-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Document Datadog AI agent coverage in Audit Trail #38221
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 8 commits
7875850
c581594
3d33b81
3368be6
2a1e447
bc9b35d
60ac055
c21a281
cc870b0
f384fcc
b1b2bfe
c3e9a06
14cab53
89b98b3
4cc0763
26eda6c
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -13,17 +13,34 @@ further_reading: | |||||
|
|
||||||
| ## Overview | ||||||
|
|
||||||
| Datadog AI agents, including the Bits fleet (Bits SRE, Bits Dev, Bits Assistant, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. This guide walks you through finding agent-driven events, filtering them by agent type, and tracing an agent's actions back to the user who delegated them. | ||||||
| Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage. | ||||||
|
anthony-dgx marked this conversation as resolved.
Outdated
|
||||||
|
|
||||||
| ## Agent coverage | ||||||
|
|
||||||
| Datadog AI agents onboard to the actor and delegation model individually, so coverage varies by agent and by action type. Use this table to check what you can query. | ||||||
|
|
||||||
| **As of July 17, 2026**, the following coverage applies: | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Suggestion: The explicit "As of July 17, 2026" anchors the table to a specific date and creates a maintenance burden — readers hitting this page months from now won't know if the table is still accurate. Consider either committing to a review cadence and noting it ("Coverage is reviewed monthly") or dropping the date and letting the table content speak for itself, since each row already describes the current state per agent.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @DataDog fix this
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I can only run on private repositories. |
||||||
|
|
||||||
| | Agent | Status | Notes | | ||||||
| | ----- | ------ | ----- | | ||||||
| | Bits SRE | Tracked | Most actions include `@evt.actor.mode` and `@delegator.*`. Some tool-call and investigation actions do not include these fields yet. | | ||||||
| | Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. | | ||||||
|
anthony-dgx marked this conversation as resolved.
Outdated
|
||||||
| | Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. | | ||||||
| | Bits Agent Builder | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | | ||||||
| | Actions taken through the Datadog MCP server | Tracked | See [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server). | | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
It's clearer (and better for AI chunking) to say that the link is to a section on the same page; I'll add a suggestion in a few other places too |
||||||
| | Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular API and application key or personal access token (PAT) and service account token (SAT) usage. | | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
Restructured to make this easier to read |
||||||
|
|
||||||
| **Note**: Even for a tracked agent, some action types haven't onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types. | ||||||
|
anthony-dgx marked this conversation as resolved.
Outdated
|
||||||
|
|
||||||
| ## View all Datadog AI agent activity | ||||||
|
|
||||||
| 1. Navigate to [Audit Trail][1]. | ||||||
| 2. In the search bar, enter the query: `@evt.actor.mode:*`. | ||||||
|
|
||||||
| This query returns every event where a Datadog AI agent is the actor, whether the agent acted `interactive` (a user was present and approved the action) or `autonomous` (the agent acted on a system trigger, with no user involved). | ||||||
| This query returns events where an onboarded Datadog AI agent is the actor, whether the agent acted `interactive` (a user was present and approved the action) or `autonomous` (the agent acted on a system trigger, with no user involved). See [Agent coverage](#agent-coverage) for which agents and action types this includes. | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
| 3. Click an event to open details and see the full actor breakdown: the delegator (the user, if any), the agent, and the mode. | ||||||
|
|
||||||
| **Note**: Rollout to all Bits agents is in progress, and coverage is not yet complete. Actions from agents that have not yet onboarded do not appear in `@evt.actor.mode:*` results. | ||||||
| **Note**: This query only returns activity from agents and action types already onboarded to the actor and delegation model. See [Agent coverage](#agent-coverage) for details. | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
|
|
||||||
| ## View actions taken through the Datadog MCP server | ||||||
|
|
||||||
|
|
@@ -50,13 +67,16 @@ To retrieve a user's complete activity, including delegated agent actions: | |||||
| | All actions attributed to a user, including actions a Datadog AI agent performed on their behalf | `(@usr.id:<USER_ID> OR @delegator.id:<USER_ID>)` | | ||||||
| 3. See [Create a dashboard or a graph][2] if you want to put this information into a dashboard or graph. | ||||||
|
|
||||||
| **Note**: This only surfaces delegated actions from agents and action types already onboarded to the delegation model. See [Agent coverage](#agent-coverage) for details. | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
|
|
||||||
| ## Distinguish agent events from human events | ||||||
|
|
||||||
| Agent-driven events are marked with the agent's name and avatar (for example, Bits Assistant) paired with the delegating user, labeled Co-authored by user + agent. This lets you distinguish agent activity from human activity without opening each event. | ||||||
| Agent-driven events are marked with the agent's name and avatar (for example, Bits Chat) paired with the delegating user, labeled Co-authored by user + agent. This lets you distinguish agent activity from human activity without opening each event. | ||||||
|
|
||||||
| ## Further reading | ||||||
|
|
||||||
| {{< partial name="whats-next/whats-next.html" >}} | ||||||
|
|
||||||
| [1]: https://app.datadoghq.com/audit-trail | ||||||
| [2]: /account_management/audit_trail/#create-a-dashboard-or-a-graph | ||||||
| [3]: https://app.datadoghq.com/ask | ||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It looks like you dropped "Bits Dev" from the list here; was that intentional? Bits Dev is still mentioned on this other page: https://github.com/DataDog/documentation/pull/38221/changes#diff-d522430ba4fafc9a364e7d797865cfcd58a9caca40f616e2bb9d2a254ce659fcR21
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good catch! I removed it from the list because Bits Dev can't take action in Datadog today