dd-audit-security-investigation

Identifies who performed security-relevant actions in Datadog Audit Trail and highlights anomalous activity.

When to use it

Use for investigations into deletions, configuration changes, logins, permission changes, or activity by a particular user or IP.

Give it a security investigation question; it clarifies the scope, queries Audit Trail, and presents findings with anomalies highlighted.