From 7875850b1023fabde804d7953731f1d0b685221f Mon Sep 17 00:00:00 2001 From: Anthony Dagneaux Date: Thu, 16 Jul 2026 16:09:56 +0200 Subject: [PATCH 01/12] Add agent coverage table to agentic usage tracking guide Clarify which Datadog AI agents and action types are currently tracked under Audit Trail's actor and delegation model, so customers can tell what @evt.actor.mode:* and @delegator.* queries do and don't cover today. --- ...rack_agentic_usage_in_your_organization.md | 24 ++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md index 3623d9c429c..6d9ff013b54 100644 --- a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md +++ b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md @@ -13,17 +13,33 @@ further_reading: ## Overview -Datadog AI agents, including the Bits fleet (Bits SRE, Bits Dev, Bits Assistant, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. This guide walks you through finding agent-driven events, filtering them by agent type, and tracing an agent's actions back to the user who delegated them. +Datadog AI agents, including the Bits fleet (Bits SRE, Bits Dev, Bits Assistant, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage. + +## Agent coverage + +Datadog AI agents onboard to the actor and delegation model individually, so coverage varies by agent and by action type. Use this table to check what you can query today. + +| Agent | Status | Notes | +| ----- | ------ | ----- | +| Bits SRE | Tracked | Most actions include `@evt.actor.mode` and `@delegator.*`. Some tool-call and investigation actions do not include these fields yet. | +| Bits Assistant | Tracked | Actions run in `interactive` mode, with the requesting user in `@delegator.*`. | +| Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. | +| Bits Dev | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | +| Bits Agent Builder | Not yet tracked | Same limitation as Bits Dev. | +| Actions taken through the Datadog MCP server | Tracked | See [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server). | +| Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular API and application key usage. | + +**Note**: Even for a tracked agent, some action types haven't onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types. ## View all Datadog AI agent activity 1. Navigate to [Audit Trail][1]. 2. In the search bar, enter the query: `@evt.actor.mode:*`. - This query returns every event where a Datadog AI agent is the actor, whether the agent acted `interactive` (a user was present and approved the action) or `autonomous` (the agent acted on a system trigger, with no user involved). + This query returns events where an onboarded Datadog AI agent is the actor, whether the agent acted `interactive` (a user was present and approved the action) or `autonomous` (the agent acted on a system trigger, with no user involved). See [Agent coverage](#agent-coverage) for which agents and action types this includes. 3. Click an event to open details and see the full actor breakdown: the delegator (the user, if any), the agent, and the mode. -**Note**: Rollout to all Bits agents is in progress, and coverage is not yet complete. Actions from agents that have not yet onboarded do not appear in `@evt.actor.mode:*` results. +**Note**: This query only returns activity from agents and action types already onboarded to the actor and delegation model. See [Agent coverage](#agent-coverage) for details. ## View actions taken through the Datadog MCP server @@ -50,6 +66,8 @@ To retrieve a user's complete activity, including delegated agent actions: | All actions attributed to a user, including actions a Datadog AI agent performed on their behalf | `(@usr.id: OR @delegator.id:)` | 3. See [Create a dashboard or a graph][2] if you want to put this information into a dashboard or graph. +**Note**: This only surfaces delegated actions from agents and action types already onboarded to the delegation model. See [Agent coverage](#agent-coverage) for details. + ## Distinguish agent events from human events Agent-driven events are marked with the agent's name and avatar (for example, Bits Assistant) paired with the delegating user, labeled Co-authored by user + agent. This lets you distinguish agent activity from human activity without opening each event. From c5815947ee59813d806f1a0a55ba41d4bf4ee722 Mon Sep 17 00:00:00 2001 From: Anthony Dagneaux Date: Thu, 16 Jul 2026 16:12:51 +0200 Subject: [PATCH 02/12] Clarify Bits Assistant coverage is partial, not full Bits Assistant actions through the chat panel are tracked, but actions through inline invocation (Cmd+I) are not yet tracked. --- .../guides/track_agentic_usage_in_your_organization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md index 6d9ff013b54..216cff10887 100644 --- a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md +++ b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md @@ -22,7 +22,7 @@ Datadog AI agents onboard to the actor and delegation model individually, so cov | Agent | Status | Notes | | ----- | ------ | ----- | | Bits SRE | Tracked | Most actions include `@evt.actor.mode` and `@delegator.