Try it free

Security events

  • Latest Dynatrace
  • Reference

Security events are a special type of data representing security-relevant data generated by Dynatrace, but also third-party vendors. The security events models are organized into the following subcategories:

  • Detection
  • Vulnerability
  • Compliance
  • Threat intelligence

In the security.events table, the data is separated in different buckets, depending on the origin of the data. For Dynatrace generated data, data is stored in the default_securityevents_builtin bucket, data ingested through the ingest APIs is stored in the default_securityevents bucket, unless rerouted to another bucket in OpenPipeline.

Query

Provides an overview of all security events by event type.

fetch security.events
| summarize {events = count()}, by: {event.type}
| sort events desc

Lists the most recent security events across all security event domains.

fetch security.events
| sort timestamp desc

Counts security events by provider and event type to show which sources generate which kinds of events.

fetch security.events
| summarize {events = count()}, by: {event.provider, event.type}
| sort events desc

Shared fields

The following field groups are shared across security event models.

Affected entities fields

AttributeTypeDescriptionExamples

affected_entities.affected_processes.count

long

resource stable
Number of affected processes.

50

affected_entities.count

long

resource stable
Number of affected entities.

1

affected_entities.hosts.count

long

resource stable
Number of affected hosts.

2

affected_entities.kubernetes_nodes.count

long

resource stable
Number of affected nodes.

2

affected_entities.management_zones.ids

array

resource stable
IDs of the management zones to which the affected entities belong.

mzid1

affected_entities.management_zones.names

array

resource stable
Names of the management zones to which the affected entities belong.

mz1

affected_entities.monitored_processes.count

long

resource stable
Number of processes of the process group.

100

affected_entities.previous.count

long

resource deprecated
Number of affected entities before the last change event.

1

affected_entities.previous.hosts.count

long

resource deprecated
Number of affected hosts before the last change event.

5

affected_entities.previous.kubernetes_nodes.count

long

resource deprecated
Number of affected Kubernetes nodes before the last change event.

5

affected_entities.previous.process_groups.count

long

resource deprecated
Number of affected process groups before the last change event.

2

affected_entities.process_groups.count

long

resource stable
Number of affected process groups.

2

affected_entities.types

array

resource stable
Types of affected entities.

PROCESS_GROUP; HOST; KUBERNETES_NODE

affected_entities.vulnerable_components.ids

array

resource stable
Dynatrace IDs of the vulnerable components causing the vulnerability.

SOFTWARE_COMPONENT-0000000000000001; SOFTWARE_COMPONENT-0000000000000002; SOFTWARE_COMPONENT-0000000000000003

affected_entities.vulnerable_components.names

array

resource stable
Names of the vulnerable components causing the vulnerability. |

com.fasterxml.jackson.core:jackson-databind:2.10.0; node-sass:4.14.1

affected_entities.vulnerable_functions

array

resource stable
Vulnerable functions detected, containing or causing the vulnerability.

org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)

Affected entity fields

AttributeTypeDescriptionExamples

affected_entity.affected_processes.ids

array

resource stable
IDs of the processes that are currently affected by the vulnerability.

PROCESS_GROUP_INSTANCE-1

affected_entity.affected_processes.names

array

resource stable
Names of the processes that are currently affected by the vulnerability.

prod_process_group_instance_1

affected_entity.id

string

resource stable
ID of the affected entity.

PROCESS_GROUP-1; HOST-1

affected_entity.management_zones.ids

array

resource stable
IDs of the management zones to which the affected entity belongs.

mzid1

affected_entity.management_zones.names

array

resource stable
Names of the management zones to which the affected entity belongs.

mz1

affected_entity.monitored_processes.count

long

resource stable
Number of affected processes.

100

affected_entity.name

string

resource stable
Name of the affected entity.

prod_process_group_1; prod_host

affected_entity.type

string

resource stable
Type of affected entity.

PROCESS_GROUP; HOST; KUBERNETES_NODE

affected_entity.vulnerable_component.id

string

resource stable
ID of the vulnerable component causing the vulnerability.

SOFTWARE_COMPONENT-D8FCFFB4FDF7A3FF

affected_entity.vulnerable_component.name

string

resource stable
Name of the vulnerable component causing the vulnerability.

log4j-core-2.6.2.jar

affected_entity.vulnerable_component.short_name

string

resource stable
Short name of the vulnerable component causing the vulnerability.

log4j

affected_entity.vulnerable_functions

array

resource stable
Vulnerable functions detected, containing or causing the vulnerability.

org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)

Related entities fields

AttributeTypeDescriptionExamples

related_entities.applications.count

long

resource stable
Number of related applications.

1

related_entities.applications.ids

array

resource stable
IDs of the applications related to the vulnerability's affected entities.

