Ingest custom security events via API
Latest Dynatrace
In the following, you'll learn how to ingest external security events from custom third-party products into Grail.
A custom third-party product is any product for which Dynatrace doesn't provide an out-of-the-box integration.
Goal
Get insights from Dynatrace for vulnerability findings from any source, provider, or format.
How it works
You ingest your data into Grail via our built-in API endpoint or a custom API endpoint. Then, depending on the ingest option chosen, you can either analyze data in your format or manually map data to the Semantic Dictionary conventions.
Details
Ingest options | ||
Description | You can use and extend our built-in security events endpoint to ingest custom security events via API. | You can create and configure from scratch a generic endpoint to ingest custom security events via API. |
Details |
|
|
Get started
To start ingesting data, use one of the options below.
For details on how to perform the API ingest, see Learn more.
Response codes
Code | Description |
---|---|
202 | Accepted |
400 | Bad request (in case of missing body or wrong format) |
401 | Unauthorized (in case of missing or invalid token) |
Examples
[{"imageId": {"imageDigest": "sha256:9282579f5330ae90d22f21b1a9be944f893895f06e3bc1985f14d1cfc084c60c"},"imageScanFindings": {"findingSeverityCounts": {"HIGH": 125,"MEDIUM": 188,"LOW": 30,"UNDEFINED": 13,"INFORMATIONAL": 353,"CRITICAL": 6},"findings": [{"attributes": [{ "key": "CVSS3_SCORE", "value": "9.8" },{ "key": "package_version", "value": "4.19.269-1" },{ "key": "package_name", "value": "linux" },{"key": "CVSS3_VECTOR","value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"description": "An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.","name": "CVE-2023-45871","severity": "CRITICAL","uri": "https://security-tracker.debian.org/tracker/CVE-2023-45871 "},{"attributes": [{ "key": "CVSS3_SCORE", "value": "9.8" },{ "key": "package_version", "value": "1:7.9p1-10+deb10u2" },{ "key": "package_name", "value": "openssh" },{"key": "CVSS3_VECTOR","value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"description": "The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.","name": "CVE-2023-38408","severity": "CRITICAL","uri": "https://security-tracker.debian.org/tracker/CVE-2023-38408 "},{"attributes": [{ "key": "CVSS3_SCORE", "value": "9.8" },{ "key": "package_version", "value": "2.7.16-2+deb10u1" },{ "key": "package_name", "value": "python2.7" },{"key": "CVSS3_VECTOR","value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"description": "An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.","name": "CVE-2022-48565","severity": "CRITICAL","uri": "https://security-tracker.debian.org/tracker/CVE-2022-48565 "},{"attributes": [{ "key": "CVSS3_SCORE", "value": "9.8" },{ "key": "package_version", "value": "2.7.16-2+deb10u1" },{ "key": "package_name", "value": "python2.7" },{"key": "CVSS3_VECTOR","value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{ "key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P" },{ "key": "CVSS2_SCORE", "value": "7.5" }],"description": "Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.","name": "CVE-2021-3177","severity": "CRITICAL","uri": "https://security-tracker.debian.org/tracker/CVE-2021-3177 "}],"imageScanCompletedAt": 1698376478,"vulnerabilitySourceUpdatedAt": 1698343825},"imageScanStatus": {"description": "The scan was completed successfully.","status": "COMPLETE"},"nextToken": "ukD72mdD/mC8b5xV3susmJzzaTgp3hKwR9nRUW1yZZ63B5NL+m8CiI+qgoiLO0t5s6Oi9w2CQBANPaxpQTFWXxF/Sq7shr/h//oNXvOJ2XuWPSF3ox6DgxQztXUFyKzeGw+HpbYZAAxpHjJVELVXXnhpxAScZkKhVG85CbbUGfSPyuKcSeeHoNvQPGBdxCWD6CaKl4nFxtXyUeFRs3RV+mkX5FUxosMnBJepE2JbaoM9elE1niY2Rpq3BZrp/QeOyWdmjeuySi+2KZO03915df+6OMIfXtt3zclPZ+BGcdMgWoETrte2fkh2y1RDO3PI4OCohgCbjlTk9X6fYLWrrxwkhfWAIRekqToQq+S8BHEm1o82jxDoyKO0Et9UrZVIEFOofBkvenm5U+8XvgQ4V5kvMZZLa9DZykVDteq28OF+KCgjo7WHTbXMy1yh7jyRJ6A77N12YJfxYgv16JjkVgmDqGjlM3YJEH2o55SYTAnSsiBXiMvvq1RK1hl567SIstgGPMK3c0v7TGDnCE6o3EhP4FC73As6mj2q4uGkLf8eMQLi9ogBJ1UAzKCiCl3bxeTKuMz1W8hokdPauwuAd9uKg0vLdHmM6iftfrVhsgbbioNLy3R5jOon7X61YbIGF7fUOkaj72o37fpPd/JG2g==","registryId": "123456789876","repositoryName": "unguard-frontend"}]