[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-datadog-labs-dd-audit-compliance-report":3,"mdc-vnmyyx-key":39,"related-org-datadog-labs-dd-audit-compliance-report":1813,"related-repo-datadog-labs-dd-audit-compliance-report":1993},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":28,"repoUrl":29,"updatedAt":30,"license":31,"forks":32,"topics":33,"repo":34,"sourceUrl":37,"mdContent":38},"dd-audit-compliance-report","generate Datadog compliance reports","Generate auditor-ready compliance evidence from Datadog Audit Trail for SOC 2 and PCI DSS. Maps framework controls to specific query patterns and produces formatted output.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"datadog-labs","Datadog Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fdatadog-labs.png",[12,16,19,22,25],{"name":13,"slug":14,"type":15},"Compliance","compliance","tag",{"name":17,"slug":18,"type":15},"Reporting","reporting",{"name":20,"slug":21,"type":15},"SOC 2","soc-2",{"name":23,"slug":24,"type":15},"Datadog","datadog",{"name":26,"slug":27,"type":15},"Audit","audit",145,"https:\u002F\u002Fgithub.com\u002Fdatadog-labs\u002Fagent-skills","2026-05-08T05:05:14.467775",null,19,[],{"repoUrl":29,"stars":28,"forks":32,"topics":35,"description":36},[],"Public repository for Datadog Agent Skills","https:\u002F\u002Fgithub.com\u002Fdatadog-labs\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fdd-audit\u002Fcompliance-report","---\nname: dd-audit-compliance-report\ndescription: Generate auditor-ready compliance evidence from Datadog Audit Trail for SOC 2 and PCI DSS. Maps framework controls to specific query patterns and produces formatted output.\nmetadata:\n  version: \"0.1.0\"\n  author: datadog-labs\n  repository: https:\u002F\u002Fgithub.com\u002Fdatadog-labs\u002Fagent-skills\n  tags: datadog,audit,compliance,soc2,pci,dd-audit\n  alwaysApply: \"false\"\n---\n\n# Audit Trail: Compliance Evidence Report\n\nGenerate auditor-ready evidence from Datadog Audit Trail for SOC 2 and PCI DSS control requirements.\n\n## Prerequisites\n\n```bash\npup auth login   # OAuth2 (recommended)\n# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope\n```\n\n## Read First\n\nSee `references\u002Fcontrol-mapping.md` for the full control → query mapping table and retention requirements by framework.\n\n## Retention Check (Run First)\n\nPCI requires 12 months. Datadog default retention is 90 days. Check whether archive is configured:\n\n```bash\npup audit-logs search --query \"@evt.name:\\\"Audit Trail\\\" @action:modified\" --from 90d -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      user: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      resource: .attributes.attributes.asset.type\n    }]'\n```\n\nIf the requested time window exceeds 90 days and no archive is confirmed, surface this gap in the report header.\n\n## Workflow\n\n1. Confirm: framework (SOC 2 \u002F PCI DSS), time window, org scope\n2. Run retention check\n3. Run each relevant control query\n4. Format output using the Evidence Report template\n\n---\n\n## SOC 2 Queries\n\n### CC6.2 — User Provisioning \u002F Deprovisioning\n\n```bash\npup audit-logs search \\\n  --query \"@evt.name:\\\"Access Management\\\" @asset.type:user @action:(created OR deleted OR modified)\" \\\n  --from PERIOD_START --to PERIOD_END --limit 500 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      actor: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      affected_user: .attributes.attributes.asset.id\n    }]'\n```\n\n### CC6.3 — Role and Permission Changes\n\n```bash\npup audit-logs search \\\n  --query \"@evt.name:\\\"Access Management\\\" @asset.type:role\" \\\n  --from PERIOD_START --to PERIOD_END --limit 500 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      actor: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      role_id: .attributes.attributes.asset.id\n    }]'\n```\n\n### CC6.6 — Failed Logins and Suspicious Access\n\n```bash\npup audit-logs search \\\n  --query \"@evt.name:Authentication @action:login @status:error\" \\\n  --from PERIOD_START --to PERIOD_END --limit 500 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      user: .attributes.attributes.usr.email,\n      ip: .attributes.attributes.network.client.ip,\n      country: .attributes.attributes.network.client.geoip.country.name\n    }]'\n```\n\n### CC7.2 — Privileged \u002F Support User Actions\n\n```bash\npup audit-logs search \\\n  --query \"@evt.actor.type:SUPPORT_USER\" \\\n  --from PERIOD_START --to PERIOD_END --limit 500 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      support_actor: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      resource_type: .attributes.attributes.asset.type,\n      resource_id: .attributes.attributes.asset.id\n    }]'\n```\n\n---\n\n## PCI DSS Queries\n\n### PCI 10.2.2 — Actions by Privileged Users\n\nSame as CC7.2 above. Also include org-level admin actions:\n\n```bash\npup audit-logs search \\\n  --query \"@evt.name:\\\"Organization Management\\\"\" \\\n  --from PERIOD_START --to PERIOD_END --limit 200 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      actor: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      resource_type: .attributes.attributes.asset.type\n    }]'\n```\n\n### PCI 10.2.3 — Access to Audit Trail Itself\n\n```bash\npup audit-logs search \\\n  --query \"@evt.name:\\\"Audit Trail\\\"\" \\\n  --from PERIOD_START --to PERIOD_END --limit 200 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      actor: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      resource_type: .attributes.attributes.asset.type\n    }]'\n```\n\n### PCI 10.2.4 — Invalid Access Attempts\n\nSame as CC6.6 failed logins above.\n\n### PCI 10.2.5 — All Authentication Events\n\n```bash\npup audit-logs search \\\n  --query \"@evt.name:Authentication @action:login\" \\\n  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      user: .attributes.attributes.usr.email,\n      auth_method: .attributes.attributes.auth_method,\n      result: .attributes.attributes.status,\n      ip: .attributes.attributes.network.client.ip,\n      country: .attributes.attributes.network.client.geoip.country.name\n    }]'\n```\n\n### PCI 10.2.7 — Object Creation and Deletion\n\n```bash\npup audit-logs search \\\n  --query \"@action:(created OR deleted)\" \\\n  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      user: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      resource_type: .attributes.attributes.asset.type,\n      resource_id: .attributes.attributes.asset.id,\n      ip: .attributes.attributes.network.client.ip\n    }]'\n```\n\n---\n\n## Evidence Report Template\n\n```\n# Datadog Audit Trail — Compliance Evidence Report\nFramework: [SOC 2 \u002F PCI DSS]\nOrganization: [org name]\nPeriod: [start] to [end]\nGenerated: [date]\n\n## Scope Boundary\nThis report covers administrative actions within the Datadog platform.\nIt does not cover actions taken within systems that Datadog monitors.\n\n## Retention Status\n[✓ Full period covered by Audit Trail retention]\n[⚠ Requested period exceeds 90-day default. Archive config required for complete coverage.]\n\n---\n\n## [Control ID] — [Control Name]\nEvents found: [N]\n\n| Timestamp | Actor | Action | Resource Type | Resource ID | IP | Country |\n|-----------|-------|--------|---------------|-------------|-----|---------|\n| ...       | ...   | ...    | ...           | ...         | ... | ...     |\n\n[Repeat per control]\n\n---\n\n## Gaps\n[List any controls where data was unavailable or incomplete, and why]\n```\n\n## Scope Caveat\n\nDatadog Audit Trail covers the **Datadog platform** as the system being audited. For PCI purposes, this is evidence that the monitoring platform's access controls are functioning — not direct evidence about the cardholder data environment (CDE) itself. Auditors should understand this scope boundary.