Application Security
Security events are a special type of data representing various events generated by Dynatrace.
In the events data store, security events are stored in a dedicated bucket (default_security_events) and come as an additional event kind (event.kind=="SECURITY_EVENT") for better access control, data separation, and data retention period control.
Entity change events
Entity change events are change events at the entity level. An event is generated whenever a vulnerability's affected entity undergoes a status or assessment change.
fetch events| filter event.kind == "SECURITY_EVENT"| filter event.category == "VULNERABILITY_MANAGEMENT"| filter event.type == "VULNERABILITY_STATUS_CHANGE_EVENT"| filter event.level == "ENTITY"fetch events| filter event.kind == "SECURITY_EVENT"| filter event.category == "VULNERABILITY_MANAGEMENT"| filter event.type == "VULNERABILITY_ASSESSMENT_CHANGE_EVENT"| filter event.level == "ENTITY"
Entity change events: Event data
This section contains general event information.
Attribute
Type
Description
Examples
event.categorystring
stable
Categorization based on the product and data generating this event.
Categorization based on the product and data generating this event.
VULNERABILITY_MANAGEMENTevent.change_listarray
stable
List of attributes updated as part of the change event. Values in the list match a
List of attributes updated as part of the change event. Values in the list match a
previous field.vulnerability.risk.score; affected_entities.count; related_entities.databases.countevent.descriptionstring
stable
Human-readable description of an event.
Human-readable description of an event.
Status of S-49 Remote Code Execution for prod_process_group_1 has changed to OPEN.; Assessment of S-49 Remote Code Execution for prod_process_group_1 has changed.; Environment impact of S-49 Remote Code Execution for prod_process_group_1 has changed.event.group_labelstring
experimental
Group label of an event.
Group label of an event.
CHANGE_EVENTevent.kindstring
stable
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permissionSECURITY_EVENTevent.levelstring
stable
Main reference point to which the event or data is related. Possible values are
Main reference point to which the event or data is related. Possible values are
Vulnerability (shows the global aggregation across the entire environment and comprises all entities and management zones) and Entity (shows the assessment based on the entity itself).ENTITYevent.namestring
stable
The human readable display name of an event type.
The human readable display name of an event type.
Vulnerable entity status change event; Vulnerable entity assessment change eventevent.providerstring
stable
Source of the event, for example the name of the component or system that generated the event.
Tags:
Source of the event, for example the name of the component or system that generated the event.
Tags:
permissionDynatraceevent.provider_productstring
stable
Name of the product providing this event.
Name of the product providing this event.
Runtime Vulnerability Analytics; Snyk Containerevent.statusstring
stable
Status of an event as being either Active or Closed.
Status of an event as being either Active or Closed.
OPEN; RESOLVED; MUTEDevent.status_transitionstring
experimental
An enum that shows the transition of the above event state.
An enum that shows the transition of the above event state.
NEW_OPEN; REOPEN; CLOSE; MUTE; UNMUTEevent.trigger.typestring
stable
Type of event trigger (for example, whether it was generated by the system, ingested via API, or triggered by the user).
Type of event trigger (for example, whether it was generated by the system, ingested via API, or triggered by the user).
DT_PLATFORM; USER_ACTIONevent.trigger.userstring
stable
ID of the user who triggered the event. If generated by Dynatrace, the value is
ID of the user who triggered the event. If generated by Dynatrace, the value is
SYSTEM.SYSTEM; <user_id>event.typestring
stable
The unique type identifier of a given event.
Tags:
The unique type identifier of a given event.
Tags:
permissionVULNERABILITY_STATUS_CHANGE_EVENT; VULNERABILITY_ASSESSMENT_CHANGE_EVENTtimestamptimestamp
stable
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.
1649822520123123123Entity change events: Vulnerability data
This section contains information about the vulnerability at the entity level and its global parent, as well as its previous values.
Attribute
Type
Description
Examples
vulnerability.code_location.namestring
stable
Name of the code location where the code-level vulnerability was detected.
Name of the code location where the code-level vulnerability was detected.
org.dynatrace.profileservice.BioController.markdownToHtml(String):80vulnerability.cvss.base_scoredouble
stable
Vulnerability's CVSS base score provided by NVD.
Vulnerability's CVSS base score provided by NVD.
8.1vulnerability.cvss.vectorstring
experimental
Vulnerability's CVSS vector defined by the provider.
