Datadog Audit Trail Investigate user activity, configuration changes, access patterns, and compliance evidence using . Sub-Skills | Sub-skill | Use when | |-----------|----------| | security-investigation | "Who changed X?", "What did this user do?", "Show me deletions in the last 24h" | | key-compromise | "Was this API key compromised?", "What did key XYZ do?", "Investigate suspicious key activity" | | cost-spike-investigation | "Why did my bill go up?", "What caused this usage spike?", "Investigate LLM cost increase" | | compliance-report | "Generate SOC 2 evidence", "PCI audit log", "User…