Name: dt-sec-insights
Author: dynatrace

Query and analyze Dynatrace security data in security.events with DQL: vulnerabilities, threat detections, compliance posture, and scan coverage. Covers Dynatrace-native Runtime Vulnerability Analytics (RVA — CVEs, reachability, exposure, exploit), Runtime Application Protection (RAP), Automated Det

Security Insights Skill Query and analyze Dynatrace security data in security.events using DQL. Events come from Dynatrace native sources (RVA, RAP, Automated Detections, SPM) or external products ingested via integrations (AWS Security Hub, Amazon GuardDuty, GitHub Advanced Security, Snyk, Qualys, Tenable, and more). What This Skill Covers Vulnerability management — open CVEs on running code from DT native RVA (risk ranked with Dynatrace Security Score and the four dimension runtime assessment: vulnerable function in use, public network exposure, reachable data assets, public exploit available) plus external SCA / SAST / image scanners. Compliance posture — DT native KSPM (Kubernetes only: CIS, DORA, NIST, STIG) plus CSPM/VSPM and external compliance/posture providers. Runtime attacks and threats — DT native detections (RAP runtime attacks, Automated Detections rules) plus external detection providers. Threat intelligence — external threat intelligence reports (AlienVault OTX pulses, CrowdStrike Falcon Intelligence) with actor / campaign / targeting context and indicators of compromise (IOCs); correlate reported IOCs / CVEs / techniques against your monitored environment. These are threat intel about the wild — not findings on your entities — and are queried separately. Vulnerability feed — the Dynatrace Library Vulnerability Feed lookup table ( /dt/security/vulnerabilities/libraries ): curated knowledge about CVEs in library ecosystems (npm, PyPI, Maven, Packagist, Go, NuGet) — affected packages and version ranges, fix versions, CISA KEV. Knowledge about the wild, not findings on your entities — combine it with findings to answer "in my environment". It enriches any finding about a library/third party component , whether from RVA (join on vulnerability.external id ) or externally ingested (join on the CVE). Code level and OS findings have no record in this table — CLV by design, OS because those records live in a separate feed — so report that, never as a gap in the feed. Scan coverage analysis — covered vs. not covered k8s workloads/hosts/processes, by Dynatrace scanning feature ( Library Vulnerability Analytics , Operating System Vulnerability Analytics , Code level Vulnerability Analytics ) or by external product. Entity enrichment — map external findings to Dynatrace runtime entities (hosts, K8s workloads, cloud resources) via Smartscape. Dashboards / KPIs — tiles, top N tables, trend charts, coverage donuts. When to Use This Skill ✅ Must first routing rule: identify user intent first, then load the matching primary reference from Quick Start: Find Your Use Case before generating DQL. Identify the intent, then load the matching reference before writing DQL. Cross cutting (any / all finding types) Intent / example Reference Pattern Security posture / overview across all products (incl. DT native) all security events.md § Broad Question Query Decomposition 3 stream decomposition (external+detections 24h / RVA 30m / KSPM 1h ), merged; lead the count summary with KSPM compliance — CIS first (other standards + RVA + detections beneath) → compliance.md § CIS Primary Standard Summary Findings on a specific entity — direct or related (blast radius) dt sec contextualization entity enrichment.md · all security events.md Broad entity security questions must decompose : external FINDING by dt.smartscape source.id / dt.entity. / k8s. ( 24h ) + DT RVA entity scope ( 30m ) + DT SPM entity scope ( 1h ) Findings from a specific provider all security events.md § Scoping to a Specific Provider contains(event.provider \ product.vendor, "<p ", caseSensitive:false) Which third party / external tools are sending data (DT native excluded) all security events.md § Which external integrations are active external only enumeration (single query) Which security products are integrated? / what security data do we have? (default: include DT native RVA + KSPM) all security events.md § Broad Question Query Decomposition 3 stream decomposition; never a single wide security.events scan Which products cover a specific entity dt sec contextualization correlation and coverage.md · all security events.md summarize by product. ; findings vs scans split Routing tie breaker: an unqualified "which security products are integrated? / are we covered? / what do we have?" defaults to the DT inclusive 3 stream decomposition (it must query DT vulnerabilities and compliance). Take the external only single query only when the user explicitly scopes to external / third party tools ("which external tools are sending us data?"). Vulnerabilities (CVE management) Intent / example Reference Pattern Counts / severity ("how many critical?", by risk + mute status) vulnerabilities dynatrace.md RVA snapshot Steps 1–3 Most vulnerable components / hosts / workloads (rankings) vulnerabilities entities.md Steps 1–3 + expand typed related entities.