Vulnerability's CVSS vector defined by the provider.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:Hvulnerability.cvss.versionstring
stable
Vulnerability's CVSS score version.
Vulnerability's CVSS score version.
3.1vulnerability.davis_assessment.assessment_modestring
stable
Availability of the information based on which the assessment of the vulnerability at the entity level has been done.
Availability of the information based on which the assessment of the vulnerability at the entity level has been done.
FULL; NOT_AVAILABLE; REDUCEDvulnerability.davis_assessment.assessment_mode_reasonsstring[]
experimental
Reasons for the assessment mode at the entity level.
Reasons for the assessment mode at the entity level.
[LIMITED_BY_CONFIGURATION, LIMITED_AGENT_SUPPORT]vulnerability.davis_assessment.data_assets_statusstring
stable
Affected entity's reachability by a database.
Affected entity's reachability by a database.
NOT_AVAILABLE; NOT_DETECTED; REACHABLEvulnerability.davis_assessment.exploit_statusstring
stable
Public exploits status of the vulnerability at the entity level.
Public exploits status of the vulnerability at the entity level.
AVAILABLE; NOT_AVAILABLEvulnerability.davis_assessment.exposure_statusstring
stable
Internet exposure status of the vulnerability at the entity level.
Internet exposure status of the vulnerability at the entity level.
NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORKvulnerability.davis_assessment.levelstring
stable
Risk level, based on Davis Security Score, of the vulnerability at the entity level.
Risk level, based on Davis Security Score, of the vulnerability at the entity level.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.davis_assessment.scoredouble
stable
Davis Security Score (1-10) calculated by Dynatrace for the vulnerability at the entity level.
Davis Security Score (1-10) calculated by Dynatrace for the vulnerability at the entity level.
8.1vulnerability.davis_assessment.vulnerable_function_statusstring
stable
Usage status of the vulnerable functions causing the vulnerability at the entity level.
Usage status of the vulnerable functions causing the vulnerability at the entity level.
IN_USE; NOT_AVAILABLE; NOT_IN_USEvulnerability.descriptionstring
stable
Description of the vulnerability.
Description of the vulnerability.
More detailed description about improper input validation vulnerability.vulnerability.display_idstring
stable
Dynatrace user-readable identifier for the vulnerability.
Dynatrace user-readable identifier for the vulnerability.
S-1234vulnerability.external_idstring
stable
External provider's unique identifier for the vulnerability.
External provider's unique identifier for the vulnerability.
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646vulnerability.external_urlstring
stable
External provider's URL to the details page of the vulnerability.
External provider's URL to the details page of the vulnerability.
https://example.comvulnerability.first_seentimestamp
stable
Timestamp of when the vulnerability at the entity level was first detected.
Timestamp of when the vulnerability at the entity level was first detected.
2023-03-22T13:19:36.945Zvulnerability.idstring
stable
Dynatrace unique identifier for the vulnerability.
Dynatrace unique identifier for the vulnerability.
2039861408676243188vulnerability.is_fix_availableboolean
experimental
Indicates if a vulnerability fix is available.
Indicates if a vulnerability fix is available.
vulnerability.mute.change_datetimestamp
stable
Timestamp of the last muted or unmuted action of the vulnerability at the entity level.
Timestamp of the last muted or unmuted action of the vulnerability at the entity level.
2023-03-22T13:19:36.945Zvulnerability.mute.reasonstring
stable
Reason for muting or unmuting the vulnerability at the entity level.
Reason for muting or unmuting the vulnerability at the entity level.
FALSE_POSITIVE; IGNORE; AFFECTED; CONFIGURATION_NOT_AFFECTED; OTHERvulnerability.mute.statusstring
stable
Mute status of the vulnerability at the entity level.
Mute status of the vulnerability at the entity level.
MUTED; NOT_MUTEDvulnerability.mute.userstring
stable
User who last changed the mute status of the vulnerability at the entity level.
User who last changed the mute status of the vulnerability at the entity level.
user@example.comvulnerability.parent.davis_assessment.assessment_modestring
stable
Availability of the information based on which the vulnerability assessment has been done.
Availability of the information based on which the vulnerability assessment has been done.
FULL; NOT_AVAILABLE; REDUCEDvulnerability.parent.davis_assessment.data_assets_statusstring
stable
Vulnerability's reachability of related data assets by affected entities.
Vulnerability's reachability of related data assets by affected entities.