APPLICATION-1

related_entities.applications.names

array

resource stable
Names of the applications related to the vulnerability's affected entities.

prod_application_1

related_entities.databases.count

long

resource stable
Number of related databases.

1

related_entities.databases.ids

array

resource stable
IDs of the databases related to the vulnerability's affected entities.

DATABASE-1

related_entities.databases.names

array

resource stable
Names of the databases related to the vulnerability's affected entities.

prod_database_1

related_entities.hosts.count

long

resource stable
Number of related hosts.

1

related_entities.hosts.ids

array

resource stable
IDs of the hosts related to the vulnerability's affected entities.

HOST-1

related_entities.hosts.names

array

resource stable
Names of the hosts related to the vulnerability's affected entities.

prod_host_1

related_entities.kubernetes_clusters.count

long

resource stable
Number of related Kubernetes clusters.

1

related_entities.kubernetes_clusters.ids

array

resource stable
IDs of the Kubernetes clusters related to the vulnerability's affected entities.

KUBERNETES_CLUSTER-1

related_entities.kubernetes_clusters.names

array

resource stable
Names of the Kubernetes clusters related to the vulnerability's affected entities.

prod_kubernetes_cluster_1

related_entities.kubernetes_workloads.count

long

resource stable
Number of related Kubernetes workloads.

1

related_entities.kubernetes_workloads.ids

array

resource stable
IDs of the Kubernetes workloads related to the vulnerability's affected entities.

KUBERNETES_WORKLOAD-1

related_entities.kubernetes_workloads.names

array

resource stable
Names of the Kubernetes workloads related to the vulnerability's affected entities.

prod_kubernetes_workload_1

related_entities.previous.databases.count

long

resource deprecated
Number of related databases before the last change event.

1

related_entities.services.count

long

resource stable
Number of related services.

1

related_entities.services.ids

array

resource stable
IDs of the services related to the vulnerability's affected entities.

SERVICE-1

related_entities.services.names

array

resource stable
Names of the services related to the vulnerability's affected entities.

prod_service_1

Vulnerable component fields

AttributeTypeDescriptionExamples

vulnerable_component.name

string

resource experimental
Name of the vulnerable component causing the vulnerability.

sqlite3:3.16.2-5+deb9u3

vulnerable_component.short_name

string

resource experimental
Short name of the vulnerable component causing the vulnerability.

sqlite3

vulnerable_component.version

string

resource experimental
Version of the vulnerable component causing the vulnerability.

3.16.2-5+deb9u3

Security event fields

AttributeTypeDescriptionExamples

event.change_list

array

resource stable
List of attributes updated as part of the change event. Values in the list match a previous field.

vulnerability.risk.score; affected_entities.count; related_entities.databases.count

event.level

string

resource stable
Main reference point to which the event or data is related. Possible values are Vulnerability (shows the global aggregation across the entire environment and comprises all entities and management zones) and Entity (shows the assessment based on the entity itself).

ENTITY; VULNERABILITY

event.provider_product

string

resource stable
Name of the product providing this event.

Runtime Vulnerability Analytics; Snyk Container

event.trigger.type

string

resource stable
Type of event trigger (for example, whether it was generated by the system, ingested via API, or triggered by the user).

DT_PLATFORM; API; USER_ACTION

event.trigger.user

string

resource stable
ID of the user who triggered the event. If generated by Dynatrace, the value is SYSTEM.

SYSTEM; <api_token_id>; <user_id>

event.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

ValueDescription

ENTITY

entity

VULNERABILITY

vulnerability

Object fields

AttributeTypeDescriptionExamples

object.id

string

resource experimental
Identifier of the affected object.

HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1

object.mapping.artifact.type

string

resource experimental
This layer represents the physical object containing the issue.

CODE; CONTAINER_IMAGE; OPERATING_SYSTEM; IAM_KEY

object.mapping.component.type

string

resource experimental
This layer represents the source of the issue within the artifact.

SOFTWARE_COMPONENT; CONFIGURATION

object.mapping.resource.type

string

resource experimental
This layer represents the impacted runtime object.

CLOUD_CLUSTER; CLOUD_NODE; CONTAINER; HOST

object.name

string

resource experimental
Name of the affected object.

kube-controller-manager-k8s-mst01-t12; daemonset-25qlv

object.type

string

resource experimental
Type of the affected object.

host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE

Scan fields

AttributeTypeDescriptionExamples

scan.id

string

resource experimental
Unique identifier of the scan.

00000000-0000-0000-0000-000000000000

scan.name

string

resource experimental
Name of the scan.

US Cloud Scanner

scan.product.name

string

resource experimental
Name of the product that performed the scan.

ECR; Inspector

scan.time.completed

timestamp

resource experimental
Time when the scan was completed.

2024-06-24T04:47:21.154000000+02:00

scan.time.started

timestamp

resource experimental
Time when the scan was started.

