Audit Trail

This dataset represents audit trail events collected by Datadog for compliance and security monitoring. It tracks all access and configuration activity by users and through APIs across the Datadog Platform, providing detailed audit events for user actions, authentication methods, API calls, and system changes. This enables organizations to monitor who is using Datadog, investigate security incidents, and maintain compliance tracking with full integration into Datadog alerts, dashboards, and role-based access control.

dd.audit

Audit Trail Public Documentation

Audit Logging Knowledge Center

Query Parameters

This dataset uses a polymorphic table function. You must specify parameters when querying.

ParameterTypeRequiredDescription
columnsarray<string>YesList of fields to return for each audit event (e.g., ’timestamp’, ‘source’, ‘@usr.email’, ‘@evt.name’).
filterstringNoOptional Event Platform search string. For example: filter => ‘@usr.email:user@example.com AND @evt.name:dashboard’.
from_timestampstringNoLower time bound for the query; defaults to query context if omitted.
to_timestampstringNoUpper time bound for the query; defaults to query context if omitted.

Example Queries

-- API key usage audit events from the last 24 hours
SELECT * FROM dd.audit(
  columns => ARRAY[
    'timestamp',
    'source',
    '@usr.email',
    '@evt.name',
    '@metadata.api_key.id',
    '@http.method',
    '@http.url_details.path'
  ],
  filter => '@metadata.api_key.id:* AND @evt.name:api_key',
  from_timestamp => now() - interval '24 hours',
  to_timestamp => now()
) AS (
  ts TIMESTAMP,
  src VARCHAR,
  user_email VARCHAR,
  event_name VARCHAR,
  api_key_id VARCHAR,
  http_method VARCHAR,
  url_path VARCHAR
);

-- Failed authentication attempts by geographic location
SELECT * FROM dd.audit(
  columns => ARRAY[
    'timestamp',
    '@status',
    '@auth_method',
    '@usr.email',
    '@network.client.geoip.country.name',
    '@network.client.geoip.city.name',
    '@network.client.ip'
  ],
  filter => '@status:error AND @auth_method:*',
  from_timestamp => now() - interval '7 days',
  to_timestamp => now()
) AS (
  ts TIMESTAMP,
  status VARCHAR,
  auth_method VARCHAR,
  user_email VARCHAR,
  country VARCHAR,
  city VARCHAR,
  client_ip VARCHAR
);