NOT_AVAILABLE; NOT_DETECTED; REACHABLEvulnerability.parent.davis_assessment.exposure_statusstring
stable
Vulnerability's internet exposure status.
Vulnerability's internet exposure status.
NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORKvulnerability.parent.davis_assessment.levelstring
stable
Vulnerability's Davis Security Score level.
Vulnerability's Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.parent.davis_assessment.scoredouble
stable
Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.
Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.
8.1vulnerability.parent.davis_assessment.vulnerable_function_statusstring
stable
Usage status of vulnerable functions causing the vulnerability. Status is
Usage status of vulnerable functions causing the vulnerability. Status is
IN_USE when there's at least one vulnerable function in use by an application.IN_USE; NOT_AVAILABLE; NOT_IN_USEvulnerability.parent.first_seenstring
stable
Timestamp of when the vulnerability was first detected.
Timestamp of when the vulnerability was first detected.
2023-03-22T13:19:36.945Zvulnerability.parent.mute.change_datetimestamp
stable
Timestamp of the last mute or unmute action of the vulnerability.
Timestamp of the last mute or unmute action of the vulnerability.
2023-03-22T13:19:36.945Zvulnerability.parent.mute.reasonstring
stable
Reason for muting or unmuting the vulnerability.
Reason for muting or unmuting the vulnerability.
FALSE_POSITIVE; IGNORE; AFFECTED; CONFIGURATION_NOT_AFFECTED; OTHERvulnerability.parent.mute.statusstring
stable
Vulnerability's mute status.
Vulnerability's mute status.
MUTED; NOT_MUTEDvulnerability.parent.mute.userstring
stable
User who last changed the vulnerability's mute status.
User who last changed the vulnerability's mute status.
user@example.comvulnerability.parent.resolution.change_datestring
stable
Timestamp of the vulnerability's last resolution status change.
Timestamp of the vulnerability's last resolution status change.
2023-03-22T13:19:37.466Zvulnerability.parent.resolution.statusstring
stable
Current status of the vulnerability.
Current status of the vulnerability.
OPEN; RESOLVEDvulnerability.parent.risk.levelstring
stable
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.parent.risk.scoredouble
stable
Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
8.1vulnerability.previous.cvss.base_scoredouble
stable
Vulnerability's previous CVSS base score (in case the CVSS base score has changed).
Vulnerability's previous CVSS base score (in case the CVSS base score has changed).
8.1vulnerability.previous.davis_assessment.data_assets_statusstring
stable
Vulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).
Vulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).
NOT_AVAILABLE; NOT_DETECTED; REACHABLEvulnerability.previous.davis_assessment.exploit_statusstring
stable
Vulnerability's previous public exploit status (in case the public exploit status has changed).
Vulnerability's previous public exploit status (in case the public exploit status has changed).
AVAILABLE; NOT_AVAILABLEvulnerability.previous.davis_assessment.exposure_statusstring
stable
Vulnerability's previous internet exposure status (in case the internet exposure status has changed).
Vulnerability's previous internet exposure status (in case the internet exposure status has changed).
NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORKvulnerability.previous.davis_assessment.levelstring
stable
Vulnerability's previous risk level (in case the risk level has changed).
Vulnerability's previous risk level (in case the risk level has changed).
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.previous.davis_assessment.scoredouble
stable
Vulnerability's previous Davis Security Score (in case Davis Security Score has changed).
Vulnerability's previous Davis Security Score (in case Davis Security Score has changed).
8.1vulnerability.previous.davis_assessment.vulnerable_function_statusstring
stable
Vulnerability's previous vulnerable function status (in case the vulnerable function status has changed).
Vulnerability's previous vulnerable function status (in case the vulnerable function status has changed).
IN_USE; NOT_AVAILABLE; NOT_IN_USEvulnerability.previous.mute.change_datestring
stable
Timestamp of the vulnerability's previous mute status (in case the mute status has changed).
Timestamp of the vulnerability's previous mute status (in case the mute status has changed).
2023-03-22T13:19:36.945Zvulnerability.previous.mute.reasonstring
stable
Reason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).
Reason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).
Muted: False positivevulnerability.previous.mute.statusstring
stable
Vulnerability's previous mute status (in case the mute status has changed).
Vulnerability's previous mute status (in case the mute status has changed).
MUTED; NOT_MUTEDvulnerability.previous.mute.userstring
stable
User who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).
