Answer "who did what" security questions from Audit Trail — deletions, config changes, login activity, permission changes, actions from a specific user or IP.
Install
npx skills add datadog-labs/agent-skills --skill dd-audit-security-investigationnpx skills add datadog-labs/agent-skills --skill dd-audit-security-investigation -a claude-code -gnpx skills add datadog-labs/agent-skills --skill dd-audit-security-investigation -a codex -ggemini skills install https://github.com/datadog-labs/agent-skills.git --path dd-audit/security-investigationgh skill install datadog-labs/agent-skills dd-audit-security-investigationgit clone --depth 1 https://github.com/datadog-labs/agent-skills /tmp/datadog-labs__agent-skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/datadog-labs__agent-skills/dd-audit/security-investigation ~/.claude/skills/dd-audit-security-investigation # Claude Code
cp -R /tmp/datadog-labs__agent-skills/dd-audit/security-investigation ~/.agents/skills/dd-audit-security-investigation # Codex, Cursor, Gemini CLI, Copilot, OpenCode