Query and analyze Dynatrace security data in security.events with DQL: vulnerabilities, threat detections, compliance posture, and scan coverage. Covers Dynatrace-native Runtime Vulnerability Analytics (RVA — CVEs, reachability, exposure, exploit), Runtime Application Protection (RAP), Automated Det

Security Insights Skill Query and analyze Dynatrace security data in security.events using DQL. Events come from Dynatrace native sources (RVA, RAP, Automated Detections, SPM) or external products ingested via integrations (AWS Security Hub, Amazon GuardDuty, GitHub Advanced Security, Snyk, Qualys, Tenable, and more). What This Skill Covers Vulnerability management — open CVEs on running code from DT native RVA (risk ranked with Dynatrace Security Score and the four dimension runtime assessment: vulnerable function in use, public network exposure, reachable data assets, public exploit available) plus external SCA / SAST / image scanners. Compliance posture — DT native KSPM (Kubernetes only: CIS, DORA, NIST, STIG) plus CSPM/VSPM and external compliance/posture providers. Runtime attacks and threats — DT native detections (RAP runtime attacks, Automated Detections rules) plus external detection providers. Threat intelligence — external threat intelligence reports (AlienVault OTX pulses, CrowdStrike Falcon Intelligence) with actor / campaign / targeting context and indicators of compromise (IOCs); correlate reported IOCs / CVEs / techniques against your monitored environment. These are threat intel about the wild — not findings on your entities — and are queried separately. Scan coverage analysis — covered vs. not covered k8s workloads/hosts/processes, by Dynatrace scanning feature ( Library Vulnerability Analytics , Operating System Vulnerability Analytics , Code level Vulnerability Analytics ) or by external product. Entity enrichment — map external findings to Dynatrace runtime entities (hosts, K8s workloads, cloud resources) via Smartscape. Dashboards / KPIs — tiles, top N tables, trend charts, coverage donuts. When to Use This Skill ✅ Must first routing rule: identify user intent first, then load the matching primary reference from Quick Start: Find Your Use Case before generating DQL. Identify the intent, then load the matching reference before writing DQL. Cross cutting (any / all finding types) Intent / example Reference Pattern Security posture / overview across all products (incl. DT native) all security events.md § Broad Question Query Decomposition 3 stream decomposition (external+detections 24h / RVA 30m / KSPM 1h ), merged; lead the count summary with KSPM compliance — CIS first (other standards + RVA + detections beneath) → compliance.md § CIS Primary Standard Summary Findings on a specific entity — direct or related (blast radius) dt sec contextualization entity enrichment.md · all security events.md Broad entity security questions must decompose : external FINDING by dt.smartscape source.id / dt.entity. / k8s. ( 24h ) + DT RVA entity scope ( 30m ) + DT SPM entity scope ( 1h ) Findings from a specific provider all security events.md § Scoping to a Specific Provider contains(lower(event.provider \ product.vendor), "<p ") Which third party / external tools are sending data (DT native excluded) all security events.md § Which external integrations are active external only enumeration (single query) Which security products are integrated? / what security data do we have? (default: include DT native RVA + KSPM) all security events.md § Broad Question Query Decomposition 3 stream decomposition; never a single wide security.events scan Which products cover a specific entity dt sec contextualization correlation and coverage.md · all security events.md summarize by product. ; findings vs scans split Routing tie breaker: an unqualified "which security products are integrated? / are we covered? / what do we have?" defaults to the DT inclusive 3 stream decomposition (it must query DT vulnerabilities and compliance). Take the external only single query only when the user explicitly scopes to external / third party tools ("which external tools are sending us data?"). Vulnerabilities (CVE management) Intent / example Reference Pattern Counts / severity ("how many critical?", by risk + mute status) vulnerabilities dynatrace.md RVA snapshot Steps 1–3 Most vulnerable components / hosts / workloads (rankings) vulnerabilities entities.md Steps 1–3 + expand typed related entities.<group .ids → smartscapeNodes lookup on id classic — ⚠ k8s. / dt.entity. are null on RVA events CVE / library lookup; "am I vulnerable to log4shell?" vulnerabilities dynatrace.md § Entity Scoping Step 2 CVE/component filter; scope RVA to a known entity Blast radius — which entities are affected by CVE X vulnerabilities entities.md related entities. indirect relation expand Lifecycle — new / resolved / open duration / MTTR vulnerabilities dynatrace.md post derive resolution.change date ; MTTR via change events only snippet (§ Resolution time) Runtime advanced — function in use, exposure, exploit, data assets vulnerabilities dynatrace.md Davis assessment fieldsAdd (Step 3) External scanner vulns — containers / artifacts / components vulnerabilities external.md VULNERABILITY FINDING + external routing Verify external vulnerability findings with RVA vulnerabilities external.md § Verify external vulnerability findings with RVA · dt sec contextualization entity enrichment.md First match the same vulnerability by vulnerability.references.cve ; then prove runtime relatedness via direct dt.smartscape IDs, container image digest → running CONTAINER , or host host.ip → Smartscape HOST "Newly reported this period and not in the previous period " (external) vulnerabilities external.md · common