User who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).
user@example.comvulnerability.previous.resolution.statusstring
stable
Vulnerability's previous resolution status (in case the resolution status has changed).
Vulnerability's previous resolution status (in case the resolution status has changed).
OPEN; RESOLVEDvulnerability.previous.risk.levelstring
stable
Vulnerability's previous risk score level (in case the risk score level has changed).
Vulnerability's previous risk score level (in case the risk score level has changed).
LOW; MEDIUM; HIGH; CRITICALvulnerability.previous.risk.scoredouble
stable
Vulnerability's previous risk score (in case the risk score has changed).
Vulnerability's previous risk score (in case the risk score has changed).
8.1vulnerability.references.cvestring[]
stable
List of the vulnerability's CVE IDs.
List of the vulnerability's CVE IDs.
[CVE-2021-41079]vulnerability.references.cwestring[]
stable
List of the vulnerability's CWE IDs.
List of the vulnerability's CWE IDs.
[CWE-20]vulnerability.references.owaspstring[]
stable
List of vulnerability's OWASP IDs.
List of vulnerability's OWASP IDs.
[2021:A3]vulnerability.remediation.descriptionstring
experimental
Description of the vulnerability's remediation advice.
Description of the vulnerability's remediation advice.
Upgrade component to version 1.2.3 or highervulnerability.resolution.change_datetimestamp
stable
Timestamp of the last resolution status change of the vulnerability at the entity level.
Timestamp of the last resolution status change of the vulnerability at the entity level.
2023-03-22T13:19:37.466Zvulnerability.resolution.statusstring
stable
Resolution status of the vulnerability at the entity level.
Resolution status of the vulnerability at the entity level.
OPEN; RESOLVEDvulnerability.risk.levelstring
stable
Vulnerability's risk score level defined by the provider at the entity level. For Dynatrace, the Davis Security Score level.
Vulnerability's risk score level defined by the provider at the entity level. For Dynatrace, the Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.risk.scalestring
stable
Scale by which the risk score and risk score level defined by the provider for the vulnerability at the entity level are measured.
Scale by which the risk score and risk score level defined by the provider for the vulnerability at the entity level are measured.
Davis Security Scorevulnerability.risk.scoredouble
stable
Risk score defined by the provider for the vulnerability at the entity level. For Dynatrace, Davis Security Score.
Risk score defined by the provider for the vulnerability at the entity level. For Dynatrace, Davis Security Score.
8.1vulnerability.stackstring
experimental
Level of the vulnerable component in the technological stack.
Level of the vulnerable component in the technological stack.
CODE; CODE_LIBRARY; SOFTWARE; CONTAINER_ORCHESTRATIONvulnerability.technologystring
stable
Technology of the vulnerable component.
Technology of the vulnerable component.
JAVA; DOTNET; GO; PHP; NODE_JSvulnerability.titlestring
stable
Title of the vulnerability.
Title of the vulnerability.
Improper Input Validationvulnerability.typestring
stable
Classification of the vulnerability based on commonly accepted enums, such as CWE.
Classification of the vulnerability based on commonly accepted enums, such as CWE.
Improper Input Validationvulnerability.urlstring
stable
Dynatrace URL to the details page of the vulnerability. |
Dynatrace URL to the details page of the vulnerability. |
https://example.comEntity change events: Environmental data
This section contains information about the vulnerability's affected entity and related entities.
Affected entity
Attribute
Type
Description
Examples
affected_entity.affected_processes.idsarray
stable
IDs of the processes that are currently affected by the vulnerability.
IDs of the processes that are currently affected by the vulnerability.
PROCESS_GROUP_INSTANCE-1affected_entity.affected_processes.namesarray
stable
Names of the processes that are currently affected by the vulnerability.
Names of the processes that are currently affected by the vulnerability.
prod_process_group_instance_1affected_entity.idstring
stable
ID of the affected entity.
ID of the affected entity.
PROCESS_GROUP-1; HOST-1affected_entity.management_zones.idsarray
stable
IDs of the management zones to which the affected entity belongs.
IDs of the management zones to which the affected entity belongs.
mzid1affected_entity.management_zones.namesarray
stable
Names of the management zones to which the affected entity belongs.
Names of the management zones to which the affected entity belongs.
mz1affected_entity.namestring
stable
Name of the affected entity.
Name of the affected entity.
prod_process_group_1; prod_hostaffected_entity.reachable_data_assets.countlong
experimental
Number of reachable data assets.