\n\n## References\n\n- [Audit Trail events reference](https:\u002F\u002Fdocs.datadoghq.com\u002Faccount_management\u002Faudit_trail\u002Fevents\u002F)\n- [PCI DSS Requirement 10](https:\u002F\u002Fwww.pcisecuritystandards.org\u002Fdocument_library\u002F)\n- [SOC 2 Trust Services Criteria](https:\u002F\u002Fus.aicpa.org\u002Finterestareas\u002Ffrc\u002Fassuranceadvisoryservices\u002Faicpasoc2report)\n",{"data":40,"body":45},{"name":4,"description":6,"metadata":41},{"version":42,"author":8,"repository":29,"tags":43,"alwaysApply":44},"0.1.0","datadog,audit,compliance,soc2,pci,dd-audit","false",{"type":46,"children":47},"root",[48,57,63,70,120,126,139,145,150,313,318,324,349,353,359,366,542,548,712,718,867,873,1031,1034,1040,1046,1051,1212,1218,1376,1382,1387,1393,1558,1564,1727,1730,1736,1746,1752,1765,1771,1807],{"type":49,"tag":50,"props":51,"children":53},"element","h1",{"id":52},"audit-trail-compliance-evidence-report",[54],{"type":55,"value":56},"text","Audit Trail: Compliance Evidence Report",{"type":49,"tag":58,"props":59,"children":60},"p",{},[61],{"type":55,"value":62},"Generate auditor-ready evidence from Datadog Audit Trail for SOC 2 and PCI DSS control requirements.",{"type":49,"tag":64,"props":65,"children":67},"h2",{"id":66},"prerequisites",[68],{"type":55,"value":69},"Prerequisites",{"type":49,"tag":71,"props":72,"children":77},"pre",{"className":73,"code":74,"language":75,"meta":76,"style":76},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","pup auth login   # OAuth2 (recommended)\n# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope\n","bash","",[78],{"type":49,"tag":79,"props":80,"children":81},"code",{"__ignoreMap":76},[82,111],{"type":49,"tag":83,"props":84,"children":87},"span",{"class":85,"line":86},"line",1,[88,94,100,105],{"type":49,"tag":83,"props":89,"children":91},{"style":90},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[92],{"type":55,"value":93},"pup",{"type":49,"tag":83,"props":95,"children":97},{"style":96},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[98],{"type":55,"value":99}," auth",{"type":49,"tag":83,"props":101,"children":102},{"style":96},[103],{"type":55,"value":104}," login",{"type":49,"tag":83,"props":106,"children":108},{"style":107},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[109],{"type":55,"value":110},"   # OAuth2 (recommended)\n",{"type":49,"tag":83,"props":112,"children":114},{"class":85,"line":113},2,[115],{"type":49,"tag":83,"props":116,"children":117},{"style":107},[118],{"type":55,"value":119},"# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope\n",{"type":49,"tag":64,"props":121,"children":123},{"id":122},"read-first",[124],{"type":55,"value":125},"Read First",{"type":49,"tag":58,"props":127,"children":128},{},[129,131,137],{"type":55,"value":130},"See ",{"type":49,"tag":79,"props":132,"children":134},{"className":133},[],[135],{"type":55,"value":136},"references\u002Fcontrol-mapping.md",{"type":55,"value":138}," for the full control → query mapping table and retention requirements by framework.",{"type":49,"tag":64,"props":140,"children":142},{"id":141},"retention-check-run-first",[143],{"type":55,"value":144},"Retention Check (Run First)",{"type":49,"tag":58,"props":146,"children":147},{},[148],{"type":55,"value":149},"PCI requires 12 months. Datadog default retention is 90 days. Check whether archive is configured:",{"type":49,"tag":71,"props":151,"children":153},{"className":73,"code":152,"language":75,"meta":76,"style":76},"pup audit-logs search --query \"@evt.name:\\\"Audit Trail\\\" @action:modified\" --from 90d -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      user: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      resource: .attributes.attributes.asset.type\n    }]'\n",[154],{"type":49,"tag":79,"props":155,"children":156},{"__ignoreMap":76},[157,240,263,272,281,290,299],{"type":49,"tag":83,"props":158,"children":159},{"class":85,"line":86},[160,164,169,174,179,185,190,196,201,205,210,215,220,225,230,235],{"type":49,"tag":83,"props":161,"children":162},{"style":90},[163],{"type":55,"value":93},{"type":49,"tag":83,"props":165,"children":166},{"style":96},[167],{"type":55,"value":168}," audit-logs",{"type":49,"tag":83,"props":170,"children":171},{"style":96},[172],{"type":55,"value":173}," search",{"type":49,"tag":83,"props":175,"children":176},{"style":96},[177],{"type":55,"value":178}," --query",{"type":49,"tag":83,"props":180,"children":182},{"style":181},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[183],{"type":55,"value":184}," \"",{"type":49,"tag":83,"props":186,"children":187},{"style":96},[188],{"type":55,"value":189},"@evt.name:",{"type":49,"tag":83,"props":191,"children":193},{"style":192},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[194],{"type":55,"value":195},"\\\"",{"type":49,"tag":83,"props":197,"children":198},{"style":96},[199],{"type":55,"value":200},"Audit Trail",{"type":49,"tag":83,"props":202,"children":203},{"style":192},[204],{"type":55,"value":195},{"type":49,"tag":83,"props":206,"children":207},{"style":96},[208],{"type":55,"value":209}," @action:modified",{"type":49,"tag":83,"props":211,"children":212},{"style":181},[213],{"type":55,"value":214},"\"",{"type":49,"tag":83,"props":216,"children":217},{"style":96},[218],{"type":55,"value":219}," --from",{"type":49,"tag":83,"props":221,"children":222},{"style":96},[223],{"type":55,"value":224}," 90d",{"type":49,"tag":83,"props":226,"children":227},{"style":96},[228],{"type":55,"value":229}," -o",{"type":49,"tag":83,"props":231,"children":232},{"style":96},[233],{"type":55,"value":234}," json",{"type":49,"tag":83,"props":236,"children":237},{"style":192},[238],{"type":55,"value":239}," \\\n",{"type":49,"tag":83,"props":241,"children":242},{"class":85,"line":113},[243,248,253,258],{"type":49,"tag":83,"props":244,"children":245},{"style":181},[246],{"type":55,"value":247},"  |",{"type":49,"tag":83,"props":249,"children":250},{"style":90},[251],{"type":55,"value":252}," jq",{"type":49,"tag":83,"props":254,"children":255},{"style":181},[256],{"type":55,"value":257}," '",{"type":49,"tag":83,"props":259,"children":260},{"style":96},[261],{"type":55,"value":262},"[.data[] | {\n",{"type":49,"tag":83,"props":264,"children":266},{"class":85,"line":265},3,[267],{"type":49,"tag":83,"props":268,"children":269},{"style":96},[270],{"type":55,"value":271},"      timestamp: .attributes.timestamp,\n",{"type":49,"tag":83,"props":273,"children":275},{"class":85,"line":274},4,[276],{"type":49,"tag":83,"props":277,"children":278},{"style":96},[279],{"type":55,"value":280},"      user: .attributes.attributes.usr.email,\n",{"type":49,"tag":83,"props":282,"children":284},{"class":85,"line":283},5,[285],{"type":49,"tag":83,"props":286,"children":287},{"style":96},[288],{"type":55,"value":289},"      action: .attributes.attributes.action,\n",{"type":49,"tag":83,"props":291,"children":293},{"class":85,"line":292},6,[294],{"type":49,"tag":83,"props":295,"children":296},{"style":96},[297],{"type":55,"value":298},"      resource: .attributes.attributes.asset.type\n",{"type":49,"tag":83,"props":300,"children":302},{"class":85,"line":301},7,[303,308],{"type":49,"tag":83,"props":304,"children":305},{"style":96},[306],{"type":55,"value":307},"    }]",{"type":49,"tag":83,"props":309,"children":310},{"style":181},[311],{"type":55,"value":312},"'\n",{"type":49,"tag":58,"props":314,"children":315},{},[316],{"type":55,"value":317},"If the requested time window exceeds 90 days and no archive is confirmed, surface this gap in the report header.",{"type":49,"tag":64,"props":319,"children":321},{"id":320},"workflow",[322],{"type":55,"value":323},"Workflow",{"type":49,"tag":325,"props":326,"children":327},"ol",{},[328,334,339,344],{"type":49,"tag":329,"props":330,"children":331},"li",{},[332],{"type":55,"value":333},"Confirm: framework (SOC 2 \u002F PCI DSS), time window, org scope",{"type":49,"tag":329,"props":335,"children":336},{},[337],{"type":55,"value":338},"Run retention check",{"type":49,"tag":329,"props":340,"children":341},{},[342],{"type":55,"value":343},"Run each relevant control query",{"type":49,"tag":329,"props":345,"children":346},{},[347],{"type":55,"value":348},"Format output using the Evidence Report template",{"type":49,"tag":350,"props":351,"children":352},"hr",{},[],{"type":49,"tag":64,"props":354,"children":356},{"id":355},"soc-2-queries",[357],{"type":55,"value":358},"SOC 2 Queries",{"type":49,"tag":360,"props":361,"children":363},"h3",{"id":362},"cc62-user-provisioning-deprovisioning",[364],{"type":55,"value":365},"CC6.2 — User Provisioning \u002F Deprovisioning",{"type":49,"tag":71,"props":367,"children":369},{"className":73,"code":368,"language":75,"meta":76,"style":76},"pup audit-logs search \\\n  --query \"@evt.name:\\\"Access Management\\\" @asset.type:user @action:(created OR deleted OR modified)\" \\\n  --from PERIOD_START --to PERIOD_END --limit 500 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      actor: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      affected_user: .attributes.attributes.asset.id\n    }]'\n",[370],{"type":49,"tag":79,"props":371,"children":372},{"__ignoreMap":76},[373,392,434,480,499,506,514,521,530],{"type":49,"tag":83,"props":374,"children":375},{"class":85,"line":86},[376,380,384,388],{"type":49,"tag":83,"props":377,"children":378},{"style":90},[379],{"type":55,"value":93},{"type":49,"tag":83,"props":381,"children":382},{"style":96},[383],{"type":55,"value":168},{"type":49,"tag":83,"props":385,"children":386},{"style":96},[387],{"type":55,"value":173},{"type":49,"tag":83,"props":389,"children":390},{"style":192},[391],{"type":55,"value":239},{"type":49,"tag":83,"props":393,"children":394},{"class":85,"line":113},[395,400,404,408,412,417,421,426,430],{"type":49,"tag":83,"props":396,"children":397},{"style":96},[398],{"type":55,"value":399},"  --query",{"type":49,"tag":83,"props":401,"children":402},{"style":181},[403],{"type":55,"value":184},{"type":49,"tag":83,"props":405,"children":406},{"style":96},[407],{"type":55,"value":189},{"type":49,"tag":83,"props":409,"children":410},{"style":192},[411],{"type":55,"value":195},{"type":49,"tag":83,"props":413,"children":414},{"style":96},[415],{"type":55,"value":416},"Access