Setting the skill. One moment.
Skills
Skill 33 of 69
Audit what the Bits AI assistant (MCP server) has done in your Datadog org — tool calls by user, resources accessed, and anomaly flags for AI governance.
1 minute · 204 words · 12 sections
Install
npx skills add datadog-labs/agent-skills --skill dd-audit-ai-activitynpx skills add datadog-labs/agent-skills/plugin marketplace add datadog-labs/agent-skillsThe first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.
Every Datadog MCP tool call is recorded in Audit Trail under the Bits AI SRE category. This skill surfaces what the AI assistant has done in your org — which users invoked it, which tools were called, and which resources were affected.
pup auth login # OAuth2 (recommended)
# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scopepup audit-logs search --query "@evt.name:\"MCP Server\"" --from 7d --limit 500 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
actor_type: .attributes.attributes.evt.actor.type,
action: .attributes.attributes.action,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id,
ip: .attributes.attributes.network.client.ip,
country: .attributes.attributes.network.client.geoip.country.name
}]'pup audit-logs search --query "@evt.name:\"MCP Server\"" --from 30d --limit 1000 -o json \
| jq '[.data[] | .attributes.attributes.usr.email]
| group_by(.)
| map({user: .[0], tool_calls: length})
| sort_by(-.tool_calls)'pup audit-logs search \
--query "@evt.name:\"MCP Server\" @action:(created OR modified OR deleted)" \
--from 7d --limit 500 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
user: .attributes.attributes.usr.email,
action: .attributes.attributes.action,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id
}]'pup audit-logs search \
--query "@evt.name:\"MCP Server\" @usr.email:user@example.com" \
--from 30d --limit 500 -o json \
| jq '[.data[] | {
timestamp: .attributes.timestamp,
action: .attributes.attributes.action,
resource_type: .attributes.attributes.asset.type,
resource_id: .attributes.attributes.asset.id
}]'pup audit-logs search --query "@evt.name:\"MCP Server\"" --from 7d --limit 1000 -o json \
| jq '{
total_tool_calls: (.data | length),
unique_users: ([.data[] | .attributes.attributes.usr.email] | unique | length),
top_users: (
[.data[] | .attributes.attributes.usr.email]
| group_by(.)
| map({user: .[0], calls: length})
| sort_by(-.calls)
| .[:5]
),
actions_breakdown: (
[.data[] | .attributes.attributes.action]
| group_by(.)
| map({action: .[0], count: length})
| sort_by(-.count)
),
resource_types: (
[.data[] | .attributes.attributes.asset.type]
| group_by(.)
| map({type: .[0], count: length})
| sort_by(-.count)
)
}'| Signal | Governance concern |
|---|---|
AI performing deleted actions on monitors or dashboards | Review whether destructive AI operations are expected |
AI acting as SUPPORT_USER | Datadog support using AI on behalf of org |
| First-time user invoking AI tools | New user accessing AI assistant |
| High volume of tool calls in short window | Automated/batch AI usage |
| AI accessing resources outside user’s normal scope | Potential over-permissioned AI session |
AI Activity Audit — [Org] — [Date Range]
Total MCP tool calls: [N]
Unique users: [N]
Top users:
[user@example.com]: [N] calls
Actions breakdown:
accessed: [N]
modified: [N]
created: [N]
deleted: [N]
Resource types affected:
dashboard: [N]
monitor: [N]
Anomalies:
[List any flagged events with timestamp, user, action, resource]This skill is most useful for:
No other observability vendor audits their AI assistant’s actions at this level of detail.
main, last pushed 6 November 2026.SKILL.md, not by matching a directory convention. 11 distinct layouts observed: agent-observability/*/SKILL.md, */SKILL.md, dd-android-sdk/*/SKILL.md, dd-apm/*/SKILL.md, dd-apm/k8s-ssi/*/SKILL.md, dd-apm/linux-ssi/*/SKILL.md, dd-apps/*/SKILL.md, dd-audit/*/SKILL.md, dd-browser-sdk/*/SKILL.md, dd-security/csm/*/SKILL.md, dd-software-delivery/*/SKILL.md.h1 and no skipped levels:.claude-plugin/marketplace.json by datadog-labs, declaring 1 plugin. It is read for editorial metadata only — never as the skill index, which is always the repository tree./datadog-labs/agent-skills.md, and each skill at its own .md URL.