Number of reachable data assets.
1affected_entity.reachable_data_assets.idsarray
experimental
IDs of the data assets that can be reached by the affected entities of the vulnerability.
IDs of the data assets that can be reached by the affected entities of the vulnerability.
DATABASE-1affected_entity.reachable_data_assets.namesarray
experimental
Names of the data assets that can be reached by the affected entities of the vulnerability.
Names of the data assets that can be reached by the affected entities of the vulnerability.
prod_database_1affected_entity.typestring
stable
Type of affected entity.
Type of affected entity.
PROCESS_GROUP; HOST; KUBERNETES_NODEaffected_entity.vulnerable_component.idstring
stable
ID of the vulnerable component causing the vulnerability.
ID of the vulnerable component causing the vulnerability.
SOFTWARE_COMPONENT-D8FCFFB4FDF7A3FFaffected_entity.vulnerable_component.namestring
stable
Name of the vulnerable component causing the vulnerability.
Name of the vulnerable component causing the vulnerability.
log4j-core-2.6.2.jaraffected_entity.vulnerable_component.package_namestring
experimental
Package name of the vulnerable component causing the vulnerability.
Package name of the vulnerable component causing the vulnerability.
k8s.io/kubernetes; github.com/kubernetes/kubernetes/pkg/kubelet/kuberuntimeaffected_entity.vulnerable_component.short_namestring
stable
Short name of the vulnerable component causing the vulnerability.
Short name of the vulnerable component causing the vulnerability.
log4jaffected_entity.vulnerable_functionsarray
stable
Vulnerable functions detected, containing or causing the vulnerability.
Vulnerable functions detected, containing or causing the vulnerability.
org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)affected_entity.vulnerable_functions_not_availablearray
experimental
Vulnerable functions detected which Dynatrace can't tell if they're in use due to limited insights.
Vulnerable functions detected which Dynatrace can't tell if they're in use due to limited insights.
org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)affected_entity.vulnerable_functions_not_in_usearray
experimental
Vulnerable functions detected which are not actively used.
Vulnerable functions detected which are not actively used.
org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)Related entities
Attribute
Type
Description
Examples
related_entities.applications.countlong
stable
Number of related applications.
Number of related applications.
1related_entities.applications.idsarray
stable
IDs of the applications related to the vulnerability's affected entities.
IDs of the applications related to the vulnerability's affected entities.
APPLICATION-1related_entities.applications.namesarray
stable
Names of the applications related to the vulnerability's affected entities.
Names of the applications related to the vulnerability's affected entities.
prod_application_1related_entities.databases.countlong
stable
Number of related databases.
Number of related databases.
1related_entities.databases.idsarray
stable
IDs of the databases related to the vulnerability's affected entities.
IDs of the databases related to the vulnerability's affected entities.
DATABASE-1related_entities.databases.namesarray
stable
Names of the databases related to the vulnerability's affected entities.
Names of the databases related to the vulnerability's affected entities.
prod_database_1related_entities.hosts.countlong
stable
Number of related hosts.
Number of related hosts.
1related_entities.hosts.idsarray
stable
IDs of the hosts related to the vulnerability's affected entities.
IDs of the hosts related to the vulnerability's affected entities.
HOST-1related_entities.hosts.namesarray
stable
Names of the hosts related to the vulnerability's affected entities.
Names of the hosts related to the vulnerability's affected entities.
prod_host_1related_entities.kubernetes_clusters.countlong
stable
Number of related Kubernetes clusters.
Number of related Kubernetes clusters.
1related_entities.kubernetes_clusters.idsarray
stable
IDs of the Kubernetes clusters related to the vulnerability's affected entities.
IDs of the Kubernetes clusters related to the vulnerability's affected entities.
KUBERNETES_CLUSTER-1related_entities.kubernetes_clusters.namesarray
stable
Names of the Kubernetes clusters related to the vulnerability's affected entities.
Names of the Kubernetes clusters related to the vulnerability's affected entities.
prod_kubernetes_cluster_1related_entities.kubernetes_workloads.countlong
stable
Number of related Kubernetes workloads.
Number of related Kubernetes workloads.
1related_entities.kubernetes_workloads.idsarray
stable
IDs of the Kubernetes workloads related to the vulnerability's affected entities.
IDs of the Kubernetes workloads related to the vulnerability's affected entities.