*`. Some tool-call and investigation actions do not include these fields yet. | -| Bits Assistant | Tracked | Actions run in `interactive` mode, with the requesting user in `@delegator.*`. | +| Bits Assistant | Partially tracked | Actions taken through the chat panel run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken through inline invocation (Cmd+I) don't include these fields yet. | | Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. | | Bits Dev | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | | Bits Agent Builder | Not yet tracked | Same limitation as Bits Dev. | From 3d33b818697286a1068295873ef4b3018b7ef199 Mon Sep 17 00:00:00 2001 From: Anthony Dagneaux Date: Thu, 16 Jul 2026 16:13:43 +0200 Subject: [PATCH 03/12] Fix which Bits Assistant surface is tracked Swap the description: the full Bits Assistant page is tracked, the inline chat panel (Cmd+I) is not yet tracked. --- .../guides/track_agentic_usage_in_your_organization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md index 216cff10887..3a444a7a1e3 100644 --- a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md +++ b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md @@ -22,7 +22,7 @@ Datadog AI agents onboard to the actor and delegation model individually, so cov | Agent | Status | Notes | | ----- | ------ | ----- | | Bits SRE | Tracked | Most actions include `@evt.actor.mode` and `@delegator.*`. Some tool-call and investigation actions do not include these fields yet. | -| Bits Assistant | Partially tracked | Actions taken through the chat panel run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken through inline invocation (Cmd+I) don't include these fields yet. | +| Bits Assistant | Partially tracked | Actions taken from the full Bits Assistant page run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. | | Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. | | Bits Dev | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | | Bits Agent Builder | Not yet tracked | Same limitation as Bits Dev. | From 3368be6d773fb1701b4b4e1727847f45e2e11946 Mon Sep 17 00:00:00 2001 From: Anthony Dagneaux Date: Thu, 16 Jul 2026 16:20:48 +0200 Subject: [PATCH 04/12] Remove Bits Dev from agentic usage tracking guide Bits Dev doesn't take actions in Datadog, so it's out of scope for Audit Trail tracking. --- .../guides/track_agentic_usage_in_your_organization.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md index 3a444a7a1e3..417cbe907d8 100644 --- a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md +++ b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md @@ -13,7 +13,7 @@ further_reading: ## Overview -Datadog AI agents, including the Bits fleet (Bits SRE, Bits Dev, Bits Assistant, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage. +Datadog AI agents, including the Bits fleet (Bits SRE, Bits Assistant, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage. ## Agent coverage @@ -24,8 +24,7 @@ Datadog AI agents onboard to the actor and delegation model individually, so cov | Bits SRE | Tracked | Most actions include `@evt.actor.mode` and `@delegator.*`. Some tool-call and investigation actions do not include these fields yet. | | Bits Assistant | Partially tracked | Actions taken from the full Bits Assistant page run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. | | Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. | -| Bits Dev | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | -| Bits Agent Builder | Not yet tracked | Same limitation as Bits Dev. | +| Bits Agent Builder | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | | Actions taken through the Datadog MCP server | Tracked | See [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server). | | Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular API and application key usage. | From 