Back to Details

dd-audit

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Datadog Audit Trail

Datadog 审计追踪

Investigate user activity, configuration changes, access patterns, and compliance evidence using 
pup audit-logs
.
使用
pup audit-logs
调查用户活动、配置变更、访问模式以及合规证据。

Sub-Skills

子技能

Sub-skillUse when
security-investigation"Who changed X?", "What did this user do?", "Show me deletions in the last 24h"
key-compromise"Was this API key compromised?", "What did key XYZ do?", "Investigate suspicious key activity"
cost-spike-investigation"Why did my bill go up?", "What caused this usage spike?", "Investigate LLM cost increase"
compliance-report"Generate SOC 2 evidence", "PCI audit log", "User provisioning report for auditor"
ai-activity-audit"What did the AI assistant do?", "Audit MCP tool calls", "AI governance report"
子技能使用场景
security-investigation当你需要查询“谁修改了X？”、“该用户做了什么？”、“展示过去24小时内的删除操作”时使用
key-compromise当你需要查询“这个API密钥是否泄露？”、“密钥XYZ执行了哪些操作？”、“调查可疑密钥活动”时使用
cost-spike-investigation当你需要查询“我的账单为什么上涨？”、“是什么导致了用量激增？”、“调查LLM成本增长”时使用
compliance-report当你需要“生成SOC 2合规证据”、“导出PCI审计日志”、“为审计员生成用户权限配置报告”时使用
ai-activity-audit当你需要查询“AI助手执行了哪些操作？”、“审计MCP工具调用记录”、“生成AI治理报告”时使用

Prerequisites

前提条件

bash
pup auth login   # OAuth2 (recommended)
bash
pup auth login   # OAuth2 (推荐方式)

or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope

或者设置具备audit_logs_read权限的DD_API_KEY和DD_APP_KEY

undefined
undefined

Commands

命令

bash
undefined
bash
undefined

List recent events

列出近期事件

pup audit-logs list --from 1h --limit 100
pup audit-logs list --from 1h --limit 100

Search with a query

使用查询语句搜索

pup audit-logs search --query "@action:deleted" --from 24h
pup audit-logs search --query "@action:deleted" --from 24h

JSON output for piping to jq

输出JSON格式以便通过管道传递给jq

pup audit-logs search --query "@usr.email:alice@example.com" --from 7d -o json | jq '.data[].attributes'
undefined
pup audit-logs search --query "@usr.email:alice@example.com" --from 7d -o json | jq '.data[].attributes'
undefined

Event Schema Quick Reference

事件架构快速参考

FieldDescriptionExample values
@usr.email
Actor email
alice@example.com
@evt.actor.type
How action was taken
USER
, 
API_KEY
, 
SUPPORT_USER
@action
Verb
created
, 
modified
, 
deleted
, 
accessed
, 
login
@evt.name
Event category
Dashboard
, 
Monitor
, 
Authentication
, 
Access Management
@asset.type
Resource type
dashboard
, 
monitor
, 
api_key
, 
role
, 
user
@asset.id
Resource identifier
abc-123
@metadata.api_key.id
API key used (if applicable)
key_abc123
@metadata.app_key.id
App key used (if applicable)
app_abc123
@network.client.ip
Client IP address
1.2.3.4
@network.client.geoip.country.name
Country
United States
@network.client.geoip.as.name
ASN name
Amazon.com
@http.url_details.path
API endpoint path
/api/v1/dashboard/xyz
字段描述示例值
@usr.email
执行者邮箱
alice@example.com
@evt.actor.type
操作执行方式
USER
, 
API_KEY
, 
SUPPORT_USER
@action
操作动词
created
, 
modified
, 
deleted
, 
accessed
, 
login
@evt.name
事件类别
Dashboard
, 
Monitor
, 
Authentication
, 
Access Management
@asset.type
资源类型
dashboard
, 
monitor
, 
api_key
, 
role
, 
user
@asset.id
资源标识符
abc-123
@metadata.api_key.id
使用的API密钥（如适用）
key_abc123
@metadata.app_key.id
使用的应用密钥（如适用）
app_abc123
@network.client.ip
客户端IP地址
1.2.3.4
@network.client.geoip.country.name
国家
United States
@network.client.geoip.as.name
ASN名称
Amazon.com
@http.url_details.path
API端点路径
/api/v1/dashboard/xyz

Search Syntax

搜索语法

Same Lucene-style syntax as Log Explorer:
QueryMeaning
@evt.name:Dashboard
Exact field match
@action:deleted
Action filter
@usr.email:alice@example.com
Specific user
@evt.name:Monitor AND @action:modified
Compound
-@action:deleted
Negation
@usr.email:*
Field exists
@network.client.ip:1.2.3.4
IP filter
与日志探索器相同的Lucene风格语法：
查询语句含义
@evt.name:Dashboard
精确字段匹配
@action:deleted
操作过滤
@usr.email:alice@example.com
指定用户
@evt.name:Monitor AND @action:modified
复合查询
-@action:deleted
排除查询
@usr.email:*
字段存在性查询
@network.client.ip:1.2.3.4
IP过滤

Retention

保留期限

Default retention is 90 days. If querying beyond 90 days, archive to S3/GCS/Azure Blob must be configured. Always check whether the requested time window falls within retention before running a query.
默认保留期限为90天。如果要查询90天之前的内容，必须配置归档到S3/GCS/Azure Blob。执行查询前，请务必确认请求的时间窗口在保留期限内。

Troubleshooting

故障排除

ProblemCauseFix
403 ForbiddenMissing 
audit_logs_read
scope		Add scope to app key in Datadog UI
Empty resultsTime window outside retentionCheck archive config; default max is 90 days
TimeoutQuery too broadNarrow time window or add more filters
No IP dataInternal action or pre-enrichment eventNot all events have geo data
问题原因解决方法
403 Forbidden缺少
audit_logs_read
权限		在Datadog界面中为应用密钥添加该权限
无查询结果时间窗口超出保留期限检查归档配置；默认最长保留90天
查询超时查询范围过广缩小时间窗口或添加更多过滤条件
无IP数据内部操作或预富集事件并非所有事件都包含地理数据

References

参考资料