KUBERNETES_WORKLOAD-1related_entities.kubernetes_workloads.namesarray
stable
Names of the Kubernetes workloads related to the vulnerability's affected entities.
Names of the Kubernetes workloads related to the vulnerability's affected entities.
prod_kubernetes_workload_1related_entities.services.countlong
stable
Number of related services.
Number of related services.
1related_entities.services.idsarray
stable
IDs of the services related to the vulnerability's affected entities.
IDs of the services related to the vulnerability's affected entities.
SERVICE-1related_entities.services.namesarray
stable
Names of the services related to the vulnerability's affected entities.
Names of the services related to the vulnerability's affected entities.
prod_service_1Entity state events
Entity state events are historical vulnerability states reported at the entity level. The current vulnerability state per entity is exported to Grail regularly.
fetch events| filter event.kind == "SECURITY_EVENT"| filter event.category == "VULNERABILITY_MANAGEMENT"| filter event.type == "VULNERABILITY_STATE_REPORT_EVENT"| filter event.level == "ENTITY"
Entity state: Event data
This section contains general event information.
Attribute
Type
Description
Examples
event.categorystring
stable
Categorization based on the product and data generating this event.
Categorization based on the product and data generating this event.
VULNERABILITY_MANAGEMENTevent.descriptionstring
stable
Human-readable description of an event.
Human-readable description of an event.
S-49 Remote Code Execution state event reportedevent.group_labelstring
experimental
Group label of an event.
Group label of an event.
STATE_REPORTevent.kindstring
stable
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permissionSECURITY_EVENTevent.levelstring
stable
Main reference point to which the event or data is related. Possible values are
Main reference point to which the event or data is related. Possible values are
Vulnerability (shows the global aggregation across the entire environment and comprises all entities and management zones) and Entity (shows the assessment based on the entity itself).ENTITYevent.namestring
stable
The human readable display name of an event type.
The human readable display name of an event type.
Vulnerability historical state report eventevent.providerstring
stable
Source of the event, for example the name of the component or system that generated the event.
Tags:
Source of the event, for example the name of the component or system that generated the event.
Tags:
permissionOneAgent; K8S; Davis; VMWare; GCP; AWS; LIMA_USAGE_STREAMevent.provider_productstring
stable
Name of the product providing this event.
Name of the product providing this event.
Runtime Vulnerability Analytics; Snyk Containerevent.statusstring
stable
Status of an event as being either Active or Closed.
Status of an event as being either Active or Closed.
OPEN; RESOLVED; MUTEDevent.typestring
stable
The unique type identifier of a given event.
Tags:
The unique type identifier of a given event.
Tags:
permissionVULNERABILITY_STATE_REPORT_EVENTtimestamptimestamp
stable
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.
1649822520123123123Entity state: Vulnerability data
This section contains information about the vulnerability at the entity level and its global vulnerability, with a focus on the affected entities.
Attribute
Type
Description
Examples
vulnerability.code_location.namestring
stable
Name of the code location where the code-level vulnerability was detected.
Name of the code location where the code-level vulnerability was detected.
org.dynatrace.profileservice.BioController.markdownToHtml(String):80vulnerability.cvss.base_scoredouble
stable
Vulnerability's CVSS base score provided by NVD.
Vulnerability's CVSS base score provided by NVD.
8.1vulnerability.cvss.vectorstring
experimental
Vulnerability's CVSS vector defined by the provider.
Vulnerability's CVSS vector defined by the provider.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:Hvulnerability.cvss.versionstring
stable
Vulnerability's CVSS score version.
Vulnerability's CVSS score version.
3.1vulnerability.davis_assessment.assessment_modestring
stable
Availability of the information based on which the assessment of the vulnerability at the entity level has been done.
Availability of the information based on which the assessment of the vulnerability at the entity level has been done.
FULL; NOT_AVAILABLE; REDUCEDvulnerability.davis_assessment.assessment_mode_reasonsstring[]
experimental
Reasons for the assessment mode at the entity level.
Reasons for the assessment mode at the entity level.
[LIMITED_BY_CONFIGURATION, LIMITED_AGENT_SUPPORT]vulnerability.davis_assessment.data_assets_statusstring
stable
Affected entity's reachability by a database.
Affected entity's reachability by a database.
NOT_AVAILABLE; NOT_DETECTED; REACHABLEvulnerability.davis_assessment.exploit_statusstring
stable
Public exploits status of the vulnerability at the entity level.
Public exploits status of the vulnerability at the entity level.
