Who changed the monitor.
Answered from the record, not from memory.
Datadog Audit Trail records every change inside Datadog: monitors, dashboards, API keys, index settings, roles and logins. We switch it on, archive it to your own storage, and keep it as the Runtime Evidence an auditor or a customer questionnaire asks for.
Quick facts
Related
- Access Control, the roles the trail records changes to
- Governance Console, the drift the trail explains
- Log Management, the indexes and filters whose changes are audited
A record of the platform, kept apart from the people who run it
An index quota is raised on a Friday. On Monday the log bill is different and the change has no author. Audit Trail answers that question from the record: who, when, from which key, and what the setting was before. It answers the same question for monitors, dashboards, roles, API keys and every call to the API.
Configuration changes with an author. A monitor silenced, a retention filter widened, an exclusion filter removed, a role granted. Each event carries the user or key, the time, and the state before and after.
Access, recorded. Logins, account and role changes, and application key creation sit in the same explorer as the configuration events, so an access review and a change review are one search.
An archive you own. Events written to your S3, Google Cloud Storage or Azure storage on a schedule, so the record outlives the retention window and sits where your SIEM or your auditor can read it.
Alerts on the record itself. Audit Trail monitors fire on the events that should never pass quietly: a key created outside the usual process, a change to the archive, a role granted to a service account.
A feature that is off by default, a retention window that resets when it is disabled, and an archive nobody checked
How it bills. Audit Trail is priced as a percentage of your monthly Datadog spend, with one rate on an annual commitment and a higher one on-demand. It requires other Datadog products and is not sold on its own. There is no per-event or per-gigabyte meter. The archive costs what your storage charges for the objects written to it. What we configure is retention, archiving and who may read the record.
The configuration traps. Audit Trail is off until someone enables it, and the first time most organisations look for the record is the day they need it. When it is enabled, retention defaults to ninety days and can be set shorter. When it is disabled, retention drops to seven. An archive configured once and never read may be writing to a bucket whose policy has since changed. By default the permissions to read and configure the trail sit with the Admin role, the role that makes the most consequential changes, so the record is read by the people it describes. None of these is a failure of the product. They are the state most organisations find it in.
Field noteThe most common gap we see is that Audit Trail was never enabled. The organisation has run on Datadog for years, the questionnaire asks for a change log for the alerting platform, and the record starts on the day someone finds the setting.
Field noteThe pattern we keep finding is a retention window cut below the ninety-day default and never restored. The trail covers less time than the incident review that needs it.
Field noteAn archive is configured to a bucket whose access policy the cloud team later tightens. Uploads stop, and nobody notices, because no monitor watches the bucket and nobody has opened it since the day it was set up.
Field noteAudit Trail Read sits with the Admin role by default and nobody moves it. The control owner who has to review the record cannot open it, and the evidence is exported by the administrators it is evidence about.
Switch it on, archive it out, and decide who may read it
We start with a Datadog HealthScan. It is read-only and fully automated, and it reports whether Audit Trail is enabled, the retention set, whether an archive exists and is writing, and which roles hold the read and write permissions, before anything changes. Then the sequence is short and the order matters.
- Enable Audit Trail and set retention. The longest window Audit Trail offers, agreed in writing with the owner of the compliance obligation it supports.
- Configure the archive. A bucket in your cloud account, with a policy that lets Datadog write and nothing else. We test that an event written today is readable from the bucket tomorrow.
- Separate reading from changing. The Audit Trail Read and Write permissions on a role that the people who change monitors do not hold, so the record is held apart from the people it describes.
- Build the monitors. Audit Trail monitors on key creation, role changes, archive changes, retention changes and the removal of exclusion or retention filters, routed to the owner of the control.
- Write the evidence procedure. How an auditor's or a customer's question is answered: which search, which export, who runs it, and where the archive sits.
- Hand over, in writing. The retention set, the archive location and policy, the roles that may read the trail, and the monitors that watch it.
Access is the Audit Trail Write permission on the Datadog organisation plus write access to the archive bucket. We operate and evidence the runtime controls that support your compliance obligations. The obligations themselves remain yours.
The record is only evidence if it is still being written
Retention gets changed in a cost review. Bucket policies get rewritten. Roles accumulate members. Managed Observability keeps Audit Trail writing, archived and readable by the right people, and reports on it every month.
Every month, we review the trail. That it is still enabled, that retention matches what was agreed, that events reached the archive this month, and which Audit Trail monitors fired.
Access is kept honest. Who holds Audit Trail Read and Write is listed and compared with the roles agreed at handover. Additions get a reason or a removal.
The record answers the questions. Role changes, key creation and silenced monitors from the month are summarised for the owner of the control, so the quarterly review is a read rather than a search.
The questionnaire is answered from the trail. When a customer or an auditor asks who can change alerting and what changed, the answer is an export from Audit Trail with the archive beside it, not a statement of intent.
We operate the stack. You own the product.
Audit Trail is only evidence if someone keeps it writing, keeps it readable, and keeps the people it describes from being the only ones who can read it. We do that work every month and write down what we found. The trail, the archive and the roles live in your Datadog organisation and your cloud account, and you can take the review in-house whenever you choose.
Datadog is our proof, not our headline. Datadog certified one managed provider globally. We are it. The Powered by Datadog accreditation means Datadog's own engineers reviewed how we instrument, alert, respond and report. We are also a Datadog Advanced Partner, ISO 27001 certified and Cyber Essentials Plus certified, with offices in Cardiff, London and Dublin.
Datadog Audit Trail, answered plainly
How is Datadog Audit Trail billed?
Audit Trail is priced as a percentage of your monthly Datadog spend, with one rate on an annual commitment and a higher one on-demand. It requires other Datadog products and is not sold on its own. There is no per-event or per-gigabyte meter. The archive costs what your cloud storage charges for the objects written to it. We do not publish prices. Retention, archiving and read access are what we configure.
What does Datadog Audit Trail record?
Every request to the Datadog API, and configuration events across the platform: monitors, dashboards, log indexes and exclusion filters, APM retention filters, custom metrics, RUM applications, Synthetic tests, Sensitive Data Scanner groups, user logins, role and account changes, and actions taken by Datadog AI agents on a user's behalf. Datadog flags a subset as notable events because they affect billing or security.
How long does Datadog keep Audit Trail events?
When Audit Trail is enabled, retention defaults to ninety days and can be set to three, seven, fifteen, thirty or ninety. When it is disabled, retention resets to seven days. For anything longer, events are archived to your own S3, Google Cloud Storage or Azure storage, where they stay as long as your bucket policy keeps them.
Can Datadog Audit Trail be used as evidence for ISO 27001 or a customer questionnaire?
It is the record of who changed what in the monitoring platform, with an archive you control, which is what those questions ask for. We operate and evidence the runtime controls that support your compliance obligations. The obligation and the audit remain yours; the export, the archive and the procedure for producing them are what we provide.
What does Critical Cloud do with Audit Trail every month?
Managed Observability confirms Audit Trail is still enabled, checks retention against what was agreed, and verifies that events reached the archive. It reviews who holds the read and write permissions. It then summarises the month's role changes, key creation and silenced monitors for the control owner, and reports what changed.
- Datadog products: every product, and how we implement and run each one
- Access Control: the roles, keys and sign-on the trail records
- Governance Console: the drift across the organisation the trail explains
- Datadog HealthScan: read-only, fully automated, and the first thing we run
The record exists. It is yours. It is still being written.
Tell us what the questionnaire asks. We will show you what Audit Trail holds today, what it does not yet, and what it takes to close the gap.