Management",{"type":49,"tag":83,"props":418,"children":419},{"style":192},[420],{"type":55,"value":195},{"type":49,"tag":83,"props":422,"children":423},{"style":96},[424],{"type":55,"value":425}," @asset.type:user @action:(created OR deleted OR modified)",{"type":49,"tag":83,"props":427,"children":428},{"style":181},[429],{"type":55,"value":214},{"type":49,"tag":83,"props":431,"children":432},{"style":192},[433],{"type":55,"value":239},{"type":49,"tag":83,"props":435,"children":436},{"class":85,"line":265},[437,442,447,452,457,462,468,472,476],{"type":49,"tag":83,"props":438,"children":439},{"style":96},[440],{"type":55,"value":441},"  --from",{"type":49,"tag":83,"props":443,"children":444},{"style":96},[445],{"type":55,"value":446}," PERIOD_START",{"type":49,"tag":83,"props":448,"children":449},{"style":96},[450],{"type":55,"value":451}," --to",{"type":49,"tag":83,"props":453,"children":454},{"style":96},[455],{"type":55,"value":456}," PERIOD_END",{"type":49,"tag":83,"props":458,"children":459},{"style":96},[460],{"type":55,"value":461}," --limit",{"type":49,"tag":83,"props":463,"children":465},{"style":464},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[466],{"type":55,"value":467}," 500",{"type":49,"tag":83,"props":469,"children":470},{"style":96},[471],{"type":55,"value":229},{"type":49,"tag":83,"props":473,"children":474},{"style":96},[475],{"type":55,"value":234},{"type":49,"tag":83,"props":477,"children":478},{"style":192},[479],{"type":55,"value":239},{"type":49,"tag":83,"props":481,"children":482},{"class":85,"line":274},[483,487,491,495],{"type":49,"tag":83,"props":484,"children":485},{"style":181},[486],{"type":55,"value":247},{"type":49,"tag":83,"props":488,"children":489},{"style":90},[490],{"type":55,"value":252},{"type":49,"tag":83,"props":492,"children":493},{"style":181},[494],{"type":55,"value":257},{"type":49,"tag":83,"props":496,"children":497},{"style":96},[498],{"type":55,"value":262},{"type":49,"tag":83,"props":500,"children":501},{"class":85,"line":283},[502],{"type":49,"tag":83,"props":503,"children":504},{"style":96},[505],{"type":55,"value":271},{"type":49,"tag":83,"props":507,"children":508},{"class":85,"line":292},[509],{"type":49,"tag":83,"props":510,"children":511},{"style":96},[512],{"type":55,"value":513},"      actor: .attributes.attributes.usr.email,\n",{"type":49,"tag":83,"props":515,"children":516},{"class":85,"line":301},[517],{"type":49,"tag":83,"props":518,"children":519},{"style":96},[520],{"type":55,"value":289},{"type":49,"tag":83,"props":522,"children":524},{"class":85,"line":523},8,[525],{"type":49,"tag":83,"props":526,"children":527},{"style":96},[528],{"type":55,"value":529},"      affected_user: .attributes.attributes.asset.id\n",{"type":49,"tag":83,"props":531,"children":533},{"class":85,"line":532},9,[534,538],{"type":49,"tag":83,"props":535,"children":536},{"style":96},[537],{"type":55,"value":307},{"type":49,"tag":83,"props":539,"children":540},{"style":181},[541],{"type":55,"value":312},{"type":49,"tag":360,"props":543,"children":545},{"id":544},"cc63-role-and-permission-changes",[546],{"type":55,"value":547},"CC6.3 — Role and Permission Changes",{"type":49,"tag":71,"props":549,"children":551},{"className":73,"code":550,"language":75,"meta":76,"style":76},"pup audit-logs search \\\n  --query \"@evt.name:\\\"Access Management\\\" @asset.type:role\" \\\n  --from PERIOD_START --to PERIOD_END --limit 500 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      actor: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      role_id: .attributes.attributes.asset.id\n    }]'\n",[552],{"type":49,"tag":79,"props":553,"children":554},{"__ignoreMap":76},[555,574,614,653,672,679,686,693,701],{"type":49,"tag":83,"props":556,"children":557},{"class":85,"line":86},[558,562,566,570],{"type":49,"tag":83,"props":559,"children":560},{"style":90},[561],{"type":55,"value":93},{"type":49,"tag":83,"props":563,"children":564},{"style":96},[565],{"type":55,"value":168},{"type":49,"tag":83,"props":567,"children":568},{"style":96},[569],{"type":55,"value":173},{"type":49,"tag":83,"props":571,"children":572},{"style":192},[573],{"type":55,"value":239},{"type":49,"tag":83,"props":575,"children":576},{"class":85,"line":113},[577,581,585,589,593,597,601,606,610],{"type":49,"tag":83,"props":578,"children":579},{"style":96},[580],{"type":55,"value":399},{"type":49,"tag":83,"props":582,"children":583},{"style":181},[584],{"type":55,"value":184},{"type":49,"tag":83,"props":586,"children":587},{"style":96},[588],{"type":55,"value":189},{"type":49,"tag":83,"props":590,"children":591},{"style":192},[592],{"type":55,"value":195},{"type":49,"tag":83,"props":594,"children":595},{"style":96},[596],{"type":55,"value":416},{"type":49,"tag":83,"props":598,"children":599},{"style":192},[600],{"type":55,"value":195},{"type":49,"tag":83,"props":602,"children":603},{"style":96},[604],{"type":55,"value":605}," @asset.type:role",{"type":49,"tag":83,"props":607,"children":608},{"style":181},[609],{"type":55,"value":214},{"type":49,"tag":83,"props":611,"children":612},{"style":192},[613],{"type":55,"value":239},{"type":49,"tag":83,"props":615,"children":616},{"class":85,"line":265},[617,621,625,629,633,637,641,645,649],{"type":49,"tag":83,"props":618,"children":619},{"style":96},[620],{"type":55,"value":441},{"type":49,"tag":83,"props":622,"children":623},{"style":96},[624],{"type":55,"value":446},{"type":49,"tag":83,"props":626,"children":627},{"style":96},[628],{"type":55,"value":451},{"type":49,"tag":83,"props":630,"children":631},{"style":96},[632],{"type":55,"value":456},{"type":49,"tag":83,"props":634,"children":635},{"style":96},[636],{"type":55,"value":461},{"type":49,"tag":83,"props":638,"children":639},{"style":464},[640],{"type":55,"value":467},{"type":49,"tag":83,"props":642,"children":643},{"style":96},[644],{"type":55,"value":229},{"type":49,"tag":83,"props":646,"children":647},{"style":96},[648],{"type":55,"value":234},{"type":49,"tag":83,"props":650,"children":651},{"style":192},[652],{"type":55,"value":239},{"type":49,"tag":83,"props":654,"children":655},{"class":85,"line":274},[656,660,664,668],{"type":49,"tag":83,"props":657,"children":658},{"style":181},[659],{"type":55,"value":247},{"type":49,"tag":83,"props":661,"children":662},{"style":90},[663],{"type":55,"value":252},{"type":49,"tag":83,"props":665,"children":666},{"style":181},[667],{"type":55,"value":257},{"type":49,"tag":83,"props":669,"children":670},{"style":96},[671],{"type":55,"value":262},{"type":49,"tag":83,"props":673,"children":674},{"class":85,"line":283},[675],{"type":49,"tag":83,"props":676,"children":677},{"style":96},[678],{"type":55,"value":271},{"type":49,"tag":83,"props":680,"children":681},{"class":85,"line":292},[682],{"type":49,"tag":83,"props":683,"children":684},{"style":96},[685],{"type":55,"value":513},{"type":49,"tag":83,"props":687,"children":688},{"class":85,"line":301},[689],{"type":49,"tag":83,"props":690,"children":691},{"style":96},[692],{"type":55,"value":289},{"type":49,"tag":83,"props":694,"children":695},{"class":85,"line":523},[696],{"type":49,"tag":83,"props":697,"children":698},{"style":96},[699],{"type":55,"value":700},"      role_id: .attributes.attributes.asset.id\n",{"type":49,"tag":83,"props":702,"children":703},{"class":85,"line":532},[704,708],{"type":49,"tag":83,"props":705,"children":706},{"style":96},[707],{"type":55,"value":307},{"type":49,"tag":83,"props":709,"children":710},{"style":181},[711],{"type":55,"value":312},{"type":49,"tag":360,"props":713,"children":715},{"id":714},"cc66-failed-logins-and-suspicious-access",[716],{"type":55,"value":717},"CC6.6 — Failed Logins and Suspicious Access",{"type":49,"tag":71,"props":719,"children":721},{"className":73,"code":720,"language":75,"meta":76,"style":76},"pup audit-logs search \\\n  --query \"@evt.name:Authentication @action:login @status:error\" \\\n  --from PERIOD_START --to PERIOD_END --limit 500 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      user: .attributes.attributes.usr.email,\n      ip: .attributes.attributes.network.client.ip,\n      country: .attributes.attributes.network.client.geoip.country.name\n    }]'\n",[722],{"type":49,"tag":79,"props":723,"children":724},{"__ignoreMap":76},[725,744,768,807,826,833,840,848,856],{"type":49,"tag":83,"props":726,"children":727},{"class":85,"line":86},[728,732,736,740],{"type":49,"tag":83,"props":729,"children":730},{"style":90},[731],{"type":55,"value":93},{"type":49,"tag":83,"props":733,"children":734},{"style":96},[735],{"type":55,"value":168},{"type":49,"tag":83,"props":737,"children":738},{"style":96},[739],{"type":55,"value":173},{"type":49,"tag":83,"props":741,"children":742},{"style":192},[743],{"type":55,"value":239},{"type":49,"tag":83,"props":745,"children":746},{"class":85,"line":113},[747,751,755,760,764],{"type":49,"tag":83,"props":748,"children":749},{"style":96},[750],{"type":55,"value":399},{"type":49,"tag":83,"props":752,"children":753},{"style":181},[754],{"type":55,"value":184},{"type":49,"tag":83,"props":756,"children":757},{"style":96},[758],{"type":55,"value":759},"@evt.name:Authentication @action:login @status:error",{"type":49,"tag":83,"props":761,"children":762},{"style":181},[763],{"type":55,"value":214},{"type":49,"tag":83,"props":765,"children":766},{"style":192},[767],{"type":55,"value":239},{"type":49,"tag":83,"props":769,"children":770},{"class":85,"line":265},[771,775,779,783,787,791,795,799,803],{"type":49,"tag":83,"props":772,"children":773},{"style":96},[774],{"type":55,"value":441},{"type":49,"tag":83,"props":776,"children":777},{"style":96},[778],{"type":55,"value":446},{"type":49,"tag":83,"props":780,"children":781},{"style":96},[782],{"type":55,"value":451},{"type":49,"tag":83,"props":784,"children":785},{"style":96},[786],{"type":55,"value":456},{"type":49,"tag":83,"props":788,"children":789},{"style":96},[790],{"type":55,"value":461},{"type":49,"tag":83,"props":792,"children":793},{"style":464},[794],{"type":55,"value":467},{"type":49,"tag":83,"props":796,"children":797},{"style":96},[798],{"type":55,"value":229},{"type":49,"tag":83,"props":800,"children":801},{"style":96},[802],{"type":55,"value":234},{"type":49,"tag":83,"props":804,"children":805},{"style":192},[806],{"type":55,"value":239},{"type":49,"tag":83,"props":808,"children":809},{"class":85,"line":274},[810,814,818,822],{"type":49,"tag":83,"props":811,"children":812},{"style":181},[813],{"type":55,"value":247},{"type":49,"tag":83,"props":815,"children":816},{"style":90},[817],{"type":55,"value":252},{"type":49,"tag":83,"props":819,"children":820},{"style":181},[821],{"type":55,"value":257},{"type":49,"tag":83,"props":823,"children":824},{"style":96},[825],{"type":55,"value":262},{"type":49,"tag":83,"props":827,"children":828},{"class":85,"line":283},[829],{"type":49,"tag":83,"props":830,"children":831},{"style":96},[832],{"type":55,"value":271},{"type":49,"tag":83,"props":834,"children":835},{"class":85,"line":292},[836],{"type":49,"tag":83,"props":837,"children":838},{"style":96},[839],{"type":55,"value":280},{"type":49,"tag":83,"props":841,"children":842},{"class":85,"line":301},[843],{"type":49,"tag":83,"props":844,"children":845},{"style":96},[846],{"type":55,"value":847},"      ip: .attributes.attributes.network.client.ip,\n",{"type":49,"tag":83,"props":849,"children":850},{"class":85,"line":523},[851],{"type":49,"tag":83,"props":852,"children":853},{"style":96},[854],{"type":55,"value":855},"      country: .attributes.attributes.network.client.geoip.country.name\n",{"type":49,"tag":83,"props":857,"children":858},{"class":85,"line":532},[859,863],{"type":49,"tag":83,"props":860,"children":861},{"style":96},[862],{"type":55,"value":307},{"type":49,"tag":83,"props":864,"children":865},{"style":181},[866],{"type":55,"value":312},{"type":49,"tag":360,"props":868,"children":870},{"id":869},"cc72-privileged-support-user-actions",[871],{"type":55,"value":872},"CC7.2 — Privileged \u002F Support User Actions",{"type":49,"tag":71,"props":874,"children":876},{"className":73,"code":875,"language":75,"meta":76,"style":76},"pup audit-logs search \\\n  --query \"@evt.actor.type:SUPPORT_USER\" \\\n  --from PERIOD_START --to PERIOD_END --limit 500 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      support_actor: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      resource_type: .attributes.attributes.asset.type,\n      resource_id: .attributes.attributes.asset.id\n    }]'\n",[877],{"type":49,"tag":79,"props":878,"children":879},{"__ignoreMap":76},[880,899,923,962,981,988,996,1003,1011,1019],{"type":49,"tag":83,"props":881,"children":882},{"class":85,"line":86},[883,887,891,895],{"type":49,"tag":83,"props":884,"children":885},{"style":90},[886],{"type":55,"value":93},{"type":49,"tag":83,"props":888,"children":889},{"style":96},[890],{"type":55,"value":168},{"type":49,"tag":83,"props":892,"children":893},{"style":96},[894],{"type":55,"value":173},{"type":49,"tag":83,"props":896,"children":897},{"style":192},[898],{"type":55,"value":239},{"type":49,"tag":83,"props":900,"children":901},{"class":85,"line":113},[902,906,910,915,919],{"type":49,"tag":83,"props":903,"children":904},{"style":96},[905],{"type":55,"value":399},{"type":49,"tag":83,"props":907,"children":908},{"style":181},[909],{"type":55,"value":184},{"type":49,"tag":83,"props":911,"children":912},{"style":96},[913],{"type":55,"value":914},"@evt.actor.type:SUPPORT_USER",{"type":49,"tag":83,"props":916,"children":917},{"style":181},[918],{"type":55,"value":214},{"type":49,"tag":83,"props":920,"children":921},{"style":192},[922],{"type":55,"value":239},{"type":49,"tag":83,"props":924,"children":925},{"class":85,"line":265},[926,930,934,938,942,946,950,954,958],{"type":49,"tag":83,"props":927,"children":928},{"style":96},[929],{"type":55,"value":441},{"type":49,"tag":83,"props":931,"children":932},{"style":96},[933],{"type":55,"value":446},{"type":49,"tag":83,"props":935,"children":936},{"style":96},[937],{"type":55,"value":451},{"type":49,"tag":83,"props":939,"children":940},{"style":96},[941],{"type":55,"value":456},{"type":49,"tag":83,"props":943,"children":944},{"style":96},[945],{"type":55,"value":461},{"type":49,"tag":83,"props":947,"children":948},{"style":464},[949],{"type":55,"value":467},{"type":49,"tag":83,"props":951,"children":952},{"style":96},[953],{"type":55,"value":229},{"type":49,"tag":83,"props":955,"children":956},{"style":96},[957],{"type":55,"value":234},{"type":49,"tag":83,"props":959,"children":960},{"style":192},[961],{"type":55,"value":239},{"type":49,"tag":83,"props":963,"children":964},{"class":85,"line":274},[965,969,973,977],{"type":49,"tag":83,"props":966,"children":967},{"style":181},[968],{"type":55,"value":247},{"type":49,"tag":83,"props":970,"children":971},{"style":90},[972],{"type":55,"value":252},{"type":49,"tag":83,"props":974,"children":975},{"style":181},[976],{"type":55,"value":257},{"type":49,"tag":83,"props":978,"children":979},{"style":96},[980],{"type":55,"value":262},{"type":49,"tag":83,"props":982,"children":983},{"class":85,"line":283},[984],{"type":49,"tag":83,"props":985,"children":986},{"style":96},[987],{"type":55,"value":271},{"type":49,"tag":83,"props":989,"children":990},{"class":85,"line":292},[991],{"type":49,"tag":83,"props":992,"children":993},{"style":96},[994],{"type":55,"value":995},"      support_actor: .attributes.attributes.usr.email,\n",{"type":49,"tag":83,"props":997,"children":998},{"class":85,"line":301},[999],{"type":49,"tag":83,"props":1000,"children":1001},{"style":96},[1002],{"type":55,"value":289},{"type":49,"tag":83,"props":1004,"children":1005},{"class":85,"line":523},[1006],{"type":49,"tag":83,"props":1007,"children":1008},{"style":96},[1009],{"type":55,"value":1010},"      resource_type: .attributes.attributes.asset.type,\n",{"type":49,"tag":83,"props":1012,"children":1013},{"class":85,"line":532},[1014],{"type":49,"tag":83,"props":1015,"children":1016},{"style":96},[1017],{"type":55,"value":1018},"      resource_id: .attributes.attributes.asset.id\n",{"type":49,"tag":83,"props":1020,"children":1022},{"class":85,"line":1021},10,[1023,1027],{"type":49,"tag":83,"props":1024,"children":1025},{"style":96},[1026],{"type":55,"value":307},{"type":49,"tag":83,"props":1028,"children":1029},{"style":181},[1030],{"type":55,"value":312},{"type":49,"tag":350,"props":1032,"children":1033},{},[],{"type":49,"tag":64,"props":1035,"children":1037},{"id":1036},"pci-dss-queries",[1038],{"type":55,"value":1039},"PCI DSS Queries",{"type":49,"tag":360,"props":1041,"children":1043},{"id":1042},"pci-1022-actions-by-privileged-users",[1044],{"type":55,"value":1045},"PCI 10.2.2 — Actions by Privileged Users",{"type":49,"tag":58,"props":1047,"children":1048},{},[1049],{"type":55,"value":1050},"Same as CC7.2 above. Also include org-level admin actions:",{"type":49,"tag":71,"props":1052,"children":1054},{"className":73,"code":1053,"language":75,"meta":76,"style":76},"pup audit-logs search \\\n  --query \"@evt.name:\\\"Organization Management\\\"\" \\\n  --from PERIOD_START --to PERIOD_END --limit 200 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      actor: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      resource_type: .attributes.attributes.asset.type\n    }]'\n",[1055],{"type":49,"tag":79,"props":1056,"children":1057},{"__ignoreMap":76},[1058,1077,1113,1153,1172,1179,1186,1193,1201],{"type":49,"tag":83,"props":1059,"children":1060},{"class":85,"line":86},[1061,1065,1069,1073],{"type":49,"tag":83,"props":1062,"children":1063},{"style":90},[1064],{"type":55,"value":93},{"type":49,"tag":83,"props":1066,"children":1067},{"style":96},[1068],{"type":55,"value":168},{"type":49,"tag":83,"props":1070,"children":1071},{"style":96},[1072],{"type":55,"value":173},{"type":49,"tag":83,"props":1074,"children":1075},{"style":192},[1076],{"type":55,"value":239},{"type":49,"tag":83,"props":1078,"children":1079},{"class":85,"line":113},[1080,1084,1088,1092,1096,1101,1105,1109],{"type":49,"tag":83,"props":1081,"children":1082},{"style":96},[1083],{"type":55,"value":399},{"type":49,"tag":83,"props":1085,"children":1086},{"style":181},[1087],{"type":55,"value":184},{"type":49,"tag":83,"props":1089,"children":1090},{"style":96},[1091],{"type":55,"value":189},{"type":49,"tag":83,"props":1093,"children":1094},{"style":192},[1095],{"type":55,"value":195},{"type":49,"tag":83,"props":1097,"children":1098},{"style":96},[1099],{"type":55,"value":1100},"Organization