AVAILABLE; NOT_AVAILABLEvulnerability.davis_assessment.exposure_statusstring
stable
Internet exposure status of the vulnerability at the entity level.
Internet exposure status of the vulnerability at the entity level.
NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORKvulnerability.davis_assessment.levelstring
stable
Risk level, based on Davis Security Score, of the vulnerability at the entity level.
Risk level, based on Davis Security Score, of the vulnerability at the entity level.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.davis_assessment.scoredouble
stable
Davis Security Score (1-10) calculated by Dynatrace for the vulnerability at the entity level.
Davis Security Score (1-10) calculated by Dynatrace for the vulnerability at the entity level.
8.1vulnerability.davis_assessment.vulnerable_function_statusstring
stable
Usage status of the vulnerable functions causing the vulnerability at the entity level.
Usage status of the vulnerable functions causing the vulnerability at the entity level.
IN_USE; NOT_AVAILABLE; NOT_IN_USEvulnerability.descriptionstring
stable
Description of the vulnerability.
Description of the vulnerability.
More detailed description about improper input validation vulnerability.vulnerability.display_idstring
stable
Dynatrace user-readable identifier for the vulnerability.
Dynatrace user-readable identifier for the vulnerability.
S-1234vulnerability.external_idstring
stable
External provider's unique identifier for the vulnerability.
External provider's unique identifier for the vulnerability.
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646vulnerability.external_urlstring
stable
External provider's URL to the details page of the vulnerability.
External provider's URL to the details page of the vulnerability.
https://example.comvulnerability.idstring
stable
Dynatrace unique identifier for the vulnerability.
Dynatrace unique identifier for the vulnerability.
2039861408676243188vulnerability.is_fix_availableboolean
experimental
Indicates if a vulnerability fix is available.
Indicates if a vulnerability fix is available.
vulnerability.mute.change_datetimestamp
stable
Timestamp of the last muted or unmuted action of the vulnerability at the entity level.
Timestamp of the last muted or unmuted action of the vulnerability at the entity level.
2023-03-22T13:19:36.945Zvulnerability.mute.reasonstring
stable
Reason for muting or unmuting the vulnerability at the entity level.
Reason for muting or unmuting the vulnerability at the entity level.
FALSE_POSITIVE; IGNORE; AFFECTED; CONFIGURATION_NOT_AFFECTED; OTHERvulnerability.mute.statusstring
stable
Mute status of the vulnerability at the entity level.
Mute status of the vulnerability at the entity level.
MUTED; NOT_MUTEDvulnerability.mute.userstring
stable
User who last changed the mute status of the vulnerability at the entity level.
User who last changed the mute status of the vulnerability at the entity level.
user@example.comvulnerability.parent.davis_assessment.assessment_modestring
stable
Availability of the information based on which the vulnerability assessment has been done.
Availability of the information based on which the vulnerability assessment has been done.
FULL; NOT_AVAILABLE; REDUCEDvulnerability.parent.davis_assessment.data_assets_statusstring
stable
Vulnerability's reachability of related data assets by affected entities.
Vulnerability's reachability of related data assets by affected entities.
NOT_AVAILABLE; NOT_DETECTED; REACHABLEvulnerability.parent.davis_assessment.exposure_statusstring
stable
Vulnerability's internet exposure status.
Vulnerability's internet exposure status.
NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORKvulnerability.parent.davis_assessment.levelstring
stable
Vulnerability's Davis Security Score level.
Vulnerability's Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.parent.davis_assessment.scoredouble
stable
Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.
Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.
8.1vulnerability.parent.davis_assessment.vulnerable_function_statusstring
stable
Usage status of vulnerable functions causing the vulnerability. Status is
Usage status of vulnerable functions causing the vulnerability. Status is
IN_USE when there's at least one vulnerable function in use by an application.IN_USE; NOT_AVAILABLE; NOT_IN_USEvulnerability.parent.first_seenstring
stable
Timestamp of when the vulnerability was first detected.
Timestamp of when the vulnerability was first detected.
2023-03-22T13:19:36.945Zvulnerability.parent.mute.change_datetimestamp
stable
Timestamp of the last mute or unmute action of the vulnerability.
Timestamp of the last mute or unmute action of the vulnerability.
2023-03-22T13:19:36.945Zvulnerability.parent.mute.reasonstring
stable
Reason for muting or unmuting the vulnerability.
