Answer "who did what" security questions from Audit Trail — deletions, config changes, login activity, permission changes, actions from a specific user or IP.
This skill does not declare a tool allowlist. The agent host applies whatever default tools are available at runtime.
SKILL.md / Manifest
https://raw.githubusercontent.com/datadog-labs/agent-skills/main/dd-audit/security-investigation/SKILL.mdRegistry
github (via claudemarketplaces.com)