/dt-obs-compliance-assistant

name: dt-obs-compliance-assistant
description: >-
  Monitor and investigate EU DORA compliance posture using Dynatrace Compliance Assistant.
  Covers compliance score, CIF health, incident lifecycle, and ICT risk inputs
  (vulnerabilities, security detection findings, misconfigurations).
  Trigger: "DORA compliance", "Digital Operational Resilience Act", "compliance score",
  "compliance snapshot", "score tier", "Critical or Important Functions", "CIF", "CIF health",
  "unclassified problems", "potential major incident", "classified major incident",
  "incident classification under DORA", "compliance.incident bizevent",
  "DQL for classified incidents", "set up Compliance Assistant", "DORA onboarding".
  Do NOT use for other compliance frameworks (SOC2, PCI-DSS, HIPAA, ISO 27001),
  generic Davis problems without DORA or CIF context,
  generic security findings not scoped to DORA,
  or score queries without compliance context.
license: Apache-2.0

Compliance Assistant

Track, manage, and investigate EU DORA compliance posture using real-time observability and security insights from the Dynatrace Compliance Assistant app.

---

Critical Disclaimer

The Dynatrace compliance score and all outputs from Compliance Assistant are **indicative metrics based on real-time observability data and automated systems**. They do **not** replace comprehensive or formal compliance assessments and do **not** constitute a legal determination of a company's compliance status under EU DORA or any other regulation.

**Never claim that a score, tier, or Compliance Assistant output means an organization is legally compliant or non-compliant with EU DORA.** Always present results as operational indicators to support remediation decisions, not as legal or regulatory verdicts.

---

When to Use This Skill

✅ **Use for:**

• EU DORA compliance posture, compliance score, compliance snapshot, score tier
• Critical or Important Functions (CIFs): health, KPI monitoring, impact analysis, setup questions
• Incident lifecycle under DORA: unclassified problems, potential major incidents, classified major incidents
• ICT risk inputs: vulnerabilities, security detection findings, misconfigurations (ICT asset configuration results)
• Incident classification under EU DORA: materiality thresholds, duration criteria, economic impact
• DQL queries for `compliance.incident` bizevents, CIF health, or unclassified problems on CIFs
• Onboarding, permissions, and settings for Compliance Assistant

❌ **Do not use for:**

• Regulatory frameworks other than EU DORA — SOC2, PCI-DSS, HIPAA, ISO 27001 are **not supported** by this app
• Generic Davis problems with no DORA, CIF, or compliance context → use `dt-obs-problems`
• Generic vulnerability or security finding queries not scoped to compliance or DORA → use application security skills
• Generic "score" queries without "compliance" or "DORA" — Dynatrace has many scores
• Configuring Business Flow or defining business process steps → see [Business Flow documentation](https://docs.dynatrace.com/docs/observe/business-observability/business-flow)
• Configuring Security Posture Management rules → see [SPM documentation](https://docs.dynatrace.com/docs/secure/application-security/spm)
• General DQL syntax help → use `dt-dql-essentials`

---

Prerequisites

Installation

Install Compliance Assistant from [Dynatrace Hub](https://www.dynatrace.com/hub/detail/compliance-assistant/).

Required Permissions

| Permission | Purpose | |---|---| | `storage:buckets:read` | Read buckets | | `storage:events:read` | Read events | | `storage:entities:read` | Read entities table | | `storage:metrics:read` | Required for Istio discovery findings rule | | `storage:filter-segments:read` | Read filter segments | | `settings:objects:read` | Read Log ingest settings | | `settings:schemas:read` | Read settings schemas | | `state:app-states:read` | Read app state | | `hub:catalog:read` | Read app version | | `storage:security.events:read` | Fetch security events |

Required Data Sources

| Source | Purpose | |---|---| | [Business Flow](https://docs.dynatrace.com/docs/observe/business-observability/business-flow) | CIF monitoring and incident detection on business processes — required for incident classification | | [Vulnerability events](https://docs.dynatrace.com/docs/secure/threat-observability/concepts#vuln-events) | Continuous vulnerability assessment (DORA requirement) | | [Detection finding events](https://docs.dynatrace.com/docs/secure/threat-observability/concepts#detection) | Continuous cyber threat assessment (DORA requirement) | | [Compliance events](https://docs.dynatrace.com/docs/secure/threat-observability/concepts#compliance) | ICT asset secure configuration baseline verification (DORA requirement) — powered by [Security Posture Management](https://docs.dynatrace.com/docs/secure/application-security/spm) |

---

Core Concepts

Compliance Framework

Compliance Assistant currently supports **EU DORA (Digital Operational Resilience Act)** only. It consolidates observability and security insights into a single compliance posture view for this framework. Support for additional frameworks is planned.

Dynatrace Score (Compliance Snapshot)

A real-time, tiered score summarizing current ICT risk posture across potential incidents, security detection findings, vulnerabilities, and misconfigurations. The score tier is determined by the most severe active condition; within a tier, the score is reduced by a penalty for each criterion met.

**Score tiers:**

| Tier | Max score | Triggered when… | |------|-----------|-----------------| | **On Track** | 100 | No criteria met across incidents, security detection findings, vulnerabilities, misconfigurations | | **Low** | 99 | Any low-severity finding in security detection findings/vulnerabilities/misconfigurations | | **Medium** | 79 | Any medium-severity finding, or ≥1 unclassified incident | | **High** | 59 | Any high-severity