dd-audit-key-compromise
datadog-labs467 installs
Trace a suspect Datadog key's audit history.
What it does
Reconstructs a suspect Datadog API key's activity, request origins, and affected resources to support a compromise investigation.
When to use it
Use when investigating a potentially compromised Datadog API key.
How to use it
Give it the suspect key ID; it returns an investigation report covering activity, origins, endpoints, destructive actions, and recommended remediation.
What you provide
- the suspect key ID
Uses
Latest review
What you need · 2
Requires the pup CLI to authenticate and search Datadog audit logs.
Requires authenticated Datadog access through OAuth2 or API and application keys with audit_logs_read scope.
Access · 1
This skill
Datadog
Read
Reads Datadog audit logs