2024-06-24T04:47:21.154000000+02:00

scan.vendor

string

resource experimental
Name of the scanner vendor that performed the scan.

AWS

Entry points fields

Resource describing entry points of a vulnerability.

AttributeTypeDescriptionExamples

entry_points

record[]

resource experimental
Entry points of a vulnerability.

['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']

entry_points.entry_point_jsons

string[]

resource deprecatedUse entry_points instead.
JSON representation of entry points of a vulnerability.

['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs_json": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']

Product fields

Product from which the data was collected, in case the data came from an integration with a third-party product.

AttributeTypeDescriptionExamples

product.feature

string

resource experimental
The feature of the product that performed the scan.

Third-party Vulnerability Analytics; Code-level Vulnerability Analytics

product.name

string

resource experimental
Product name.

Tenable; Snyk

product.vendor

string

resource experimental
Product vendor.

Tenable; Snyk

product.version

string

resource experimental
Version of the product that performed the scan.

6.9.2.0

Sink code fields

The individual parts of an application where data from entry points ends up, potentially causing a vulnerability to be exploited.

AttributeTypeDescriptionExamples

sink.code.function

string

resource experimental
Name of the function that executes the command, query, or similar with tainted parameters.

executeQuery

sink.code.namespace

string

resource experimental
Namespace of the sink code function.

com.mysql.jdbc.Statement

sink.code.parameter_types

array

resource experimental
Parameter types as defined in the method signature of the sink code function, which help distinguish in case of method overloads. For example, for a method with the executeQuery(String sql) signature, the parameter types would be ["String"].

[String]

Security events Smartscape fields

Shared Smartscape fields for security events.

AttributeTypeDescriptionExamples

dt.smartscape_source.type

string

stable
Display name: Smartscape source type
The entity type of the entity whose identifier is held in dt.smartscape_source.id.

K8S_CLUSTER; AWS_LAMBDA_FUNCTION

Vulnerability scan events

A vulnerability scan event records that a specific object—such as a running process group, container image, or code artifact—was scanned for vulnerabilities by a particular tool, together with scan coverage metadata. It lets you distinguish an object that was scanned and found clean from one that was never scanned. Vulnerability scan events are produced both by Dynatrace Runtime Vulnerability Analytics (process scans) and by ingested third-party scanners such as Black Duck.

Query

Lists the most recent vulnerability scan events provided by Dynatrace Runtime Vulnerability Analytics.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| sort timestamp desc
| filter product.vendor == "Dynatrace"

Counts unique scanned objects by object type.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| dedup {object.id}, sort: {timestamp desc}
| summarize {scanned_objects = countDistinctExact(object.id)}, by: {object.type}
| sort scanned_objects desc

Counts vulnerability scan events by provider and product.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| summarize {scans = count()}, by: {event.provider, product.name}
| sort scans desc

Show vulnerability scans over time by different vendors and their products.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| summarize count = count(), by: {bin(timestamp, 1h), product.vendor, product.name}

Vulnerability scan events metadata fields

Meta-information on the vulnerability scan event.

AttributeTypeDescriptionExamples

event.id

string

stable
Display name: Event ID
Unique identifier string of an event; is stable across multiple refreshes and updates.

73d32f1e-2a6e-4b47-a79a-c865885c4821

event.kind

string

stable
Display name: Event kind
Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.
Tags: permission

SECURITY_EVENT

event.name

string

stable
Display name: Event name
The human readable display name of an event type.

Vulnerability scan event

event.provider

string

stable
Display name: Event provider
Specifies the source of the event. In the case of integration with a specific product, such as Amazon ECR or AWS Security Hub, the product's full name is included.
Tags: permission

Amazon ECR

event.type

string

stable
Display name: Event type
The unique type identifier of a given event.
Tags: permission

VULNERABILITY_SCAN

event.version

string

experimental
Display name: Event version
Describes the version of the event.

1.309

timestamp

timestamp

stable
Display name: Timestamp
Time (UNIX Epoch time in nanoseconds) when the event originated, typically when the scan was completed. If scan completion time isn't available, it's set to the event creation time.

1649822520123123123

Vulnerability scan events affected object data fields

Information about the affected object to which the scan belongs.

AttributeTypeDescriptionExamples

object.id

string

resource experimental
Identifier of the affected object.

HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1

object.mapping.resource.type

string

resource experimental
This layer represents the impacted runtime object.

CLOUD_CLUSTER; CLOUD_NODE; CONTAINER; HOST

object.type

string

resource experimental
Type of the affected object.

host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE

Vulnerability scan events scanner metadata fields

Information about the scan and the product that performed it.

AttributeTypeDescriptionExamples

scan.id

string

resource experimental
Unique identifier of the scan.

00000000-0000-0000-0000-000000000000

scan.name

string

resource experimental
Name of the scan.

