Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion content/en/account_management/audit_trail/events.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ further_reading:

## Agent actor and delegation fields

In addition to product-specific events, Audit Trail events can carry actor and delegation metadata that identifies actions taken by a Datadog AI agent, such as Bits SRE, Bits Dev, Bits Assistant, Bits Security Analyst, and Bits Agent Builder.
In addition to product-specific events, Audit Trail events can carry actor and delegation metadata that identifies actions taken by a Datadog AI agent, such as Bits SRE, Bits Chat, Bits Security Analyst, and Bits Agent Builder.

| Field | Description |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,17 +13,34 @@ further_reading:

## Overview

Datadog AI agents, including the Bits fleet (Bits SRE, Bits Dev, Bits Assistant, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. This guide walks you through finding agent-driven events, filtering them by agent type, and tracing an agent's actions back to the user who delegated them.
Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like you dropped "Bits Dev" from the list here; was that intentional? Bits Dev is still mentioned on this other page: https://github.com/DataDog/documentation/pull/38221/changes#diff-d522430ba4fafc9a364e7d797865cfcd58a9caca40f616e2bb9d2a254ce659fcR21

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch! I removed it from the list because Bits Dev can't take action in Datadog today

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style: "current" is a temporal marker that ages similarly to "currently" (avoided per the style guide). Since the new section is titled "Agent coverage," you can drop the qualifier:

Suggested change
Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage.
Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking agent coverage.


## Agent coverage

Datadog AI agents onboard to the actor and delegation model individually, so coverage varies by agent and by action type. Use this table to check what you can query.

**As of July 17, 2026**, the following coverage applies:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The explicit "As of July 17, 2026" anchors the table to a specific date and creates a maintenance burden — readers hitting this page months from now won't know if the table is still accurate. Consider either committing to a review cadence and noting it ("Coverage is reviewed monthly") or dropping the date and letting the table content speak for itself, since each row already describes the current state per agent.


| Agent | Status | Notes |
| ----- | ------ | ----- |
| Bits SRE | Tracked | Most actions include `@evt.actor.mode` and `@delegator.*`. Some tool-call and investigation actions do not include these fields yet. |
| Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. |

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style: This keyboard shortcut is written differently than elsewhere in the docs (see content/en/bits_ai/bits_chat.md:132, which uses <kbd> tags and includes both Cmd and Ctrl). Windows/Linux users won't recognize Cmd+I. Consider matching the existing pattern:

Suggested change
| Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. |
| Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (<kbd>Cmd</kbd>/<kbd>Ctrl</kbd> + <kbd>I</kbd>) don't include these fields yet. |

| Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. |
| Bits Agent Builder | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. |
| Actions taken through the Datadog MCP server | Tracked | See the [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server) section. |
| Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular usage of API keys, application keys, personal access tokens (PATs), or service account tokens (SATs). |

**Note**: Even for a tracked agent, some action types haven't onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style: "action types haven't onboarded" reads awkwardly — action types are the thing being onboarded, not the actor. Passive voice fits better here:

Suggested change
**Note**: Even for a tracked agent, some action types haven't onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types.
**Note**: Even for a tracked agent, some action types haven't been onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types.


## View all Datadog AI agent activity

1. Navigate to [Audit Trail][1].
2. In the search bar, enter the query: `@evt.actor.mode:*`.

This query returns every event where a Datadog AI agent is the actor, whether the agent acted `interactive` (a user was present and approved the action) or `autonomous` (the agent acted on a system trigger, with no user involved).
This query returns events where an onboarded Datadog AI agent is the actor, whether the agent acted in `interactive` mode (a user was present and approved the action) or `autonomous` mode (the agent acted on a system trigger, with no user involved). See the [Agent coverage](#agent-coverage) section for which agents and action types this includes.
3. Click an event to open details and see the full actor breakdown: the delegator (the user, if any), the agent, and the mode.

