Audit trail: incident review starts with who changed what

TL;DR

For "who changed this monitor last Tuesday.": change a monitor in staging, find the change in the audit trail with the right actor and timestamp. The audit trail records org-level changes: who created, modified, or deleted monitors, dashboards, SLOs, keys, and settings, and when.

who changed this monitor last Tuesday.

Steps

1. The audit trail records org-level changes: who created, modified, or deleted monitors, dashboards, SLOs, keys, and settings, and when. It is the answer to "who changed this monitor last Tuesday."
2. Incident review starts here. Before theorizing about why the monitor did not fire, check the audit trail: was the threshold changed, was the monitor muted, was notifynodata flipped.
3. Key lifecycle: audit who created API and application keys and when. Stale keys from departed team members get revoked on a schedule, not discovered in a breach.
4. Pair with Terraform. When monitors are code, the audit trail should show applies from the CI identity, not humans. A human editing a Terraform-managed monitor in the UI is the anomaly to investigate.
5. Access reviews: periodic review of who has admin, who can edit monitors, who can manage keys. The audit trail shows whether the permissions match the policy.
6. The trail is an event stream, not a backup: it tells you what changed, not the previous value. For real rollback you need the Terraform state or dashboard JSON in git. Treat audit as detection, version control as recovery.
7. Change a monitor in staging, find the change in the audit trail with the right actor and timestamp. If you cannot find your own change, the trail is not configured or not retained long enough for your compliance needs.

When to use

You are seeing this: Incident review starts here. Use this skill when you run into "Audit trail: incident review starts with who changed what".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

The Datadog audit trail docs cover the event stream of organization changes (who did what, when). Verified against live docs 2026-09-26.