Management",{"type":49,"tag":83,"props":1102,"children":1103},{"style":192},[1104],{"type":55,"value":195},{"type":49,"tag":83,"props":1106,"children":1107},{"style":181},[1108],{"type":55,"value":214},{"type":49,"tag":83,"props":1110,"children":1111},{"style":192},[1112],{"type":55,"value":239},{"type":49,"tag":83,"props":1114,"children":1115},{"class":85,"line":265},[1116,1120,1124,1128,1132,1136,1141,1145,1149],{"type":49,"tag":83,"props":1117,"children":1118},{"style":96},[1119],{"type":55,"value":441},{"type":49,"tag":83,"props":1121,"children":1122},{"style":96},[1123],{"type":55,"value":446},{"type":49,"tag":83,"props":1125,"children":1126},{"style":96},[1127],{"type":55,"value":451},{"type":49,"tag":83,"props":1129,"children":1130},{"style":96},[1131],{"type":55,"value":456},{"type":49,"tag":83,"props":1133,"children":1134},{"style":96},[1135],{"type":55,"value":461},{"type":49,"tag":83,"props":1137,"children":1138},{"style":464},[1139],{"type":55,"value":1140}," 200",{"type":49,"tag":83,"props":1142,"children":1143},{"style":96},[1144],{"type":55,"value":229},{"type":49,"tag":83,"props":1146,"children":1147},{"style":96},[1148],{"type":55,"value":234},{"type":49,"tag":83,"props":1150,"children":1151},{"style":192},[1152],{"type":55,"value":239},{"type":49,"tag":83,"props":1154,"children":1155},{"class":85,"line":274},[1156,1160,1164,1168],{"type":49,"tag":83,"props":1157,"children":1158},{"style":181},[1159],{"type":55,"value":247},{"type":49,"tag":83,"props":1161,"children":1162},{"style":90},[1163],{"type":55,"value":252},{"type":49,"tag":83,"props":1165,"children":1166},{"style":181},[1167],{"type":55,"value":257},{"type":49,"tag":83,"props":1169,"children":1170},{"style":96},[1171],{"type":55,"value":262},{"type":49,"tag":83,"props":1173,"children":1174},{"class":85,"line":283},[1175],{"type":49,"tag":83,"props":1176,"children":1177},{"style":96},[1178],{"type":55,"value":271},{"type":49,"tag":83,"props":1180,"children":1181},{"class":85,"line":292},[1182],{"type":49,"tag":83,"props":1183,"children":1184},{"style":96},[1185],{"type":55,"value":513},{"type":49,"tag":83,"props":1187,"children":1188},{"class":85,"line":301},[1189],{"type":49,"tag":83,"props":1190,"children":1191},{"style":96},[1192],{"type":55,"value":289},{"type":49,"tag":83,"props":1194,"children":1195},{"class":85,"line":523},[1196],{"type":49,"tag":83,"props":1197,"children":1198},{"style":96},[1199],{"type":55,"value":1200},"      resource_type: .attributes.attributes.asset.type\n",{"type":49,"tag":83,"props":1202,"children":1203},{"class":85,"line":532},[1204,1208],{"type":49,"tag":83,"props":1205,"children":1206},{"style":96},[1207],{"type":55,"value":307},{"type":49,"tag":83,"props":1209,"children":1210},{"style":181},[1211],{"type":55,"value":312},{"type":49,"tag":360,"props":1213,"children":1215},{"id":1214},"pci-1023-access-to-audit-trail-itself",[1216],{"type":55,"value":1217},"PCI 10.2.3 — Access to Audit Trail Itself",{"type":49,"tag":71,"props":1219,"children":1221},{"className":73,"code":1220,"language":75,"meta":76,"style":76},"pup audit-logs search \\\n  --query \"@evt.name:\\\"Audit Trail\\\"\" \\\n  --from PERIOD_START --to PERIOD_END --limit 200 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      actor: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      resource_type: .attributes.attributes.asset.type\n    }]'\n",[1222],{"type":49,"tag":79,"props":1223,"children":1224},{"__ignoreMap":76},[1225,1244,1279,1318,1337,1344,1351,1358,1365],{"type":49,"tag":83,"props":1226,"children":1227},{"class":85,"line":86},[1228,1232,1236,1240],{"type":49,"tag":83,"props":1229,"children":1230},{"style":90},[1231],{"type":55,"value":93},{"type":49,"tag":83,"props":1233,"children":1234},{"style":96},[1235],{"type":55,"value":168},{"type":49,"tag":83,"props":1237,"children":1238},{"style":96},[1239],{"type":55,"value":173},{"type":49,"tag":83,"props":1241,"children":1242},{"style":192},[1243],{"type":55,"value":239},{"type":49,"tag":83,"props":1245,"children":1246},{"class":85,"line":113},[1247,1251,1255,1259,1263,1267,1271,1275],{"type":49,"tag":83,"props":1248,"children":1249},{"style":96},[1250],{"type":55,"value":399},{"type":49,"tag":83,"props":1252,"children":1253},{"style":181},[1254],{"type":55,"value":184},{"type":49,"tag":83,"props":1256,"children":1257},{"style":96},[1258],{"type":55,"value":189},{"type":49,"tag":83,"props":1260,"children":1261},{"style":192},[1262],{"type":55,"value":195},{"type":49,"tag":83,"props":1264,"children":1265},{"style":96},[1266],{"type":55,"value":200},{"type":49,"tag":83,"props":1268,"children":1269},{"style":192},[1270],{"type":55,"value":195},{"type":49,"tag":83,"props":1272,"children":1273},{"style":181},[1274],{"type":55,"value":214},{"type":49,"tag":83,"props":1276,"children":1277},{"style":192},[1278],{"type":55,"value":239},{"type":49,"tag":83,"props":1280,"children":1281},{"class":85,"line":265},[1282,1286,1290,1294,1298,1302,1306,1310,1314],{"type":49,"tag":83,"props":1283,"children":1284},{"style":96},[1285],{"type":55,"value":441},{"type":49,"tag":83,"props":1287,"children":1288},{"style":96},[1289],{"type":55,"value":446},{"type":49,"tag":83,"props":1291,"children":1292},{"style":96},[1293],{"type":55,"value":451},{"type":49,"tag":83,"props":1295,"children":1296},{"style":96},[1297],{"type":55,"value":456},{"type":49,"tag":83,"props":1299,"children":1300},{"style":96},[1301],{"type":55,"value":461},{"type":49,"tag":83,"props":1303,"children":1304},{"style":464},[1305],{"type":55,"value":1140},{"type":49,"tag":83,"props":1307,"children":1308},{"style":96},[1309],{"type":55,"value":229},{"type":49,"tag":83,"props":1311,"children":1312},{"style":96},[1313],{"type":55,"value":234},{"type":49,"tag":83,"props":1315,"children":1316},{"style":192},[1317],{"type":55,"value":239},{"type":49,"tag":83,"props":1319,"children":1320},{"class":85,"line":274},[1321,1325,1329,1333],{"type":49,"tag":83,"props":1322,"children":1323},{"style":181},[1324],{"type":55,"value":247},{"type":49,"tag":83,"props":1326,"children":1327},{"style":90},[1328],{"type":55,"value":252},{"type":49,"tag":83,"props":1330,"children":1331},{"style":181},[1332],{"type":55,"value":257},{"type":49,"tag":83,"props":1334,"children":1335},{"style":96},[1336],{"type":55,"value":262},{"type":49,"tag":83,"props":1338,"children":1339},{"class":85,"line":283},[1340],{"type":49,"tag":83,"props":1341,"children":1342},{"style":96},[1343],{"type":55,"value":271},{"type":49,"tag":83,"props":1345,"children":1346},{"class":85,"line":292},[1347],{"type":49,"tag":83,"props":1348,"children":1349},{"style":96},[1350],{"type":55,"value":513},{"type":49,"tag":83,"props":1352,"children":1353},{"class":85,"line":301},[1354],{"type":49,"tag":83,"props":1355,"children":1356},{"style":96},[1357],{"type":55,"value":289},{"type":49,"tag":83,"props":1359,"children":1360},{"class":85,"line":523},[1361],{"type":49,"tag":83,"props":1362,"children":1363},{"style":96},[1364],{"type":55,"value":1200},{"type":49,"tag":83,"props":1366,"children":1367},{"class":85,"line":532},[1368,1372],{"type":49,"tag":83,"props":1369,"children":1370},{"style":96},[1371],{"type":55,"value":307},{"type":49,"tag":83,"props":1373,"children":1374},{"style":181},[1375],{"type":55,"value":312},{"type":49,"tag":360,"props":1377,"children":1379},{"id":1378},"pci-1024-invalid-access-attempts",[1380],{"type":55,"value":1381},"PCI 10.2.4 — Invalid Access Attempts",{"type":49,"tag":58,"props":1383,"children":1384},{},[1385],{"type":55,"value":1386},"Same as CC6.6 failed logins above.",{"type":49,"tag":360,"props":1388,"children":1390},{"id":1389},"pci-1025-all-authentication-events",[1391],{"type":55,"value":1392},"PCI 10.2.5 — All Authentication Events",{"type":49,"tag":71,"props":1394,"children":1396},{"className":73,"code":1395,"language":75,"meta":76,"style":76},"pup audit-logs search \\\n  --query \"@evt.name:Authentication @action:login\" \\\n  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      user: .attributes.attributes.usr.email,\n      auth_method: .attributes.attributes.auth_method,\n      result: .attributes.attributes.status,\n      ip: .attributes.attributes.network.client.ip,\n      country: .attributes.attributes.network.client.geoip.country.name\n    }]'\n",[1397],{"type":49,"tag":79,"props":1398,"children":1399},{"__ignoreMap":76},[1400,1419,1443,1483,1502,1509,1516,1524,1532,1539,1546],{"type":49,"tag":83,"props":1401,"children":1402},{"class":85,"line":86},[1403,1407,1411,1415],{"type":49,"tag":83,"props":1404,"children":1405},{"style":90},[1406],{"type":55,"value":93},{"type":49,"tag":83,"props":1408,"children":1409},{"style":96},[1410],{"type":55,"value":168},{"type":49,"tag":83,"props":1412,"children":1413},{"style":96},[1414],{"type":55,"value":173},{"type":49,"tag":83,"props":1416,"children":1417},{"style":192},[1418],{"type":55,"value":239},{"type":49,"tag":83,"props":1420,"children":1421},{"class":85,"line":113},[1422,1426,1430,1435,1439],{"type":49,"tag":83,"props":1423,"children":1424},{"style":96},[1425],{"type":55,"value":399},{"type":49,"tag":83,"props":1427,"children":1428},{"style":181},[1429],{"type":55,"value":184},{"type":49,"tag":83,"props":1431,"children":1432},{"style":96},[1433],{"type":55,"value":1434},"@evt.name:Authentication @action:login",{"type":49,"tag":83,"props":1436,"children":1437},{"style":181},[1438],{"type":55,"value":214},{"type":49,"tag":83,"props":1440,"children":1441},{"style":192},[1442],{"type":55,"value":239},{"type":49,"tag":83,"props":1444,"children":1445},{"class":85,"line":265},[1446,1450,1454,1458,1462,1466,1471,1475,1479],{"type":49,"tag":83,"props":1447,"children":1448},{"style":96},[1449],{"type":55,"value":441},{"type":49,"tag":83,"props":1451,"children":1452},{"style":96},[1453],{"type":55,"value":446},{"type":49,"tag":83,"props":1455,"children":1456},{"style":96},[1457],{"type":55,"value":451},{"type":49,"tag":83,"props":1459,"children":1460},{"style":96},[1461],{"type":55,"value":456},{"type":49,"tag":83,"props":1463,"children":1464},{"style":96},[1465],{"type":55,"value":461},{"type":49,"tag":83,"props":1467,"children":1468},{"style":464},[1469],{"type":55,"value":1470}," 1000",{"type":49,"tag":83,"props":1472,"children":1473},{"style":96},[1474],{"type":55,"value":229},{"type":49,"tag":83,"props":1476,"children":1477},{"style":96},[1478],{"type":55,"value":234},{"type":49,"tag":83,"props":1480,"children":1481},{"style":192},[1482],{"type":55,"value":239},{"type":49,"tag":83,"props":1484,"children":1485},{"class":85,"line":274},[1486,1490,1494,1498],{"type":49,"tag":83,"props":1487,"children":1488},{"style":181},[1489],{"type":55,"value":247},{"type":49,"tag":83,"props":1491,"children":1492},{"style":90},[1493],{"type":55,"value":252},{"type":49,"tag":83,"props":1495,"children":1496},{"style":181},[1497],{"type":55,"value":257},{"type":49,"tag":83,"props":1499,"children":1500},{"style":96},[1501],{"type":55,"value":262},{"type":49,"tag":83,"props":1503,"children":1504},{"class":85,"line":283},[1505],{"type":49,"tag":83,"props":1506,"children":1507},{"style":96},[1508],{"type":55,"value":271},{"type":49,"tag":83,"props":1510,"children":1511},{"class":85,"line":292},[1512],{"type":49,"tag":83,"props":1513,"children":1514},{"style":96},[1515],{"type":55,"value":280},{"type":49,"tag":83,"props":1517,"children":1518},{"class":85,"line":301},[1519],{"type":49,"tag":83,"props":1520,"children":1521},{"style":96},[1522],{"type":55,"value":1523},"      auth_method: .attributes.attributes.auth_method,\n",{"type":49,"tag":83,"props":1525,"children":1526},{"class":85,"line":523},[1527],{"type":49,"tag":83,"props":1528,"children":1529},{"style":96},[1530],{"type":55,"value":1531},"      result: .attributes.attributes.status,\n",{"type":49,"tag":83,"props":1533,"children":1534},{"class":85,"line":532},[1535],{"type":49,"tag":83,"props":1536,"children":1537},{"style":96},[1538],{"type":55,"value":847},{"type":49,"tag":83,"props":1540,"children":1541},{"class":85,"line":1021},[1542],{"type":49,"tag":83,"props":1543,"children":1544},{"style":96},[1545],{"type":55,"value":855},{"type":49,"tag":83,"props":1547,"children":1549},{"class":85,"line":1548},11,[1550,1554],{"type":49,"tag":83,"props":1551,"children":1552},{"style":96},[1553],{"type":55,"value":307},{"type":49,"tag":83,"props":1555,"children":1556},{"style":181},[1557],{"type":55,"value":312},{"type":49,"tag":360,"props":1559,"children":1561},{"id":1560},"pci-1027-object-creation-and-deletion",[1562],{"type":55,"value":1563},"PCI 10.2.7 — Object Creation and Deletion",{"type":49,"tag":71,"props":1565,"children":1567},{"className":73,"code":1566,"language":75,"meta":76,"style":76},"pup audit-logs search \\\n  --query \"@action:(created OR deleted)\" \\\n  --from PERIOD_START --to PERIOD_END --limit 1000 -o json \\\n  | jq '[.data[] | {\n      timestamp: .attributes.timestamp,\n      user: .attributes.attributes.usr.email,\n      action: .attributes.attributes.action,\n      resource_type: .attributes.attributes.asset.type,\n      resource_id: .attributes.attributes.asset.id,\n      ip: .attributes.attributes.network.client.ip\n    }]'\n",[1568],{"type":49,"tag":79,"props":1569,"children":1570},{"__ignoreMap":76},[1571,1590,1614,1653,1672,1679,1686,1693,1700,1708,1716],{"type":49,"tag":83,"props":1572,"children":1573},{"class":85,"line":86},[1574,1578,1582,1586],{"type":49,"tag":83,"props":1575,"children":1576},{"style":90},[1577],{"type":55,"value":93},{"type":49,"tag":83,"props":1579,"children":1580},{"style":96},[1581],{"type":55,"value":168},{"type":49,"tag":83,"props":1583,"children":1584},{"style":96},[1585],{"type":55,"value":173},{"type":49,"tag":83,"props":1587,"children":1588},{"style":192},[1589],{"type":55,"value":239},{"type":49,"tag":83,"props":1591,"children":1592},{"class":85,"line":113},[1593,1597,1601,1606,1610],{"type":49,"tag":83,"props":1594,"children":1595},{"style":96},[1596],{"type":55,"value":399},{"type":49,"tag":83,"props":1598,"children":1599},{"style":181},[1600],{"type":55,"value":184},{"type":49,"tag":83,"props":1602,"children":1603},{"style":96},[1604],{"type":55,"value":1605},"@action:(created OR deleted)",{"type":49,"tag":83,"props":1607,"children":1608},{"style":181},[1609],{"type":55,"value":214},{"type":49,"tag":83,"props":1611,"children":1612},{"style":192},[1613],{"type":55,"value":239},{"type":49,"tag":83,"props":1615,"children":1616},{"class":85,"line":265},[1617,1621,1625,1629,1633,1637,1641,1645,1649],{"type":49,"tag":83,"props":1618,"children":1619},{"style":96},[1620],{"type":55,"value":441},{"type":49,"tag":83,"props":1622,"children":1623},{"style":96},[1624],{"type":55,"value":446},{"type":49,"tag":83,"props":1626,"children":1627},{"style":96},[1628],{"type":55,"value":451},{"type":49,"tag":83,"props":1630,"children":1631},{"style":96},[1632],{"type":55,"value":456},{"type":49,"tag":83,"props":1634,"children":1635},{"style":96},[1636],{"type":55,"value":461},{"type":49,"tag":83,"props":1638,"children":1639},{"style":464},[1640],{"type":55,"value":1470},{"type":49,"tag":83,"props":1642,"children":1643},{"style":96},[1644],{"type":55,"value":229},{"type":49,"tag":83,"props":1646,"children":1647},{"style":96},[1648],{"type":55,"value":234},{"type":49,"tag":83,"props":1650,"children":1651},{"style":192},[1652],{"type":55,"value":239},{"type":49,"tag":83,"props":1654,"children":1655},{"class":85,"line":274},[1656,1660,1664,1668],{"type":49,"tag":83,"props":1657,"children":1658},{"style":181},[1659],{"type":55,"value":247},{"type":49,"tag":83,"props":1661,"children":1662},{"style":90},[1663],{"type":55,"value":252},{"type":49,"tag":83,"props":1665,"children":1666},{"style":181},[1667],{"type":55,"value":257},{"type":49,"tag":83,"props":1669,"children":1670},{"style":96},[1671],{"type":55,"value":262},{"type":49,"tag":83,"props":1673,"children":1674},{"class":85,"line":283},[1675],{"type":49,"tag":83,"props":1676,"children":1677},{"style":96},[1678],{"type":55,"value":271},{"type":49,"tag":83,"props":1680,"children":1681},{"class":85,"line":292},[1682],{"type":49,"tag":83,"props":1683,"children":1684},{"style":96},[1685],{"type":55,"value":280},{"type":49,"tag":83,"props":1687,"children":1688},{"class":85,"line":301},[1689],{"type":49,"tag":83,"props":1690,"children":1691},{"style":96},[1692],{"type":55,"value":289},{"type":49,"tag":83,"props":1694,"children":1695},{"class":85,"line":523},[1696],{"type":49,"tag":83,"props":1697,"children":1698},{"style":96},[1699],{"type":55,"value":1010},{"type":49,"tag":83,"props":1701,"children":1702},{"class":85,"line":532},[1703],{"type":49,"tag":83,"props":1704,"children":1705},{"style":96},[1706],{"type":55,"value":1707},"      resource_id: .attributes.attributes.asset.id,\n",{"type":49,"tag":83,"props":1709,"children":1710},{"class":85,"line":1021},[1711],{"type":49,"tag":83,"props":1712,"children":1713},{"style":96},[1714],{"type":55,"value":1715},"      ip: .attributes.attributes.network.client.ip\n",{"type":49,"tag":83,"props":1717,"children":1718},{"class":85,"line":1548},[1719,1723],{"type":49,"tag":83,"props":1720,"children":1721},{"style":96},[1722],{"type":55,"value":307},{"type":49,"tag":83,"props":1724,"children":1725},{"style":181},[1726],{"type":55,"value":312},{"type":49,"tag":350,"props":1728,"children":1729},{},[],{"type":49,"tag":64,"props":1731,"children":1733},{"id":1732},"evidence-report-template",[1734],{"type":55,"value":1735},"Evidence Report Template",{"type":49,"tag":71,"props":1737,"children":1741},{"className":1738,"code":1740,"language":55},[1739],"language-text","# Datadog Audit Trail — Compliance Evidence Report\nFramework: [SOC 2 \u002F PCI DSS]\nOrganization: [org name]\nPeriod: [start] to [end]\nGenerated: [date]\n\n## Scope Boundary\nThis report covers administrative actions within the Datadog platform.