Fields

TitleIDTypeData TypeDescription
TimestamptimestampcoretimestampThe time when the audit event occurred (e.g., 1771261655440).
Ingest Sizeingest_size_in_bytescoreint64The size of the audit event payload in bytes at ingestion time (e.g., 1024).
SourcesourcecorestringSource of the audit event indicating the Datadog service or component (e.g., datadog).
Status@statusevent_attributestringStatus of the audited action indicating success or failure (e.g., info).
Authentication Method@auth_methodevent_attributestringMethod used for authentication during the audited action (e.g., session_cookie).
Tiebreakertiebreakercoreint64Value used to establish deterministic ordering among events with the same timestamp (e.g., 1234567890).
Event Actor Type@evt.actor.typeevent_attributestringType of actor that performed the audited action (e.g., user).
HTTP URL Path@http.url_details.pathevent_attributestringPath component of the HTTP request URL for API-based audit events (e.g., /api/v1/dashboards).
Organization UUID@org.uuidevent_attributestringUnique identifier of the organization associated with the audit event (e.g., abc123def-456-789-ghi-jklmnopqrst).
User UUID@usr.uuidevent_attributestringUnique identifier of the user who performed the audited action (e.g., def456ghi-789-012-jkl-mnopqrstuvwx).
HTTP URL Host@http.url_details.hostevent_attributestringHost component of the HTTP request URL for API-based audit events (e.g., api.datadoghq.com).
User ID@usr.idevent_attributestringNumeric identifier of the user who performed the audited action (e.g., 1234567).
Event Name@evt.nameevent_attributestringName or type of the audited event (e.g., dashboard).
HTTP User Agent@http.useragentevent_attributestringUser agent string from the HTTP request header (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36).
Action@actionevent_attributestringSpecific action that was performed in the audit event (e.g., created).
Actor@actorevent_attributestringThe actor (user or API client) that performed the audited action.
Asset ID@asset.idevent_attributestringIdentifier of the asset or resource involved in the audited action (e.g., abc-123-def).
App Key ID@metadata.app_key.idevent_attributestringIdentifier of the application key used for authentication when auth_method is api_app_keys (e.g., app-key-abc123).
Personal Access Token ID@metadata.pat.idevent_attributestringIdentifier of the Personal Access Token used for authentication when auth_method is pat (e.g., pat-xyz789).
OAuth Client Name@metadata.oauth_client.nameevent_attributestringName of the OAuth client used for authentication when auth_method is oauth_token (e.g., my-oauth-app).
Application Key ID@metadata.application_key.idevent_attributestringIdentifier of the application key used for API authentication (e.g., app-key-abc123).
MessagemessagecorestringHuman-readable message describing the audit event (e.g., User created new dashboard).
Route Path@route.pathevent_attributestringInternal route path for the audited API endpoint (e.g., /api/v1/dashboard/:id).
Client City@network.client.geoip.city.nameevent_attributestringCity name derived from the client IP address geolocation (e.g., New York).
AS Number@network.client.geoip.as.numberevent_attributestringAutonomous System number for the client IP address (e.g., 15169).
AS Name@network.client.geoip.as.nameevent_attributestringAutonomous System name for the client IP address (e.g., Google LLC).
Subdivision ISO Code@network.client.geoip.subdivision.iso_codeevent_attributestringISO code for the subdivision (state/province) from client IP geolocation (e.g., NY).
AS Route@network.client.geoip.as.routeevent_attributestringIP route prefix associated with the client's Autonomous System (e.g., 8.8.8.0/24).
Subdivision Name@network.client.geoip.subdivision.nameevent_attributestringName of the subdivision (state/province) from client IP geolocation (e.g., New York).
HTTP Status Code@http.status_codeevent_attributestringHTTP response status code for API-based audit events (e.g., 200).
Continent Name@network.client.geoip.continent.nameevent_attributestringContinent name derived from the client IP address geolocation (e.g., North America).
Event StatusstatuscorestringOverall status of the audit event (e.g., info).
User Email@usr.emailevent_attributestringEmail address of the user who performed the audited action (e.g., user@example.com).
Country ISO Code@network.client.geoip.country.iso_codeevent_attributestringTwo-letter ISO country code from client IP geolocation (e.g., US).
HTTP Method@http.methodevent_attributestringHTTP request method for API-based audit events (e.g., POST).
API Key ID@metadata.api_key.idevent_attributestringIdentifier of the API key used for authentication (e.g., api-key-xyz789).
Country Name@network.client.geoip.country.nameevent_attributestringCountry name derived from the client IP address geolocation (e.g., United States).
Client IP Address@network.client.ipevent_attributestringIP address of the client that initiated the audited action (e.g., 192.168.1.100).
Geolocated IP Address@network.client.geoip.ipAddressevent_attributestringIP address used for geolocation lookup (e.g., 203.0.113.10).
Emitted Source@emitted_sourceevent_attributestringSource component that emitted the audit event (e.g., web-app).
Timezone@network.client.geoip.timezoneevent_attributestringTimezone associated with the client IP address location (e.g., America/New_York).
Location Latitude@network.client.geoip.location.latitudeevent_attributefloat64Latitude coordinate from client IP address geolocation (e.g., 40.7128).
Organization Name@org.nameevent_attributestringName of the organization associated with the audit event (e.g., Example Corp).
Asset Type@asset.typeevent_attributestringType of asset or resource involved in the audited action (e.g., dashboard).
Event UUID@uuidevent_attributestringUnique identifier for the audit event (e.g., 550e8400-e29b-41d4-a716-446655440000).
Query Data Access Indexes@asset.new_value.query.data_access.indexesevent_attributestringIndexes accessed by queries in the audited asset configuration (e.g., logs-*,metrics-*).
Query Source@asset.new_value.query_sourceevent_attributestringSource of the query in the audited asset configuration (e.g., logs).
Event IDidcorestringA unique identifier for the event.
Discovery Timestampdiscovery_timestampcoreint64The time when Datadog first received the event (milliseconds since Unix epoch). May differ from timestamp if there was an ingestion delay.
Random Drawrandom_drawcorefloat64A random value between 0.0 and 1.0 assigned at ingestion, useful for consistent sampling across queries.