Control Mapping · Dd Audit Compliance Report · datadog-labs/agent-skills · Skills Docs

Control Mapping · Dd Audit Compliance Report · datadog-labs/agent-skills · Skills Docs

Control	Description	Audit Trail Query	Fields Used
CC6.1	Logical access controls implemented	Review role assignments	`@evt.name:"Access Management" @asset.type:role`
CC6.2	User registration and deprovisioning	User lifecycle events	`@evt.name:"Access Management" @asset.type:user @action:(created OR deleted)`
CC6.3	Role-based access	Permission change log	`@evt.name:"Access Management" @asset.type:role`
CC6.6	Logical access boundaries	Failed logins, geo anomalies	`@evt.name:Authentication @action:login @status:error`
CC6.8	Prevent unauthorized access	API key management	`@evt.name:Authentication @asset.type:api_key`
CC7.2	System monitoring — anomaly detection	Privileged/support access	`@evt.actor.type:SUPPORT_USER`
CC7.3	Event response	Changes during incident window	Time-scoped `@action:modified` + `@evt.name` filter
A1.1	Availability monitoring	Monitor create/delete events	`@evt.name:Monitor`

Req	Description	Audit Trail Query	PCI Field Mapping
10.2.1	Access to cardholder data	Dashboard/resource access events	`@http.method:GET @asset.type:dashboard`
10.2.2	Actions by root/privileged users	Support user and org admin events	`@evt.actor.type:SUPPORT_USER`
10.2.3	Access to audit trail	Audit Trail config events	`@evt.name:"Audit Trail"`
10.2.4	Invalid access attempts	Failed authentication events	`@evt.name:Authentication @status:error`
10.2.5	Use of identification/auth mechanisms	All login events	`@evt.name:Authentication @action:login`
10.2.6	Initialization/stopping of audit logs	Audit retention setting changes	`@evt.name:"Audit Trail" @action:modified`
10.2.7	Creation/deletion of system objects	All create/delete events	`@action:(created OR deleted)`
10.3.1	User identification	`@usr.email` field	Present on all user-initiated events
10.3.2	Event type	`@action`, `@evt.name` fields	Present on all events
10.3.3	Date and time	`timestamp` field	ISO 8601 UTC on all events
10.3.4	Success/failure indication	`@status` field	`info`/`error`/`warn`
10.3.5	Origination of event	`@network.client.ip` field	Present on most events
10.3.6	Identity of affected data/component	`@asset.type`, `@asset.id` fields	Present on resource events
10.7	Retain audit logs ≥12 months	Check archive config	Default 90 days — must configure archive

Framework	Required retention	Datadog default	Gap?
SOC 2	Auditor discretion (typically 12 months)	90 days	Yes — configure archive
PCI DSS	12 months minimum	90 days	Yes — configure archive
ISO 27001	3 years typical	90 days	Yes — configure archive
HIPAA	6 years	90 days	Yes — configure archive