2a1e44761baf0e15d577ef70ca04fa6d8fb31567 Mon Sep 17 00:00:00 2001 From: Anthony Dagneaux Date: Fri, 17 Jul 2026 10:51:11 +0200 Subject: [PATCH 05/12] Clarify third-party/customer-built agent auth methods Note that third-party or customer-built agents can authenticate with API and application keys, personal access tokens, or service account tokens, none of which Audit Trail distinguishes from regular usage. --- .../guides/track_agentic_usage_in_your_organization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md index 417cbe907d8..e57e993b81f 100644 --- a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md +++ b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md @@ -26,7 +26,7 @@ Datadog AI agents onboard to the actor and delegation model individually, so cov | Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. | | Bits Agent Builder | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | | Actions taken through the Datadog MCP server | Tracked | See [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server). | -| Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular API and application key usage. | +| Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular API and application key or personal access token (PAT) and service account token (SAT) usage. | **Note**: Even for a tracked agent, some action types haven't onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types. From bc9b35de90ba6d13dfea057c6ff052c6fc7fca46 Mon Sep 17 00:00:00 2001 From: Anthony Dagneaux Date: Fri, 17 Jul 2026 10:53:48 +0200 Subject: [PATCH 06/12] Add as-of date to agent coverage table Lets customers know when the coverage table was last verified, since onboarding to the actor and delegation model is ongoing. --- .../guides/track_agentic_usage_in_your_organization.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md index e57e993b81f..83cdab96e97 100644 --- a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md +++ b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md @@ -17,7 +17,9 @@ Datadog AI agents, including the Bits fleet (Bits SRE, Bits Assistant, Bits Secu ## Agent coverage -Datadog AI agents onboard to the actor and delegation model individually, so coverage varies by agent and by action type. Use this table to check what you can query today. +Datadog AI agents onboard to the actor and delegation model individually, so coverage varies by agent and by action type. Use this table to check what you can query. + +**As of July 17, 2026**, the following coverage applies: | Agent | Status | Notes | | ----- | ------ | ----- | From 60ac055cf0cf32fbfcf4728a25a0d87317e71182 Mon Sep 17 00:00:00 2001 From: Anthony Dagneaux Date: Fri, 17 Jul 2026 11:29:08 +0200 Subject: [PATCH 07/12] Rename Bits Assistant to Bits Chat and link the direct Bits Chat URL --- content/en/account_management/audit_trail/events.md | 2 +- .../guides/track_agentic_usage_in_your_organization.md | 7 ++++--- content/en/bits_ai/bits_chat.md | 2 ++ 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/content/en/account_management/audit_trail/events.md b/content/en/account_management/audit_trail/events.md index 253c1b4b2cd..4248f2eb93a 100644 --- a/content/en/account_management/audit_trail/events.md +++ b/content/en/account_management/audit_trail/events.md @@ -18,7 +18,7 @@ further_reading: ## Agent actor and delegation fields -In addition to product-specific events, Audit Trail events can carry actor and delegation metadata that identifies actions taken by a Datadog AI agent, such as Bits SRE, Bits Dev, Bits Assistant, Bits Security Analyst, and Bits Agent Builder. +In addition to product-specific events, Audit Trail events can carry actor and delegation metadata that identifies actions taken by a Datadog AI agent, such as Bits SRE, Bits Dev, Bits Chat, Bits Security Analyst, and Bits Agent Builder. | Field | Description | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| diff --git a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md index 83cdab96e97..ebb730ed384 100644 --- a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md +++ b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md @@ -13,7 +13,7 @@ further_reading: ## Overview -Datadog AI agents, including the Bits fleet (Bits SRE, Bits Assistant, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage. +Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage. ## Agent coverage @@ -24,7 +24,7 @@ Datadog AI agents onboard to the actor and delegation model individually, so cov | Agent | Status | Notes | | ----- | ------ | ----- | | Bits SRE | Tracked | Most actions include `@evt.actor.mode` and `@delegator.