Ingest custom security events via API

Latest Dynatrace

In the following, you'll learn how to ingest external security events from custom third-party products into Grail.

A custom third-party product is any product for which Dynatrace doesn't provide an out-of-the-box integration.

Goal

Get insights from Dynatrace for vulnerability findings from any source, provider, or format.

How it works

You ingest your data into Grail via our built-in API endpoint or a custom API endpoint. Then, depending on the ingest option chosen, you can either analyze data in your format or manually map data to the Semantic Dictionary conventions.

Details

Ingest options

Built-in API endpoint

Custom API endpoint

Description

You can use and extend our built-in security events endpoint to ingest custom security events via API.

You can create and configure from scratch a generic endpoint to ingest custom security events via API.

Details

Get started

To start ingesting data, use one of the options below.

For details on how to perform the API ingest, see Learn more.

Response codes

CodeDescription
202Accepted
400Bad request (in case of missing body or wrong format)
401Unauthorized (in case of missing or invalid token)

Examples

[
  {
  "imageId": {
    "imageDigest": "sha256:9282579f5330ae90d22f21b1a9be944f893895f06e3bc1985f14d1cfc084c60c"
  },
  "imageScanFindings": {
    "findingSeverityCounts": {
      "HIGH": 125,
      "MEDIUM": 188,
      "LOW": 30,
      "UNDEFINED": 13,
      "INFORMATIONAL": 353,
      "CRITICAL": 6
    },
    "findings": [
      {
        "attributes": [
          { "key": "CVSS3_SCORE", "value": "9.8" },
          { "key": "package_version", "value": "4.19.269-1" },
          { "key": "package_name", "value": "linux" },
          {
            "key": "CVSS3_VECTOR",
            "value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          }
        ],
        "description": "An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.",
        "name": "CVE-2023-45871",
        "severity": "CRITICAL",
        "uri": "https://security-tracker.debian.org/tracker/CVE-2023-45871 "
      },
      {
        "attributes": [
          { "key": "CVSS3_SCORE", "value": "9.8" },
          { "key": "package_version", "value": "1:7.9p1-10+deb10u2" },
          { "key": "package_name", "value": "openssh" },
          {
            "key": "CVSS3_VECTOR",
            "value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          }
        ],
        "description": "The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.",
        "name": "CVE-2023-38408",
        "severity": "CRITICAL",
        "uri": "https://security-tracker.debian.org/tracker/CVE-2023-38408 "
      },
      {
        "attributes": [
          { "key": "CVSS3_SCORE", "value": "9.8" },
          { "key": "package_version", "value": "2.7.16-2+deb10u1" },
          { "key": "package_name", "value": "python2.7" },
          {
            "key": "CVSS3_VECTOR",
            "value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          }
        ],
        "description": "An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.",
        "name": "CVE-2022-48565",
        "severity": "CRITICAL",
        "uri": "https://security-tracker.debian.org/tracker/CVE-2022-48565 "
      },
      {
        "attributes": [
          { "key": "CVSS3_SCORE", "value": "9.8" },
          { "key": "package_version", "value": "2.7.16-2+deb10u1" },
          { "key": "package_name", "value": "python2.7" },
          {
            "key": "CVSS3_VECTOR",
            "value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          { "key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P" },
          { "key": "CVSS2_SCORE", "value": "7.5" }
        ],
        "description": "Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.",
        "name": "CVE-2021-3177",
        "severity": "CRITICAL",
        "uri": "https://security-tracker.debian.org/tracker/CVE-2021-3177 "
      }
    ],
    "imageScanCompletedAt": 1698376478,
    "vulnerabilitySourceUpdatedAt": 1698343825
  },
  "imageScanStatus": {
    "description": "The scan was completed successfully.",
    "status": "COMPLETE"
  },
  "nextToken": "ukD72mdD/mC8b5xV3susmJzzaTgp3hKwR9nRUW1yZZ63B5NL+m8CiI+qgoiLO0t5s6Oi9w2CQBANPaxpQTFWXxF/Sq7shr/h//oNXvOJ2XuWPSF3ox6DgxQztXUFyKzeGw+HpbYZAAxpHjJVELVXXnhpxAScZkKhVG85CbbUGfSPyuKcSeeHoNvQPGBdxCWD6CaKl4nFxtXyUeFRs3RV+mkX5FUxosMnBJepE2JbaoM9elE1niY2Rpq3BZrp/QeOyWdmjeuySi+2KZO03915df+6OMIfXtt3zclPZ+BGcdMgWoETrte2fkh2y1RDO3PI4OCohgCbjlTk9X6fYLWrrxwkhfWAIRekqToQq+S8BHEm1o82jxDoyKO0Et9UrZVIEFOofBkvenm5U+8XvgQ4V5kvMZZLa9DZykVDteq28OF+KCgjo7WHTbXMy1yh7jyRJ6A77N12YJfxYgv16JjkVgmDqGjlM3YJEH2o55SYTAnSsiBXiMvvq1RK1hl567SIstgGPMK3c0v7TGDnCE6o3EhP4FC73As6mj2q4uGkLf8eMQLi9ogBJ1UAzKCiCl3bxeTKuMz1W8hokdPauwuAd9uKg0vLdHmM6iftfrVhsgbbioNLy3R5jOon7X61YbIGF7fUOkaj72o37fpPd/JG2g==",
  "registryId": "123456789876",
  "repositoryName": "unguard-frontend"
}
]

Related topics