<group .ids → smartscapeNodes lookup on id classic — ⚠ k8s. / dt.entity. are null on RVA events CVE / library lookup; "am I vulnerable to log4shell?" vulnerabilities dynatrace.md § Entity Scoping Step 2 CVE/component filter; scope RVA to a known entity Blast radius — which entities are affected by CVE X vulnerabilities entities.md related entities. indirect relation expand Lifecycle — new / resolved / open duration / MTTR vulnerabilities dynatrace.md post derive resolution.change date ; MTTR via change events only snippet (§ Resolution time) Runtime advanced — function in use, exposure, exploit, data assets vulnerabilities dynatrace.md Davis assessment fieldsAdd (Step 3) External scanner vulns — containers / artifacts / components vulnerabilities external.md VULNERABILITY FINDING + external routing Verify external vulnerability findings with RVA vulnerabilities external.md § Verify external vulnerability findings with RVA · dt sec contextualization entity enrichment.md First match the same vulnerability by vulnerability.references.cve ; then prove runtime relatedness via direct dt.smartscape IDs, container image digest → running CONTAINER , or host host.ip → Smartscape HOST "Newly reported this period and not in the previous period " (external) vulnerabilities external.md · common patterns.md § 18 prior period anti join ( isNull(right. ) ) — a finding.time.created filter is NOT equivalent AI/LLM/GenAI workload vulnerabilities; "which AI services have vulnerabilities?" vulnerabilities dynatrace advanced.md § AI workload vulnerabilities Probe smartscapeNodes "GENAI SERVICE" first — zero rows → report cannot be determined (no GenAI monitored services); non zero → DT findings + GENAI scope ( 30m , dedup finding.id ). ⚠ Zero rows = hard stop — no fallbacks permitted : entity/namespace/workload name substrings, ML library component lists, process/image/label patterns are all prohibited substitutes. New AI workload vulnerabilities this period vulnerabilities dynatrace advanced.md § UC AI2 prior window anti join on {genai service.id, vulnerability.id} Vulnerability feed — "does Dynatrace know about CVE X?", what is CVE X, which ecosystems / packages does it affect, is package@version affected vulnerability feed.md § CVE and package lookup · § Affected version ranges load "/dt/security/vulnerabilities/libraries" + in("CVE X", vulnerability.cve ids) ; one record per ecosystem; expand vulnerability.affected for ranges — DQL cannot compare versions, reason over the returned ranges How can CVE X be fixed / which version fixes it / which version should package P be upgraded to vulnerability feed.md § Fix guidance expand vulnerability.affected → remediation.description , ranges[].fixed ; "fix most in my environment" = RVA component ranking ( vulnerabilities entities.md ) first, then feed "What is DTV \<year\ \<eco\ \<n\ ?" — a Dynatrace Vulnerability Record (DTVR) ID, incl. the vulnerability.external id shown on RVA findings vulnerability feed.md § CVE and package lookup filter vulnerability.id == "DTV …" — the table's sort column, the cheapest feed query; most feed records have no CVE (malicious package advisories), so the DTVR ID is often the only identifier "What is new in the last N days?" vulnerability feed.md § Recently added vulnerabilities origin published is upstream disclosure , not feed ingestion — the feed has no ingestion timestamp, so say "added to the feed" is not answerable. Report CVE backed and malicious package advisories separately — raw counts are dominated by malware records with no CVE "Print / export / give me the whole feed" (or a whole ecosystem) vulnerability feed.md § Mistakes to avoid — Dumping or exporting the corpus Refuse the bulk dump — licensed for in platform analysis only, no redistribution or corpus mirroring. Offer aggregates or a targeted filter instead Feed query inside a workflow / scheduled check ("alert me when the feed goes stale") vulnerability feed.md § Using the feed in workflows same load in dynatrace.automations:execute dql query ; must summarize or limit (task result size), align the window to the trigger cadence Enrich my open findings with feed detail (severity, KEV, ecosystem, remediation) vulnerability feed.md § Enriching RVA findings with feed detail Join on vulnerability.external id → feed vulnerability.id (the feed's key and sort column), aggregating the RVA side to one row per vulnerability.display id first. external id is DTV … for library findings, CVE … for OS findings, null for code level — classify unmatched rows, never report them as "missing from the feed" "Can this actually be exploited here?" / "the vuln is Windows only, are we affected?" / does the workload meet the preconditions vulnerability feed.md § Exploitability: what the feed cannot tell you The feed has no OS / platform / config prerequisites — say so. Use the CVSS vector ( AV: , PR: , UI: , AC: ) for what the vulnerability requires, and vulnerability.davis assessment. ( exposure status , vulnerable function status , data assets status , exploit status ) for whether it is exploitable here Which of my vulnerabilities are exploited in the wild (CISA KEV) vulnerability feed.md § KEV in your environment RVA Step 1 ( 30m , open, not muted) filtered to matchesValue(vulnerability.external id, "DTV ") + lookup a KEV filtered feed side on that key; scope the answer to library findings only . CVE keyed join is the documented fallback for external providers; the feed alone never proves exposure Feed vs RVA tie breaker: "am I vulnerable to / affected by CVE X?" is an environment question → RVA ( vulnerabilities dynatrace.md ). "Does Dynatrace know CVE X / what does it affect / how is it fixed?" is a knowledge question → the feed ( vulnerability feed.md ). Answer both halves only when the user asks about exposure and remediation — and when they want their findings annotated with feed knowledge, join on vulnerability.external id rather than answering the two halves separately. The environment side is not only RVA: any externally ingested finding carrying vulnerability.references.cve can be enriched from the feed with severity, fix versions and KEV — see vulnerability feed.md § CVE fallback for the join, and vulnerabilities external.md for the event shape. If load fails with UNKNOWN TABULAR FILE , the feed is not provisioned on this tenant — say so, do not substitute. Detections (threats & attacks) Intent / example Reference Pattern Severity / time window overview (DT + external) detections.md · all