# Datadog Inspector Expert

> Interpret datadog-inspector findings and translate Datadog monitoring, audit, log-retention, SSO, and RBAC results into GRC evidence and remediation.

- Skill: `grcengclub/datadog-inspector-expert` (Agent Skill)
- Install (CLI): `npx skillmds@latest add grcengclub/datadog-inspector-expert`
- Raw SKILL.md: https://api.skillmd.com/api/skills/grcengclub/datadog-inspector-expert/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: grcengclub (https://skillmd.com/u/grcengclub)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/grcengclub/datadog-inspector-expert

---


# Datadog Inspector Expert

Use this skill when reviewing `datadog-inspector` output or planning Datadog control remediation.

## Output Shape

Findings are written to:

```text
~/.cache/claude-grc/findings/datadog-inspector/<run_id>.json
```

The connector emits a `datadog_organization` resource with SCF evaluations for:

- `DCH-07`: log retention
- `LOG-08`: audit log availability
- `MON-01.2`: critical monitor coverage
- `IAC-04`: SSO enforcement visibility
- `IAC-07`: RBAC role inventory visibility
- `GOV-03`: organization/API inventory

## Review Guidance

- Treat `inconclusive` as a permission or plan-coverage gap, not a pass.
- Confirm monitor coverage against the user's actual critical service inventory; the collector can only infer criticality from Datadog monitor metadata.
- Pair API output with Datadog org settings screenshots when SSO or audit APIs are unavailable.

## Remediation Patterns

- Set log index retention according to incident-response and regulatory requirements.
- Ensure audit events are retained and exportable to long-term evidence storage.
- Create monitors for production services and route critical alerts to incident response.
- Enforce SSO and review local-user exceptions.
- Review custom roles for least privilege.