k9-ownership-byod-setup
Generate a BYOD ownership preferences reference table for a customer. Walks through preference types, generates CSV, and provides upload instructions (UI, API, cloud storage, or Terraform). Use when asked about BYOD setup, preferences reference table, k9ownershippreferences, or ownership customization.
- Installs
- 458
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/datadog-labs/agent-skills --skill k9-ownership-byod-setup- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads k9-ownership-byod-setup automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
BYOD Preferences Reference Table Setup
Help customers create and upload a k9_ownership_preferences reference table to customize how the Ownership Agent determines resource owners.
Read first
references/schema.md— full schema, column details, validation rules, and per-type examplesassets/example.csv— complete working CSV with all three preference types
Overview
The Ownership Agent infers owners for cloud resources with security findings. Ownership preferences let customers customize this by providing rules in a Datadog reference table. The agent reads them automatically.
With preferences you can:
- Map tags to owners: Resources with specific tag values belong to a particular team or person
- Exclude accounts: Prevent bot accounts or shared infrastructure from appearing as owners
- Provide custom guidance: Give the AI engine organization-specific context
Reference Table Details
- Table name:
k9_ownership_preferences(exact name, must match) - Effect delay: Changes take effect within 24 hours of upload
- Schema: 12 columns, all STRING — see
references/schema.mdfor details
Workflow
Step 1: Determine Needs
Ask the customer:
- Tag mappings: "Do you have tags on your cloud resources that indicate ownership? (e.g.,
cost-center,team,project)" - Exclusions: "Are there bot accounts, service accounts, or shared accounts that should never appear as owners?"
- Prompt text: "Any organization-specific context that would help determine ownership? (e.g., naming conventions, team structure)"
Step 2: Generate CSV
Read references/schema.md for the full column spec and assets/example.csv for a working template. Build a CSV with all 12 column headers. Each row gets a unique sequential id and fills columns relevant to its preference_type, leaving the rest empty.
Step 3: Upload Instructions
Option A — CSV Upload (UI):
- Go to Integrations > Reference Tables in Datadog
- Click New Reference Table
- Upload the CSV
- Set table name to
k9_ownership_preferences - Choose primary key:
preference_type, tag_key, tag_value, handle - Save
Manual uploads support files up to 4 MB.
Option B — Cloud Storage Sync (S3, Azure Blob, GCS): Best for automated, recurring updates. Store your CSV in a cloud storage bucket and Datadog periodically imports it.
- Upload CSV to S3 / Azure Blob / GCS
- In Datadog, go to Integrations > Reference Tables
- Click New Reference Table, select Cloud Storage as source
- Provide storage path and credentials
- Set table name to
k9_ownership_preferences - Datadog re-imports the file periodically
Cloud storage uploads support files up to 200 MB.
Option C — Terraform:
Use the datadog_reference_table resource in the Datadog Terraform provider to manage the table as infrastructure-as-code.
Option D — API: You can manage reference tables programmatically through the Reference Tables API. See the API documentation for available endpoints. Replace the API domain with your Datadog site URL if applicable.
Step 4: Verify
Changes take effect within 24 hours. To verify:
- Identify a resource that matches one of your tag mappings
- After 24 hours, check the ownership suggestion for that resource in the Datadog UI
- The suggested owner should reflect your configured mapping
Key Behaviors
- Case-insensitive matching: Tag keys, tag values, handles, exclusion types, and resource types are all matched case-insensitively
- AND-logic exclusions: All non-empty exclusion fields must match. Empty fields act as wildcards
- Tag mappings complement, not override: Direct ownership indicators (like
team:orservice:tags) take precedence. Tag mappings augment, not replace - Graceful degradation: If the table doesn't exist or is empty, ownership detection works normally without preferences
- Empty table clears preferences: Deleting all rows or deleting the table causes cached preferences to expire and be left empty
- All-or-nothing validation: Any validation failure rejects the entire preference set for that cycle
Troubleshooting
| Problem | Likely cause | Fix |
|---|---|---|
| Preferences not taking effect after 24h | Table name is wrong | Must be exactly k9_ownership_preferences |
| Preferences not taking effect after 24h | Missing column headers | All 12 columns must exist as CSV headers |
| Preferences not taking effect after 24h | Feature not enabled for org | Contact support to enable ownership preferences |
| All preferences rejected | Invalid characters | See references/schema.md Allowed Characters. No angle brackets, curly braces, or pipes |
| All preferences rejected | Missing required field | Check required fields for each preference type in references/schema.md |
| All preferences rejected | Duplicate or conflicting rows | See Duplicate Detection in references/schema.md |
| All preferences rejected | Size limit exceeded | 50 tag mappings, 20 exclusions, 3 prompt texts. 1024 bytes/field, 4096/prompt |
| Tag mapping not matching | Spelling mismatch | Matching is case-insensitive but verify exact tag key/value on resource |
| Exclusion not applying | Scoping too narrow | All non-empty fields must match (AND). Leave filters empty for broad exclusions |
| Preferences cleared unexpectedly | Table emptied or deleted | Both cause cached preferences to expire. Upload a valid CSV to restore |
FAQ
What does the k9-ownership-byod-setup skill do?
Generate a BYOD ownership preferences reference table for a customer. Walks through preference types, generates CSV, and provides upload instructions (UI, API, cloud storage, or Terraform). Use when asked about BYOD setup, preferences reference table, k9ownershippreferences, or ownership customization.
How do I install k9-ownership-byod-setup?
Run npx skills add https://github.com/datadog-labs/agent-skills --skill k9-ownership-byod-setup in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/k9-ownership-byod-setup/ (personal) or .claude/skills/k9-ownership-byod-setup/ (project).
Which AI agents can use k9-ownership-byod-setup?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is k9-ownership-byod-setup safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains k9-ownership-byod-setup?
It is published by datadog-labs in datadog-labs/agent-skills, and it is an official skill from the maker of the technology it covers. It has 458 recorded installs.
More from datadog-labs/agent-skills
dd-pup
datadog-labs/agent-skills
Datadog CLI (Rust). OAuth2 auth with token refresh.
agent-skills
datadog-labs/agent-skills
Datadog skills for AI agents. Essential monitoring, logging, tracing and observability.
dd-logs
datadog-labs/agent-skills
Log management - search, archives, metrics, and cost control.
dd-apm
datadog-labs/agent-skills
APM - install, onboard, instrument, enable, set up, configure, traces, services, dependencies, performance analysis, Data Streams Monitoring (DSM), queue lag, pipeline latency. Use for any request involving Datadog APM setup, instrumentation (SSI, ddtrace, agent install), or analysis.
dd-monitors
datadog-labs/agent-skills
Monitor management - list, search, file-based create, and alerting best practices.
dd-docs
datadog-labs/agent-skills
Datadog docs lookup using docs.datadoghq.com/llms.txt and linked Markdown pages.
Popular devops & cloud skills
microsoft-foundry
microsoft/azure-skills
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent create, managed harness agent create, GitHub Copilot harness agent, create agent, update agent, add tool to agent, invoke agent, agent insights, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure
azure-diagnostics
microsoft/azure-skills
Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.
azure-prepare
microsoft/azure-skills
Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.
azure-ai
microsoft/azure-skills
Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.
azure-deploy
microsoft/azure-skills
Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.
azure-validate
microsoft/azure-skills
Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.