, and time window. - Verified access and identity: Resolves the selected CLI profile, runs tenant-aware whoami, and treats the first valid audit page as proof of effective read access, distinguishing authentication, permission, and configuration failures. - Sanitized, bounded output: Returns summary or JSON reports with safe scope metadata, pagination continuation tokens, and opt-in names via --include-pii; raw payloads, credentials, and filter literals are never exposed. - Use Case: Investigate who deleted an MK8s cluster by running the helper with the cluster ID, tenant, origin region, and a DELETE action filter, then report the acting service-account ID, operation status, and correlation evidence without inferring a human operator. ## Quick Start Ask the agent to use nebius-audit-log to investigate who deleted a specific cluster in a given tenant, region, and time window.