\nIt does not cover actions taken within systems that Datadog monitors.\n\n## Retention Status\n[✓ Full period covered by Audit Trail retention]\n[⚠ Requested period exceeds 90-day default. Archive config required for complete coverage.]\n\n---\n\n## [Control ID] — [Control Name]\nEvents found: [N]\n\n| Timestamp | Actor | Action | Resource Type | Resource ID | IP | Country |\n|-----------|-------|--------|---------------|-------------|-----|---------|\n| ...       | ...   | ...    | ...           | ...         | ... | ...     |\n\n[Repeat per control]\n\n---\n\n## Gaps\n[List any controls where data was unavailable or incomplete, and why]\n",[1742],{"type":49,"tag":79,"props":1743,"children":1744},{"__ignoreMap":76},[1745],{"type":55,"value":1740},{"type":49,"tag":64,"props":1747,"children":1749},{"id":1748},"scope-caveat",[1750],{"type":55,"value":1751},"Scope Caveat",{"type":49,"tag":58,"props":1753,"children":1754},{},[1755,1757,1763],{"type":55,"value":1756},"Datadog Audit Trail covers the ",{"type":49,"tag":1758,"props":1759,"children":1760},"strong",{},[1761],{"type":55,"value":1762},"Datadog platform",{"type":55,"value":1764}," as the system being audited. For PCI purposes, this is evidence that the monitoring platform's access controls are functioning — not direct evidence about the cardholder data environment (CDE) itself. Auditors should understand this scope boundary.",{"type":49,"tag":64,"props":1766,"children":1768},{"id":1767},"references",[1769],{"type":55,"value":1770},"References",{"type":49,"tag":1772,"props":1773,"children":1774},"ul",{},[1775,1787,1797],{"type":49,"tag":329,"props":1776,"children":1777},{},[1778],{"type":49,"tag":1779,"props":1780,"children":1784},"a",{"href":1781,"rel":1782},"https:\u002F\u002Fdocs.datadoghq.com\u002Faccount_management\u002Faudit_trail\u002Fevents\u002F",[1783],"nofollow",[1785],{"type":55,"value":1786},"Audit Trail events reference",{"type":49,"tag":329,"props":1788,"children":1789},{},[1790],{"type":49,"tag":1779,"props":1791,"children":1794},{"href":1792,"rel":1793},"https:\u002F\u002Fwww.pcisecuritystandards.org\u002Fdocument_library\u002F",[1783],[1795],{"type":55,"value":1796},"PCI DSS Requirement 10",{"type":49,"tag":329,"props":1798,"children":1799},{},[1800],{"type":49,"tag":1779,"props":1801,"children":1804},{"href":1802,"rel":1803},"https:\u002F\u002Fus.aicpa.org\u002Finterestareas\u002Ffrc\u002Fassuranceadvisoryservices\u002Faicpasoc2report",[1783],[1805],{"type":55,"value":1806},"SOC 2 Trust Services Criteria",{"type":49,"tag":1808,"props":1809,"children":1810},"style",{},[1811],{"type":55,"value":1812},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1814,"total":1992},[1815,1832,1850,1861,1877,1891,1907,1921,1933,1945,1957,1977],{"slug":1816,"name":1816,"fn":1817,"description":1818,"org":1819,"tags":1820,"stars":28,"repoUrl":29,"updatedAt":1831},"agent-install","install Datadog Agent on Kubernetes","Install the Datadog Agent on Kubernetes using the Datadog Operator — required before enabling Single Step Instrumentation (SSI), which automatically instruments applications for APM without code changes. Only use if no Datadog Agent is deployed on the cluster yet.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1821,1822,1825,1828],{"name":23,"slug":24,"type":15},{"name":1823,"slug":1824,"type":15},"Deployment","deployment",{"name":1826,"slug":1827,"type":15},"Kubernetes","kubernetes",{"name":1829,"slug":1830,"type":15},"Observability","observability","2026-04-15T04:57:27.489805",{"slug":1833,"name":1833,"fn":1834,"description":1835,"org":1836,"tags":1837,"stars":28,"repoUrl":29,"updatedAt":1849},"agent-observability-auto-experiment","run iterative code improvements using Datadog data","Run an iterative code-improvement hill-climb against real Datadog LLM-Obs data, locally, with Claude Code as the agent. Establishes a baseline eval, makes one focused change, re-scores with the same harness, keeps the change if it improves the score in the goal's direction (labeling within-noise gains tentative), and repeats. Use when the user says \"run an auto experiment\", \"hill-climb this code\", \"iteratively improve X and measure the delta\", \"optimize this prompt\u002Ffile against my traces\", \"auto-optimize against LLM-Obs\", or wants the local equivalent of the auto_experiments worker. Works from a local dataset file, an ml_app, a dataset_id, or a list of trace_ids.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1838,1839,1842,1845,1848],{"name":23,"slug":24,"type":15},{"name":1840,"slug":1841,"type":15},"Debugging","debugging",{"name":1843,"slug":1844,"type":15},"Evals","evals",{"name":1846,"slug":1847,"type":15},"LLM","llm",{"name":1829,"slug":1830,"type":15},"2026-07-31T05:52:13.711906",{"slug":1851,"name":1851,"fn":1852,"description":1853,"org":1854,"tags":1855,"stars":28,"repoUrl":29,"updatedAt":1860},"agent-observability-eval-bootstrap","bootstrap evaluators from production traces","Bootstrap evaluators from production traces — by default propose online LLM-judge evaluators and, after you confirm, create them in Datadog as disabled drafts (never auto-enabled); on request emit Python SDK code or a framework-agnostic JSON spec instead. Use when user says \"bootstrap evaluators\", \"generate evaluators\", \"create evals from traces\", \"eval bootstrap\", \"write evaluators\", \"build eval suite\", \"publish evaluators\", or wants to generate BaseEvaluator\u002FLLMJudge code or online judge configs from production LLM trace data. Works with ml_app and optional RCA report or failure hypothesis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1856,1857,1858,1859],{"name":23,"slug":24,"type":15},{"name":1843,"slug":1844,"type":15},{"name":1846,"slug":1847,"type":15},{"name":1829,"slug":1830,"type":15},"2026-06-19T09:04:19.259734",{"slug":1862,"name":1862,"fn":1863,"description":1864,"org":1865,"tags":1866,"stars":28,"repoUrl":29,"updatedAt":1876},"agent-observability-eval-pipeline","run agent observability and evaluation pipelines","End-to-end Agent Observability pipeline for an instrumented ml_app — classify production traces, root-cause failures, bootstrap evaluators, then (optionally) sample + publish a dataset, generate + run an experiment, and analyze results. Six narrated phases with a standardized banner and a \"continue\" checkpoint between each. Pure orchestration over the agent-observability sub-skills (`agent-observability-session-classify`, `agent-observability-trace-rca`, `agent-observability-eval-bootstrap`, `agent-observability-experiment-py-bootstrap`, `agent-observability-experiment-analyzer`). Use when user says \"run the eval pipeline\", \"go from traces to evals\", \"bootstrap evals end to end\", \"classify then RCA then bootstrap\", \"build an eval set from scratch\", \"onboard me to datasets and experiments\", \"walk me through experiments\", \"I have an ml_app, now what\", \"Agent Observability onboarding\", \"guided experiment setup\", \"from traces to experiments\", or wants a deterministic, narrated tour from production data through evaluators, datasets, and experiments. Stop early with `--stop-after \u003Cphase>` to short-circuit at evaluators or dataset, or resume mid-flow with `--start-at \u003Cphase>`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1867,1870,1873,1874,1875],{"name":1868,"slug":1869,"type":15},"Agents","agents",{"name":1871,"slug":1872,"type":15},"Data Pipeline","data-pipeline",{"name":23,"slug":24,"type":15},{"name":1843,"slug":1844,"type":15},{"name":1829,"slug":1830,"type":15},"2026-06-19T09:04:17.231423",{"slug":1878,"name":1878,"fn":1879,"description":1880,"org":1881,"tags":1882,"stars":28,"repoUrl":29,"updatedAt":1890},"agent-observability-experiment-analyzer","analyze LLM experiment results","Analyze LLM experiment results. Handles single or comparative experiments, exploratory or Q&A modes. Use when user says \"analyze experiment\", \"compare experiments\", \"analyze against baseline\", or provides one or two experiment IDs for analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1883,1886,1887,1888,1889],{"name":1884,"slug":1885,"type":15},"Analytics","analytics",{"name":23,"slug":24,"type":15},{"name":1843,"slug":1844,"type":15},{"name":1846,"slug":1847,"type":15},{"name":1829,"slug":1830,"type":15},"2026-06-19T09:04:21.212498",{"slug":1892,"name":1892,"fn":1893,"description":1894,"org":1895,"tags":1896,"stars":28,"repoUrl":29,"updatedAt":1906},"agent-observability-experiment-py-bootstrap","generate Python experiment clients for LLM observability","Generates a self-contained Python experiment client that uses the ddtrace.llmobs SDK. Emits either a runnable .py script or a Jupyter .ipynb notebook matching the canonical DataDog reference