/dt-sec-contextualization

name: dt-sec-contextualization
description: >-
  Resolve security signals, IoC matches, or Smartscape nodes to runtime
  Dynatrace entities and connect findings on different entity levels through a
  shared runtime entity. Covers identity-to-Smartscape mapping (incl.
  container-image digest/ID to workload), cross-level topology (K8s pod
  detection vs. node CVE via pod-to-node), per-entity risk summarization, and
  coverage match recipes shared by dt-sec-insights. Trigger: "map these findings
  to workloads/hosts", "which workload does this container image run as", "do
  these findings relate through the same runtime entity", "enrich this IoC match
  with entity context", "which threat report mentions this IoC". Queries
  security.events ONLY for THREAT_REPORT IoC enrichment (matched IoC to
  attributing reports); Do NOT use for broad security.events posture/overview
  (use dt-sec-insights), general DQL (use dt-dql-essentials), IoC hunting in
  logs/spans (use dt-sec-ioc-hunting), or K8s observability outside the security
  cross-level context (use dt-obs-kubernetes).
license: Apache-2.0

Security Contextualization Skill

Resolve security signals and entity attribute sets to runtime Dynatrace Smartscape entities, summarize findings across entity levels, and connect signals that land on different levels (e.g. a detection on a `K8S_POD` vs. a CVE on a `KUBERNETES_NODE`) via a shared runtime entity.

What This Skill Covers

• **Identity → Smartscape mapping** — given a row carrying any of

`dt.smartscape_source.id`, `container_image.digest`, `container_image.id`, `host.ip`, `dt.entity.*`, or `k8s.*` fields, resolve it to a Smartscape entity at any requested level (CONTAINER / K8S_POD / workload / K8S_NODE / HOST / cloud / `GENAI_SERVICE` — AI/GenAI workloads).

• **Artifact → runtime bridge** — `container_image.digest` →

`smartscapeNodes CONTAINER` → `is_part_of.*` → parent workload or `runs_on.host` → HOST. Works without pre-enriched `dt.smartscape_source.id`.

• **Cross-level correlation** — tiered entity matching to determine whether

two findings (e.g. a detection and a CVE from different legs) relate through a shared runtime entity. Tier 1: exact entity id match; Tier 2: same workload/pod/host by name; Tier 3: same namespace/cluster (context-only — does not contribute to scoring).

• **Pod → node topology** — resolve `K8S_POD` to its `K8S_NODE` via

`k8s.node.name` (co-projected field) or Smartscape edge traversal. Enables "detection hit pod X — does that pod run on a vulnerable node?"

• **Coverage match recipes** — 2-way and 3-way container→workload match

patterns shared across dt-sec-insights coverage counting queries.

• **Entity enrichment** — given findings, IoC matches, or raw Smartscape

nodes, produce per-entity risk-level breakdowns and entity-key bundles for downstream scoring.

• **IoC enrichment** — attribute an already-matched IoC (IP / domain / URL /

email / CVE / hash / MITRE TTP) with adversary context (actor, malware family, MITRE technique, targeting, provider) by reverse-looking-up the ingested `THREAT_REPORT` events whose observable arrays contain that IoC.

When to Use This Skill

| Intent / trigger | Reference | |---|---| | Map findings / IoC matches to workloads, hosts, or cloud entities | `identity-mapping.md` -> `entity-enrichment.md` | | Which Smartscape entity does this container image / digest run as? | `identity-mapping.md` § Mapping Primitive (Path 2 - container digest) | | Do this detection and this CVE relate via a shared entity? | `correlation-and-coverage.md` § Correlation | | Pod X fired - does it run on a vulnerable node? | `correlation-and-coverage.md` § Correlation (Pod->Node Topology) | | Per-entity risk summary (Critical/High/Medium/Low) | `entity-enrichment.md` | | Coverage match recipe - which workloads are covered by product Y? | `correlation-and-coverage.md` § Coverage | | Which entity-identity fields are relevant to a finding type? | `identity-mapping.md` § Data Model | | Enrich a matched IoC (IP/domain/hash/CVE/...) with threat-report adversary context | `ioc-enrichment.md` | | Scope findings to AI/GenAI workloads; which processes belong to an AI service; resolve a process to its AI service | `identity-mapping.md` § Mapping Primitive (Path 4 - `GENAI_SERVICE -> SERVICE -> PROCESS`) |

How This Skill Is Organized

1. **SKILL.md** (this file) — entry point and routing. 2. **references/**

• [**identity-mapping.md**](references/identity-mapping.md) — generalized

identity->Smartscape resolver (mapping primitive Paths 1/2/3/4), pre-flight identifier checks, level selection, and entity-identity field guidance.

• [**entity-enrichment.md**](references/entity-enrichment.md) — consumers of

the mapping primitive: cloud (Path 1), K8s workload (3-way), host-by-IP, host-by-entity, natural-language fallback, problem->entities->findings chain. Per-entity risk-level breakdowns (Critical/High/Medium/Low).

• [**correlation-and-coverage.md**](references/correlation-and-coverage.md) —

cross-level entity convergence, pod->node topology resolution, scoring contract, and 2-way/3-way coverage match recipes shared with dt-sec-insights.

• [**ioc-enrichment.md**](references/ioc-enrichment.md) — reverse-lookup IoC

enrichment: attribute a matched IoC to ingested `THREAT_REPORT` events and surface adversary context (actor / malware / MITRE / targeting). Single and batch (per-IoC) templates; supported-IoC taxonomy.

Universal Best Practices

1. **Always load `dt-dql-essentials` first** — DQL syntax and function names differ from SQL. Confirm all functions before generating queries. 2. **Ground every query in a named template** — do not improvise Smartscape joins. The 3-way match, digest→CONTAINER→workload, and pod→node traversal patterns are precise; deviating produces silent zero-row results. 3. **Run the pre-flight check before the full 3-way enrichmen