US Cloud Scanner

scan.product.name

string

resource experimental
Name of the product that performed the scan.

ECR; Inspector

scan.time.completed

timestamp

resource experimental
Time when the scan was completed.

2024-06-24T04:47:21.154000000+02:00

scan.time.started

timestamp

resource experimental
Time when the scan was started.

2024-06-24T04:47:21.154000000+02:00

scan.vendor

string

resource experimental
Name of the scanner vendor that performed the scan.

AWS

Vulnerability scan events product data fields

Information about the third-party product from where Dynatrace fetches data.

AttributeTypeDescriptionExamples

product.feature

string

resource experimental
The feature of the product that performed the scan.

Third-party Vulnerability Analytics; Code-level Vulnerability Analytics

product.name

string

resource experimental
Product name.

Tenable; Snyk

product.vendor

string

resource experimental
Product vendor.

Tenable; Snyk

Extensions

Vulnerability scan events container image data fields

Container-image-specific data for scans performed on container image registries.

AttributeTypeDescriptionExamples

container_image.digest

string

resource experimental
Display name: Container image digest
Container image digest uniquely and immutably identifying the vulnerable container image.

sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1

container_image.registry

string

resource experimental
Display name: Container image registry
Container image registry from which the container image originates.

1294385647.eu-central-1

container_image.repository

string

resource experimental
Display name: Container image repository
Container image repository from which the container image originates.

unguard-frontend

container_image.tags

array

resource experimental
Display name: Container image tags
List of tags of the container image.

[1.0.0]; [1.0.0, 1.0.0-nightly, latest]

Vulnerability scan events OS data fields

Information about the operating system on which the scan is performed.

AttributeTypeDescriptionExamples

os.architecture

string

resource experimental
Display name: OS architecture
Architecture of the CPU, discovered from the operating system.

X86

os.name

string

resource stable
Display name: OS name
The OS name in a short, human-readable format.

iOS

os.type

string

resource experimental
Display name: OS type
Type of discovered operating system.

LINUX; WINDOWS

os.version

string

resource stable
Display name: OS version
The complete OS version, including patch, build, and other information.

15.3.1; Ubuntu 16.04.7 LTS (Xenial Xerus) (kernel 4.15.0-206-generic); Windows Server 2022 Datacenter 21H2 2009, ver. 10.0.20348

Vulnerability scan events entity fields

Information about the entity being scanned.

AttributeTypeDescriptionExamples

dt.entity.host

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.host instead.
Display name: Host
An entity ID of an entity of type HOST.
Tags: entity-id

HOST-E0D8F94D9065F24F

dt.entity.process_group

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.process_group.id or dt.process_group.detected_name instead. Note that there is no entity type PROCESS_GROUP in Smartscape, so dt.process_group.id exists only for compatibility. Preferably use dt.process_group.detected_name to identify process groups.
Display name: Process group
An entity ID of an entity of type PROCESS_GROUP.
Tags: entity-id

PROCESS_GROUP-E0D8F94D9065F24F

dt.entity.process_group_instance

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.process instead.
Display name: Process group instance
An entity ID of an entity of type PROCESS_GROUP_INSTANCE.
Tags: entity-id

PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F

dt.smartscape_source.id

smartscapeId

resource stable
Display name: Smartscape source ID
The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1
Tags: smartscape-id

K8S_CLUSTER-E0D8F94D9065F24F; AWS_LAMBDA_FUNCTION-E0D8F94D9065F24F

dt.smartscape_source.type

string

stable
Display name: Smartscape source type
The entity type of the entity whose identifier is held in dt.smartscape_source.id.

K8S_CLUSTER; AWS_LAMBDA_FUNCTION

dt.source_entity

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.id instead.
Display name: Source entity
The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. 2
Tags: entity-id

HOST-E0D8F94D9065F24F; PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F

dt.source_entity.type

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.type instead.
Display name: Source entity type
The entity type of the entity whose identifier is held in dt.source_entity. The value must be a valid entity type and consistent with dt.source_entity. Note, however, that the type identifiers are expected to be lowercased in alignment with suffixes of dt.entity.* keys.

host; process_group_instance; cloud:azure:resource_group

host.name

string

resource experimental
Display name: Host name
The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry).
Important: This is not the name of the host entity, which can be modified based on naming rules.
Tags: permission

ip-10-178-54-32.ec2.internal

1

The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.

2

The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.

Vulnerability scan events Kubernetes resource fields

The associated Kubernetes resource (if any)

AttributeTypeDescriptionExamples

k8s.cluster.name

string

resource stable
Display name: Kubernetes cluster name
The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable.
Tags: permission primary-field

unguard-dev; acme-prod10

k8s.namespace.name

string

resource stable
Display name: Kubernetes namespace name
The name of the namespace that the pod is running in.
Tags: permission primary-field

default; kube-system

Related tags
Application Security