notebook style. Use when the user says \"generate Python experiment\", \"write an SDK experiment\", \"create a ddtrace experiment\", \"Python notebook experiment\", \"use the Agent Observability SDK\", or has `ddtrace` installed and wants idiomatic SDK code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1897,1898,1901,1902,1903],{"name":23,"slug":24,"type":15},{"name":1899,"slug":1900,"type":15},"Jupyter","jupyter",{"name":1846,"slug":1847,"type":15},{"name":1829,"slug":1830,"type":15},{"name":1904,"slug":1905,"type":15},"Python","python","2026-06-19T09:04:22.640384",{"slug":1908,"name":1908,"fn":1909,"description":1910,"org":1911,"tags":1912,"stars":28,"repoUrl":29,"updatedAt":1920},"agent-observability-replay-trace","iterate on LLM traces with local code","Use when a developer wants to iterate on ONE specific Agent Observability \u002F LLM Obs trace whose output they didn't like — re-running that trace against their LOCAL code, seeing a concise diff of the old vs new output, and looping (change code → replay → diff) until satisfied. Invoked as \u002Fagent-observability-replay-trace \u003Ctrace-id> [changes to test]. Signals: \"replay this trace\"; \"iterate on a trace\"; \"this trace's output is wrong, fix it and re-run\"; \"re-run trace \u003Cid> with \u003Cchange>\"; pasting a trace id from the Agent Observability UI with a description of what to fix. It fetches the trace via the datadog-llmo MCP or the pup CLI, edits code, re-runs the app to emit a NEW trace, and diffs the two — no local server, no browser. For agents traced with ddtrace \u002F LLM Obs (Python first-class), with JSON-serializable entry input. Do NOT use for: scored Experiments or the browser \"Replay\" button (that's agent-observability-replay-experiment), building an experiment from a dataset\u002FCSV, writing evaluators, root-causing failed traces, or RUM\u002FHTTP session replay.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1913,1914,1915,1916,1917],{"name":23,"slug":24,"type":15},{"name":1840,"slug":1841,"type":15},{"name":1846,"slug":1847,"type":15},{"name":1829,"slug":1830,"type":15},{"name":1918,"slug":1919,"type":15},"Tracing","tracing","2026-07-31T05:52:08.594182",{"slug":1922,"name":1922,"fn":1923,"description":1924,"org":1925,"tags":1926,"stars":28,"repoUrl":29,"updatedAt":1932},"agent-observability-session-classify","evaluate user intent satisfaction in sessions","Classify whether user intent was satisfied in a Datadog Agent Observability trace or session. Three modes: (1) session_id — classify a single CMD+I assistant session with RUM; (2) trace_id — classify a single Agent Observability trace without RUM; (3) ml_app — sample and classify multiple sessions or traces from a given LLM app. Output is compact by default (verdict + one-sentence reason). Use when evaluating satisfaction, classifying sessions\u002Ftraces, labeling data, or generating signal for agent-observability-eval-pipeline or agent-observability-trace-rca.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1927,1928,1929,1930,1931],{"name":1884,"slug":1885,"type":15},{"name":23,"slug":24,"type":15},{"name":1843,"slug":1844,"type":15},{"name":1846,"slug":1847,"type":15},{"name":1829,"slug":1830,"type":15},"2026-06-19T09:04:26.341497",{"slug":1934,"name":1934,"fn":1935,"description":1936,"org":1937,"tags":1938,"stars":28,"repoUrl":29,"updatedAt":1944},"agent-observability-trace-rca","diagnose LLM application failures from traces","Root cause analysis on production LLM traces. Diagnoses why an LLM application is failing — works from eval judge verdicts, runtime errors, or structural anomalies depending on what signals are present. Walks the span tree from symptom to root cause. Use when user says \"what's wrong with my app\", \"why is my eval failing\", \"analyze errors\", \"root cause analysis\", \"diagnose failures\", or wants to understand production failure patterns.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1939,1940,1941,1942,1943],{"name":23,"slug":24,"type":15},{"name":1840,"slug":1841,"type":15},{"name":1843,"slug":1844,"type":15},{"name":1846,"slug":1847,"type":15},{"name":1829,"slug":1830,"type":15},"2026-06-19T09:04:24.316244",{"slug":1946,"name":1946,"fn":1947,"description":1948,"org":1949,"tags":1950,"stars":28,"repoUrl":29,"updatedAt":1956},"agent-skills","use Datadog observability skills","Datadog skills for AI agents. Essential monitoring, logging, tracing and observability.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1951,1952,1955],{"name":23,"slug":24,"type":15},{"name":1953,"slug":1954,"type":15},"Monitoring","monitoring",{"name":1829,"slug":1830,"type":15},"2026-04-06T18:08:33.337476",{"slug":1958,"name":1958,"fn":1959,"description":1960,"org":1961,"tags":1962,"stars":28,"repoUrl":29,"updatedAt":1976},"datadog-app","build and manage Datadog applications","Guides developers building Datadog Apps with TypeScript, React, the @datadog\u002Fapps scaffolder, and @datadog\u002Fvite-plugin. Use when a user wants to scaffold, run, debug, upgrade, build, upload, publish, upload without publishing (draft upload), add an upload-no-publish script, set up CI\u002FCD, use OAuth or API\u002Fapplication key auth, trigger\u002Fpoll Workflow Automation, choose DDSQL or Action Catalog for backend data access, or query app datastores with DDSQL, including backend function troubleshooting.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1963,1964,1967,1970,1973],{"name":23,"slug":24,"type":15},{"name":1965,"slug":1966,"type":15},"Frontend","frontend",{"name":1968,"slug":1969,"type":15},"React","react",{"name":1971,"slug":1972,"type":15},"TypeScript","typescript",{"name":1974,"slug":1975,"type":15},"Vite","vite","2026-06-18T08:01:32.562331",{"slug":1978,"name":1978,"fn":1979,"description":1980,"org":1981,"tags":1982,"stars":28,"repoUrl":29,"updatedAt":1991},"dd-apm","query Datadog APM traces","APM - install, onboard, instrument, enable, set up, configure, traces, services, dependencies, performance analysis. Use for any request involving Datadog APM setup, instrumentation (SSI, ddtrace, agent install), or analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1983,1984,1987,1988],{"name":23,"slug":24,"type":15},{"name":1985,"slug":1986,"type":15},"Distributed Tracing","distributed-tracing",{"name":1829,"slug":1830,"type":15},{"name":1989,"slug":1990,"type":15},"Performance","performance","2026-04-06T18:08:34.575282",35,{"items":1994,"total":2049},[1995,2002,2010,2017,2025,2033,2041],{"slug":1816,"name":1816,"fn":1817,"description":1818,"org":1996,"tags":1997,"stars":28,"repoUrl":29,"updatedAt":1831},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1998,1999,2000,2001],{"name":23,"slug":24,"type":15},{"name":1823,"slug":1824,"type":15},{"name":1826,"slug":1827,"type":15},{"name":1829,"slug":1830,"type":15},{"slug":1833,"name":1833,"fn":1834,"description":1835,"org":2003,"tags":2004,"stars":28,"repoUrl":29,"updatedAt":1849},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2005,2006,2007,2008,2009],{"name":23,"slug":24,"type":15},{"name":1840,"slug":1841,"type":15},{"name":1843,"slug":1844,"type":15},{"name":1846,"slug":1847,"type":15},{"name":1829,"slug":1830,"type":15},{"slug":1851,"name":1851,"fn":1852,"description":1853,"org":2011,"tags":2012,"stars":28,"repoUrl":29,"updatedAt":1860},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2013,2014,2015,2016],{"name":23,"slug":24,"type":15},{"name":1843,"slug":1844,"type":15},{"name":1846,"slug":1847,"type":15},{"name":1829,"slug":1830,"type":15},{"slug":1862,"name":1862,"fn":1863,"description":1864,"org":2018,"tags":2019,"stars":28,"repoUrl":29,"updatedAt":1876},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2020,2021,2022,2023,2024],{"name":1868,"slug":1869,"type":15},{"name":1871,"slug":1872,"type":15},{"name":23,"slug":24,"type":15},{"name":1843,"slug":1844,"type":15},{"name":1829,"slug":1830,"type":15},{"slug":1878,"name":1878,"fn":1879,"description":1880,"org":2026,"tags":2027,"stars":28,"repoUrl":29,"updatedAt":1890},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2028,2029,2030,2031,2032],{"name":1884,"slug":1885,"type":15},{"name":23,"slug":24,"type":15},{"name":1843,"slug":1844,"type":15},{"name":1846,"slug":1847,"type":15},{"name":1829,"slug":1830,"type":15},{"slug":1892,"name":1892,"fn":1893,"description":1894,"org":2034,"tags":2035,"stars":28,"repoUrl":29,"updatedAt":1906},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2036,2037,2038,2039,2040],{"name":23,"slug":24,"type":15},{"name":1899,"slug":1900,"type":15},{"name":1846,"slug":1847,"type":15},{"name":1829,"slug":1830,"type":15},{"name":1904,"slug":1905,"type":15},{"slug":1908,"name":1908,"fn":1909,"description":1910,"org":2042,"tags":2043,"stars":28,"repoUrl":29,"updatedAt":1920},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2044,2045,2046,2047,2048],{"name":23,"slug":24,"type":15},{"name":1840,"slug":1841,"type":15},{"name":1846,"slug":1847,"type":15},{"name":1829,"slug":1830,"type":15},{"name":1918,"slug":1919,"type":15},34]