*`. Some tool-call and investigation actions do not include these fields yet. | -| Bits Assistant | Partially tracked | Actions taken from the full Bits Assistant page run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. | +| Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. | | Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. | | Bits Agent Builder | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | | Actions taken through the Datadog MCP server | Tracked | See [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server). | @@ -71,7 +71,7 @@ To retrieve a user's complete activity, including delegated agent actions: ## Distinguish agent events from human events -Agent-driven events are marked with the agent's name and avatar (for example, Bits Assistant) paired with the delegating user, labeled Co-authored by user + agent. This lets you distinguish agent activity from human activity without opening each event. +Agent-driven events are marked with the agent's name and avatar (for example, Bits Chat) paired with the delegating user, labeled Co-authored by user + agent. This lets you distinguish agent activity from human activity without opening each event. ## Further reading @@ -79,3 +79,4 @@ Agent-driven events are marked with the agent's name and avatar (for example, Bi [1]: https://app.datadoghq.com/audit-trail [2]: /account_management/audit_trail/#create-a-dashboard-or-a-graph +[3]: https://app.datadoghq.com/ask diff --git a/content/en/bits_ai/bits_chat.md b/content/en/bits_ai/bits_chat.md index 9bab9790686..93c96813fbc 100644 --- a/content/en/bits_ai/bits_chat.md +++ b/content/en/bits_ai/bits_chat.md @@ -126,6 +126,7 @@ Use these insights to understand adoption patterns, identify power users for bes ### Web application There are multiple ways to open Bits Chat in the Datadog web application: +- Go to [Bits Chat][11] directly. - In the top-right of the navigation bar, click {{< ui >}}Ask Bits{{< /ui >}} - In a Datadog product integrated with Bits Chat, click {{< ui >}}Ask Bits{{< /ui >}} or {{< img src="bits_ai/dev_agent/twinkling_stars_icon.png" inline="true" style="width:24px">}} (the twinkling stars icon) - Press Cmd/Ctrl + I @@ -165,3 +166,4 @@ After setup is completed, you can send queries to `@Datadog` in natural language [8]: /ddsql_reference/data_directory/ [9]: /cloud_cost_management/cloud_cost_skill/ [10]: https://app.datadoghq.com/ask/usage +[11]: https://app.datadoghq.com/ask From cc870b0c2004704097f6b2b7e94879d217ad2b67 Mon Sep 17 00:00:00 2001 From: Anthony Dagneaux Date: Mon, 20 Jul 2026 14:44:09 +0200 Subject: [PATCH 08/12] Address review feedback on agent coverage docs - Drop Bits Dev from the agent examples in events.md, matching its removal from the agentic usage guide (it doesn't take actions in Datadog) - Restructure the third-party/customer-built agents note for readability - Clarify section links (Agent coverage, MCP server) to say 'the ... section' instead of just linking the title - Add trailing periods to the Bits Chat web application bullet list --- content/en/account_management/audit_trail/events.md | 2 +- .../guides/track_agentic_usage_in_your_organization.md | 10 +++++----- content/en/bits_ai/bits_chat.md | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/content/en/account_management/audit_trail/events.md b/content/en/account_management/audit_trail/events.md index 4248f2eb93a..3c1782fc027 100644 --- a/content/en/account_management/audit_trail/events.md +++ b/content/en/account_management/audit_trail/events.md @@ -18,7 +18,7 @@ further_reading: ## Agent actor and delegation fields -In addition to product-specific events, Audit Trail events can carry actor and delegation metadata that identifies actions taken by a Datadog AI agent, such as Bits SRE, Bits Dev, Bits Chat, Bits Security Analyst, and Bits Agent Builder. +In addition to product-specific events, Audit Trail events can carry actor and delegation metadata that identifies actions taken by a Datadog AI agent, such as Bits SRE, Bits Chat, Bits Security Analyst, and Bits Agent Builder. | Field | Description | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| diff --git a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md index ebb730ed384..b9eb14abea9 100644 --- a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md +++ b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md @@ -27,8 +27,8 @@ Datadog AI agents onboard to the actor and delegation model individually, so cov | Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. | | Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. | | Bits Agent Builder | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | -| Actions taken through the Datadog MCP server | Tracked | See [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server). | -| Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular API and application key or personal access token (PAT) and service account token (SAT) usage. | +| Actions taken through the Datadog MCP server | Tracked | See the [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server) section. | +| Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular usage of API keys, application keys, personal access tokens (PATs), or service account tokens (SATs). | **Note**: Even for a tracked agent, some action types haven't onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types. @@ -37,10 +37,10 @@ Datadog AI agents onboard to the actor and delegation model individually, so cov 1. Navigate to [Audit Trail][1]. 2. In the search bar, enter the query: `@evt.actor.mode:*`. - This query returns events where an onboarded Datadog AI agent is the actor, whether the agent acted `interactive` (a user was present and approved the action) or `autonomous` (the agent acted on a system trigger, with no user involved). See [Agent coverage](#agent-coverage) for which agents and action types this includes. + This query returns events where an onboarded Datadog AI agent is the actor, whether the agent acted in `interactive` mode (a user was present and approved the action) or `autonomous` mode (the agent acted on a system trigger, with no user involved). See the [Agent coverage](#agent-coverage) section for which agents and action types this includes. 3. Click an event to open details and see the full actor breakdown: the delegator (the user, if any), the agent, and the mode. -**Note**: This query only returns activity from agents and action types already onboarded to the actor and delegation model. See [Agent coverage](#agent-coverage) for details. +**Note**: This query only returns activity from agents and action types already onboarded to the actor and delegation model. See the [Agent coverage](#agent-coverage) section for details. ## View actions taken through the Datadog MCP server @@ -67,7 +67,7 @@ To retrieve a user's complete activity, including delegated agent actions: | All actions attributed to a user, including actions a Datadog AI agent performed on their behalf | `(@usr.id: OR @delegator.id:)` | 3. See [Create a dashboard or a graph][2] if you want to put this information into a dashboard or graph. -**Note**: This only surfaces delegated actions from agents and action types already onboarded to the delegation model. See [Agent coverage](#agent-coverage) for details. +**Note**: This only surfaces delegated actions from agents and action types already onboarded to the delegation model. See the [Agent coverage](#agent-coverage) section for details. ## Distinguish agent events from human events diff --git a/content/en/bits_ai/bits_chat.md b/content/en/bits_ai/bits_chat.md index 93c96813fbc..634eaca3010 100644 --- a/content/en/bits_ai/bits_chat.md +++ b/content/en/bits_ai/bits_chat.md @@ -127,10 +127,10 @@ Use these insights to understand adoption patterns, identify power users for bes ### Web application There are multiple ways to open Bits Chat in the Datadog web application: - Go to [Bits Chat][11] directly. -- In the top-right of the navigation bar, click {{< ui >}}Ask Bits{{< /ui >}} -- In a Datadog product integrated with Bits Chat, click {{< ui >}}Ask Bits{{< /ui >}} or {{< img src="bits_ai/dev_agent/twinkling_stars_icon.png" inline="true" style="width:24px">}} (the twinkling stars icon) -- Press Cmd/Ctrl + I -- In the left-side navigation panel, click {{< ui >}}Bits AI{{< /ui >}} +- In the top-right of the navigation bar, click {{< ui >}}Ask Bits{{< /ui >}}. +- In a Datadog product integrated with Bits Chat, click {{< ui >}}Ask Bits{{< /ui >}} or {{< img src="bits_ai/dev_agent/twinkling_stars_icon.png" inline="true" style="width:24px">}} (the twinkling stars icon). +- Press Cmd/Ctrl + I. +- In the left-side navigation panel, click {{< ui >}}Bits AI{{< /ui >}}. {{< img src="bits_ai/getting_started/bits_assistant_side_panel.png" alt="Bits Chat panel open alongside the Dashboards list" style="width:40%;">}} From b1b2bfeb15d8bdf5eab3683697d7eeed1df56d09 Mon Sep 17 00:00:00 2001 From: anthony-dgx Date: Tue, 21 Jul 2026 16:25:58 +0200 Subject: [PATCH 09/12] Update content/en/bits_ai/bits_chat.