Setting the skill. One moment.
Skills
Skill 24 of 48
Audit what the Bits AI assistant (MCP server) has done in your Datadog org — tool calls by user, resources accessed, and anomaly flags for AI governance.
1 minute · 204 words · 12 sections
Install
npx skills add datadog-labs/agent-skills --skill dd-audit-ai-activitynpx skills add datadog-labs/agent-skillsThe first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.
Every Datadog MCP tool call is recorded in Audit Trail under the Bits AI SRE category. This skill surfaces what the AI assistant has done in your org — which users invoked it, which tools were called, and which resources were affected.
pup auth login # OAuth2 (recommended)
# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scopepup audit-logs search --query "@evt.name:\"MCP Server\"" --from 7d --limit 500 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
actor_type: .attributes.attributes.evt.actor.type,
action: .attributes.attributes.action,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id,
ip: .attributes.attributes.network.client.ip,
country: .attributes.attributes.network.client.geoip.country.name
}]'pup audit-logs search --query "@evt.name:\"MCP Server\"" --from 30d --limit 1000 -o json \
| jq '[.data[] | .attributes.attributes.usr.email]
| group_by(.)
| map({user: .[0], tool_calls: length})
| sort_by(-.tool_calls)'pup audit-logs search \
--query "@evt.name:\"MCP Server\" @action:(created OR modified OR deleted)" \
--from 7d --limit 500 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
action: .attributes.attributes.action,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id
}]'pup audit-logs search \
--query "@evt.name:\"MCP Server\" @usr.email:user@example.com" \
--from 30d --limit 500 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
action: .attributes.attributes.action,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id
}]'pup audit-logs search --query "@evt.name:\"MCP Server\"" --from 7d --limit 1000 -o json \
| jq '{
total_tool_calls: (.data | length),
unique_users: ([.data[] | .attributes.attributes.usr.email] | unique | length),
top_users: (
[.data[] | .attributes.attributes.usr.email]
| group_by(.)
| map({user: .[0], calls: length})
| sort_by(-.calls)
| .[:5]
),
actions_breakdown: (
[.data[] | .attributes.attributes.action]
| group_by(.)
| map({action: .[0], count: length})
| sort_by(-.count)
),
resource_types: (
[.data[] | .attributes.attributes.asset.type]
| group_by(.)
| map({type: .[0], count: length})
| sort_by(-.count)
)
}'| Signal | Governance concern |
|---|---|
AI performing deleted actions on monitors or dashboards | Review whether destructive AI operations are expected |
AI acting as SUPPORT_USER | Datadog support using AI on behalf of org |
| First-time user invoking AI tools | New user accessing AI assistant |
| High volume of tool calls in short window | Automated/batch AI usage |
| AI accessing resources outside user’s normal scope | Potential over-permissioned AI session |
AI Activity Audit — [Org] — [Date Range]
Total MCP tool calls: [N]
Unique users: [N]
Top users:
[user@example.com]: [N] calls
Actions breakdown:
accessed: [N]
modified: [N]
created: [N]
deleted: [N]
Resource types affected:
dashboard: [N]
monitor: [N]
Anomalies:
[List any flagged events with timestamp, user, action, resource]This skill is most useful for:
No other observability vendor audits their AI assistant’s actions at this level of detail.
main, last pushed 17 September 2026.SKILL.md, not by matching a directory convention. 11 distinct layouts observed: agent-observability/*/SKILL.md, */SKILL.md, dd-apm/k8s-ssi/*/SKILL.md, dd-apm/linux-ssi/*/SKILL.md, dd-apm/*/SKILL.md, dd-apps/*/SKILL.md, dd-audit/*/SKILL.md, dd-browser-sdk/*/SKILL.md, dd-security/csm/*/SKILL.md, dd-software-delivery/*/SKILL.md, SKILL.md (repo root).h1 and no skipped levels:/datadog-labs/agent-skills.md, and each skill at its own .md URL.