patterns.md § 18 prior period anti join ( isNull(right. ) ) — a finding.time.created filter is NOT equivalent AI/LLM/GenAI workload vulnerabilities; "which AI services have vulnerabilities?" vulnerabilities dynatrace advanced.md § AI workload vulnerabilities Probe smartscapeNodes "GENAI SERVICE" first — zero rows → report cannot be determined (no GenAI monitored services); non zero → DT findings + GENAI scope ( 30m , dedup finding.id ). ⚠ Zero rows = hard stop — no fallbacks permitted : entity/namespace/workload name substrings, ML library component lists, process/image/label patterns are all prohibited substitutes. New AI workload vulnerabilities this period vulnerabilities dynatrace advanced.md § UC AI2 prior window anti join on {genai service.id, vulnerability.id} Detections (threats & attacks) Intent / example Reference Pattern Severity / time window overview (DT + external) detections.md · all security events.md DETECTION FINDING summary; default unqualified timeframe is 2h , widen to 24h only if empty By attack type ( SQL injection , crypto mining, …) detections.md finding.type substring match Attacker IPs / campaigns detections.md expand actor.ips + ip() MITRE technique / sub technique detections.md threat.attack. arrays RAP only / Automated Detections only detections.md § Provider Routing product.name=="Runtime Application Protection" / event.provider=="Dynatrace Automated Detections" Map detections to entities; repeated firing detections.md · dt sec contextualization entity enrichment.md object.id grouping / enrichment A specific external provider all security events.md § Scoping to a Specific Provider provider contains idiom MITRE routing tie breaker: a MITRE ATT&CK question routes by intent. "Which techniques did we detect / observe (on our entities)?" → detections.md ( DETECTION FINDING ). "Which techniques are reported in threat intel / campaigns in the wild ?" → threat intelligence.md ( THREAT REPORT ). Don't merge the two — a report tagged T1059 is not evidence T1059 occurred in your environment. Threat intelligence (external reports & IOCs) Intent / example Reference Pattern Show / list / count threat intelligence reports; reports by provider, actor, malware family, targeted country/industry, TLP, report type threat intelligence.md THREAT REPORT + dedup {threat.report.id} (SD guard first); never the four key finding summarize Top IOCs (CVEs / IPs / domains / URLs / emails / hashes) or MITRE techniques across reports threat intelligence.md § IOC extraction dedup → expand observable → countDistinctExact(threat.report.id) Am I exposed to report X / are these IOCs in my environment? (threat exposure) threat intelligence.md § Threat Exposure Correlation join report IOCs/CVEs/techniques to VULNERABILITY FINDING /RVA/ DETECTION FINDING ; logs/spans IoC hunt → dt sec ioc hunting Compliance (policy violations & benchmarks) Intent / example Reference Pattern Pass rate / posture (CIS / DORA / NIST / STIG) compliance.md Load compliance.md first — SPM Steps 1–2 + passRate Critical misconfigurations compliance.md Load compliance.md first — Steps 1–2 + severity filter Compliance / misconfigurations on a specific entity compliance.md § Entity Security Tab View (entity scoped ${entityIdsOrNames} filter) · entity enrichment.md Mirror the entity Security tab (CIS default, failed only): Table 1 DT CIS failed rules → Table 2 other DT standards (overlap caveat) → Table 3 external misconfigs. Broad posture/count questions instead use § CIS Primary Standard Summary (scorecard). Map control/standard → entities; per namespace compliance.md entity scoping via compliance.standard.short name / compliance.rule.id (⚠ never metadata json ) Cloud / non K8s (PCI/ISO/HIPAA/GDPR; AWS/Azure/GCP) compliance.md § External external taxonomy ( compliance.standards / policy / control ) External violations grouped by standard / framework compliance.md § External compliance.standards is an array — expand it before summarize Config drift / newly failing rules vs previous week (DT) compliance.md § Week over Week Config Drift prior period anti join — a wide fetch window is NOT a substitute External compliance findings new this period, absent in prior compliance.md § External prior period anti join (same rule as drift) KSPM (Kubernetes only, DT native) compliance.md product.name=="Security Posture Management" Coverage, enrichment & dashboards Intent / example Reference Pattern Coverage / "covered vs not covered" / coverage gaps — hosts / processes / workloads coverage and dashboards.md (counting logic) · dt sec contextualization correlation and coverage.md (match recipes) ⚠ MUST start from smartscapeNodes + lookup scan events — summarizing scan events alone has no denominator and cannot answer a coverage question Specific entity coverage by a DT capability (RVA, SPM, RAP, other DT native) coverage and dashboards.md If no relevant findings or scan/completion events exist for that entity in the capability's operational window, answer not covered — capability is likely not enabled or not configured for that entity Map external findings → workloads / hosts / cloud dt sec contextualization entity enrichment.md 3 way match (K8s) / host by IP / Path 1 (cloud) — ⚠ always join to Smartscape; never group findings by raw object.name / k8s.namespace.name / host.name / cloud resource IDs alone One row per entity risk summary dt sec contextualization entity enrichment.md · coverage and dashboards.md RVA + external merge Dashboards — KPI tiles, top N, trends, donuts coverage and dashboards.md makeTimeseries , summarization recipes ❌ Don't use for: Dynatrace detected problems → dt obs problems Application/infrastructure logs → dt obs logs Distributed tracing → dt obs tracing Service p

dt-sec-insights