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- content/en/bits_ai/bits_chat.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/bits_ai/bits_chat.md b/content/en/bits_ai/bits_chat.md index 634eaca3010..1f6eaaa4375 100644 --- a/content/en/bits_ai/bits_chat.md +++ b/content/en/bits_ai/bits_chat.md @@ -126,7 +126,7 @@ Use these insights to understand adoption patterns, identify power users for bes ### Web application There are multiple ways to open Bits Chat in the Datadog web application: -- Go to [Bits Chat][11] directly. +- Go to [Bits Chat][11]. - In the top-right of the navigation bar, click {{< ui >}}Ask Bits{{< /ui >}}. - In a Datadog product integrated with Bits Chat, click {{< ui >}}Ask Bits{{< /ui >}} or {{< img src="bits_ai/dev_agent/twinkling_stars_icon.png" inline="true" style="width:24px">}} (the twinkling stars icon). - Press Cmd/Ctrl + I. From c3e9a068f2ddf88e96710062d4bc816ba3f65f82 Mon Sep 17 00:00:00 2001 From: anthony-dgx Date: Tue, 21 Jul 2026 16:26:28 +0200 Subject: [PATCH 10/12] Update content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- .../guides/track_agentic_usage_in_your_organization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md index b9eb14abea9..2c740b4dd03 100644 --- a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md +++ b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md @@ -13,7 +13,7 @@ further_reading: ## Overview -Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage. +Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking agent coverage. ## Agent coverage From 14cab53196695ded9f6318e981ff8fc79e874191 Mon Sep 17 00:00:00 2001 From: anthony-dgx Date: Tue, 21 Jul 2026 16:27:21 +0200 Subject: [PATCH 11/12] Update track_agentic_usage_in_your_organization.md --- .../guides/track_agentic_usage_in_your_organization.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md index 2c740b4dd03..c12ee2e4079 100644 --- a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md +++ b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md @@ -19,8 +19,6 @@ Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Datadog AI agents onboard to the actor and delegation model individually, so coverage varies by agent and by action type. Use this table to check what you can query. -**As of July 17, 2026**, the following coverage applies: - | Agent | Status | Notes | | ----- | ------ | ----- | | Bits SRE | Tracked | Most actions include `@evt.actor.mode` and `@delegator.*`. Some tool-call and investigation actions do not include these fields yet. | From 89b98b3107b8a8d020abc8205830a79437d3ff09 Mon Sep 17 00:00:00 2001 From: anthony-dgx Date: Tue, 21 Jul 2026 16:27:48 +0200 Subject: [PATCH 12/12] Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- .../guides/track_agentic_usage_in_your_organization.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md index c12ee2e4079..51790bb47bf 100644 --- a/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md +++ b/content/en/account_management/audit_trail/guides/track_agentic_usage_in_your_organization.md @@ -22,13 +22,13 @@ Datadog AI agents onboard to the actor and delegation model individually, so cov | Agent | Status | Notes | | ----- | ------ | ----- | | Bits SRE | Tracked | Most actions include `@evt.actor.mode` and `@delegator.*`. Some tool-call and investigation actions do not include these fields yet. | -| Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. | +| Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd/Ctrl + I) don't include these fields yet. | | Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. | | Bits Agent Builder | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | | Actions taken through the Datadog MCP server | Tracked | See the [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server) section. | | Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular usage of API keys, application keys, personal access tokens (PATs), or service account tokens (SATs). | -**Note**: Even for a tracked agent, some action types haven't onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types. +**Note**: Even for a tracked agent, some action types haven't been onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types. ## View all Datadog AI agent activity