/dt-sec-insights

name: dt-sec-insights
description: >-
  Query and analyze Dynatrace security data in security.events with DQL:
  vulnerabilities, threat detections, compliance posture, and scan coverage.
  Covers Dynatrace-native Runtime Vulnerability Analytics (RVA — CVEs,
  reachability, exposure, exploit), Runtime Application Protection (RAP),
  Automated Detections, and Security Posture Management
  (KSPM/CSPM), plus external security products and tools. Trigger:
  "open critical vulnerabilities", "vulnerable functions in use and publicly
  exposed", "top vulnerable libraries / K8s workloads", "CIS/DORA compliance
  pass rate", "SQL injection detections", "map external findings to workloads",
  "hosts not covered by scanning". Do NOT use for explaining existing DQL
  (use dt-dql-essentials), Davis problems (dt-obs-problems), logs (dt-obs-logs),
  distributed tracing (dt-obs-tracing), service RED metrics (dt-obs-services),
  or platform usage/audit telemetry (dt-platform).
license: Apache-2.0

Security Insights Skill

Query and analyze Dynatrace security data in `security.events` using DQL. Events come from **Dynatrace-native sources** (RVA, RAP, Automated Detections, SPM) or **external products** ingested via integrations (AWS Security Hub, Amazon GuardDuty, GitHub Advanced Security, Snyk, Qualys, Tenable, and more).

What This Skill Covers

• **Vulnerability management** — open CVEs on running code from DT-native RVA

(risk-ranked with Dynatrace Security Score and the four-dimension runtime assessment: vulnerable-function-in-use, public network exposure, reachable data assets, public exploit available) plus external SCA / SAST / image scanners.

• **Compliance posture** — DT-native KSPM (Kubernetes-only: CIS, DORA, NIST,

STIG) plus CSPM/VSPM and external compliance/posture providers.

• **Runtime attacks and threats** — DT-native detections (RAP runtime attacks,

Automated Detections rules) plus external detection providers.

• **Threat intelligence** — external threat-intelligence reports (AlienVault OTX

pulses, CrowdStrike Falcon Intelligence) with actor / campaign / targeting context and indicators of compromise (IOCs); correlate reported IOCs / CVEs / techniques against your monitored environment. **These are threat intel about the wild — not findings on your entities — and are queried separately.**

• **Scan coverage analysis** — covered vs. not-covered k8s workloads/hosts/processes, by Dynatrace

scanning feature (`Library Vulnerability Analytics`, `Operating System Vulnerability Analytics`, `Code-level Vulnerability Analytics`) or by external product.

• **Entity enrichment** — map external findings to Dynatrace runtime entities

(hosts, K8s workloads, cloud resources) via Smartscape.

• **Dashboards / KPIs** — tiles, top-N tables, trend charts, coverage donuts.

When to Use This Skill

✅ **Must-first routing rule:** identify user intent first, then load the matching primary reference from **Quick Start: Find Your Use Case** before generating DQL.

Identify the intent, then load the matching reference before writing DQL.

**Cross-cutting (any / all finding types)**

| Intent / example | Reference | Pattern | |---|---|---| | Security posture / overview across all products (incl. DT-native) | `all-security-events.md` § Broad-Question Query Decomposition | 3-stream decomposition (external+detections `24h` / RVA `30m` / KSPM `1h`), merged; **lead the count summary with KSPM compliance — CIS first** (other standards + RVA + detections beneath) → `compliance.md` § CIS-Primary Standard Summary | | Findings on a specific entity — direct or related (blast radius) | **dt-sec-contextualization** `entity-enrichment.md` · `all-security-events.md` | **Broad entity-security questions must decompose**: external `*_FINDING` by `dt.smartscape_source.id` / `dt.entity.*` / `k8s.*` (`24h`) + DT RVA entity scope (`30m`) + DT SPM entity scope (`1h`) | | Findings from a specific provider | `all-security-events.md` § Scoping to a Specific Provider | `contains(lower(event.provider \| product.vendor), "<p>")` | | Which **third-party / external** tools are sending data (DT-native excluded) | `all-security-events.md` § Which external integrations are active | external-only enumeration (single query) | | Which security products are integrated? / what security data do we have? (default: **include DT-native** RVA + KSPM) | `all-security-events.md` § Broad-Question Query Decomposition | 3-stream decomposition; never a single wide `security.events` scan | | Which products cover a specific entity | **dt-sec-contextualization** `correlation-and-coverage.md` · `all-security-events.md` | summarize by `product.*`; findings-vs-scans split |

> **Routing tie-breaker:** an unqualified "which security products are integrated? / are we covered? / what do we have?" defaults to the **DT-inclusive 3-stream decomposition** (it *must* query DT vulnerabilities and compliance). Take the external-only single query **only** when the user explicitly scopes to external / third-party tools ("which external tools are sending us data?").

**Vulnerabilities (CVE management)**

| Intent / example | Reference | Pattern | |---|---|---| | Counts / severity ("how many critical?", by risk + mute status) | `vulnerabilities-dynatrace.md` | RVA snapshot Steps 1–3 | | Most vulnerable components / hosts / workloads (rankings) | `vulnerabilities-entities.md` | Steps 1–3 + `expand` typed `related_entities.<group>.ids` → `smartscapeNodes` lookup on `id_classic` — ⚠ `k8s.*`/`dt.entity.*` are null on RVA events | | CVE / library lookup; "am I vulnerable to log4shell?" | `vulnerabilities-dynatrace.md` § Entity Scoping | Step 2 CVE/component filter; scope RVA to a known entity | | Blast radius — which entities are affected by CVE X | `vulnerabilities-entities.md` | `related_entities.*` indirect-relation expand | | Lifecycle — new / resolved / open-duration / MTTR | `vulnerabilities-dynatrace.md` | post-derive `resolution.change_date`;