**Note**: Rollout to all Bits agents is in progress, and coverage is not yet complete. Actions from agents that have not yet onboarded do not appear in `@evt.actor.mode:*` results.
**Note**: This query only returns activity from agents and action types already onboarded to the actor and delegation model. See the [Agent coverage](#agent-coverage) section for details.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: This note is largely redundant with the sentence added to step 2 (line 40), which already tells readers to see the Agent coverage section for which agents and action types are included. Consider removing this note to reduce noise, since the same information appears immediately above.


## View actions taken through the Datadog MCP server

Expand All @@ -50,13 +67,16 @@ To retrieve a user's complete activity, including delegated agent actions:
| All actions attributed to a user, including actions a Datadog AI agent performed on their behalf | `(@usr.id:<USER_ID> OR @delegator.id:<USER_ID>)` |
3. See [Create a dashboard or a graph][2] if you want to put this information into a dashboard or graph.

**Note**: This only surfaces delegated actions from agents and action types already onboarded to the delegation model. See the [Agent coverage](#agent-coverage) section for details.

## Distinguish agent events from human events

Agent-driven events are marked with the agent's name and avatar (for example, Bits Assistant) paired with the delegating user, labeled Co-authored by user + agent. This lets you distinguish agent activity from human activity without opening each event.
Agent-driven events are marked with the agent's name and avatar (for example, Bits Chat) paired with the delegating user, labeled Co-authored by user + agent. This lets you distinguish agent activity from human activity without opening each event.

## Further reading

{{< partial name="whats-next/whats-next.html" >}}

[1]: https://app.datadoghq.com/audit-trail
[2]: /account_management/audit_trail/#create-a-dashboard-or-a-graph
[3]: https://app.datadoghq.com/ask
10 changes: 6 additions & 4 deletions content/en/bits_ai/bits_chat.md
Original file line number Diff line number Diff line change
Expand Up @@ -126,10 +126,11 @@ Use these insights to understand adoption patterns, identify power users for bes

### Web application
There are multiple ways to open Bits Chat in the Datadog web application:
- In the top-right of the navigation bar, click {{< ui >}}Ask Bits{{< /ui >}}
- In a Datadog product integrated with Bits Chat, click {{< ui >}}Ask Bits{{< /ui >}} or {{< img src="bits_ai/dev_agent/twinkling_stars_icon.png" inline="true" style="width:24px">}} (the twinkling stars icon)
- Press <kbd>Cmd</kbd>/<kbd>Ctrl</kbd> + <kbd>I</kbd>
- In the left-side navigation panel, click {{< ui >}}Bits AI{{< /ui >}}
- Go to [Bits Chat][11] directly.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: "directly" is a filler word here — the URL itself is the direct route. Consider tightening:

Suggested change
- Go to [Bits Chat][11] directly.
- Go to [Bits Chat][11].

- In the top-right of the navigation bar, click {{< ui >}}Ask Bits{{< /ui >}}.
- In a Datadog product integrated with Bits Chat, click {{< ui >}}Ask Bits{{< /ui >}} or {{< img src="bits_ai/dev_agent/twinkling_stars_icon.png" inline="true" style="width:24px">}} (the twinkling stars icon).
- Press <kbd>Cmd</kbd>/<kbd>Ctrl</kbd> + <kbd>I</kbd>.
- In the left-side navigation panel, click {{< ui >}}Bits AI{{< /ui >}}.

{{< img src="bits_ai/getting_started/bits_assistant_side_panel.png" alt="Bits Chat panel open alongside the Dashboards list" style="width:40%;">}}

Expand Down Expand Up @@ -165,3 +166,4 @@ After setup is completed, you can send queries to `@Datadog` in natural language
[8]: /ddsql_reference/data_directory/
[9]: /cloud_cost_management/cloud_cost_skill/
[10]: https://app.datadoghq.com/ask/usage
[11]: https://app.datadoghq.com/ask
Loading