Reason for muting or unmuting the vulnerability.
FALSE_POSITIVE; IGNORE; AFFECTED; CONFIGURATION_NOT_AFFECTED; OTHERvulnerability.parent.mute.statusstring
stable
Vulnerability's mute status.
Vulnerability's mute status.
MUTED; NOT_MUTEDvulnerability.parent.mute.userstring
stable
User who last changed the vulnerability's mute status.
User who last changed the vulnerability's mute status.
user@example.comvulnerability.parent.resolution.change_datestring
stable
Timestamp of the vulnerability's last resolution status change.
Timestamp of the vulnerability's last resolution status change.
2023-03-22T13:19:37.466Zvulnerability.parent.resolution.statusstring
stable
Current status of the vulnerability.
Current status of the vulnerability.
OPEN; RESOLVEDvulnerability.parent.risk.levelstring
stable
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.parent.risk.scoredouble
stable
Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
8.1vulnerability.references.cvestring[]
stable
List of the vulnerability's CVE IDs.
List of the vulnerability's CVE IDs.
[CVE-2021-41079]vulnerability.references.cwestring[]
stable
List of the vulnerability's CWE IDs.
List of the vulnerability's CWE IDs.
[CWE-20]vulnerability.references.owaspstring[]
stable
List of vulnerability's OWASP IDs.
List of vulnerability's OWASP IDs.
[2021:A3]vulnerability.remediation.descriptionstring
experimental
Description of the vulnerability's remediation advice.
Description of the vulnerability's remediation advice.
Upgrade component to version 1.2.3 or highervulnerability.resolution.change_datetimestamp
stable
Timestamp of the last status change of the vulnerability at the entity level.
Timestamp of the last status change of the vulnerability at the entity level.
2023-03-22T13:19:37.466Zvulnerability.resolution.statusstring
stable
Resolution status of the vulnerability at the entity level.
Resolution status of the vulnerability at the entity level.
OPEN; RESOLVEDvulnerability.risk.levelstring
stable
Vulnerability's risk score level defined by the provider at the entity level. For Dynatrace, the Davis Security Score level.
Vulnerability's risk score level defined by the provider at the entity level. For Dynatrace, the Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.risk.scalestring
stable
Scale by which the risk score and risk score level defined by the provider for the vulnerability at the entity level are measured.
Scale by which the risk score and risk score level defined by the provider for the vulnerability at the entity level are measured.
Davis Security Scorevulnerability.risk.scoredouble
stable
Risk score defined by the provider for the vulnerability at the entity level. For Dynatrace, Davis Security Score.
Risk score defined by the provider for the vulnerability at the entity level. For Dynatrace, Davis Security Score.
8.1vulnerability.stackstring
experimental
Level of the vulnerable component in the technological stack.
Level of the vulnerable component in the technological stack.
CODE; CODE_LIBRARY; SOFTWARE; CONTAINER_ORCHESTRATIONvulnerability.technologystring
stable
Technology of the vulnerable component.
Technology of the vulnerable component.
JAVA; DOTNET; GO; PHP; NODE_JSvulnerability.titlestring
stable
Title of the vulnerability.
Title of the vulnerability.
Improper Input Validationvulnerability.typestring
stable
Classification of the vulnerability based on commonly accepted enums, such as CWE.
Classification of the vulnerability based on commonly accepted enums, such as CWE.
Improper Input Validationvulnerability.urlstring
stable
Dynatrace URL to the details page of the vulnerability. |
Dynatrace URL to the details page of the vulnerability. |
https://example.comEntity state: Environmental data
This section contains information about the vulnerability's affected and related entities.
Affected entities
Attribute
Type
Description
Examples
affected_entity.affected_processes.idsarray
stable
IDs of the processes that are currently affected by the vulnerability.
IDs of the processes that are currently affected by the vulnerability.
PROCESS_GROUP_INSTANCE-1affected_entity.affected_processes.namesarray
stable
Names of the processes that are currently affected by the vulnerability.
Names of the processes that are currently affected by the vulnerability.
prod_process_group_instance_1affected_entity.idstring
stable
ID of the affected entity.
ID of the affected entity.
PROCESS_GROUP-1; HOST-1affected_entity.management_zones.idsarray
stable
IDs of the management zones to which the affected entity belongs.
IDs of the management zones to which the affected entity belongs.
mzid1affected_entity.management_zones.namesarray
stable
Names of the management zones to which the affected entity belongs.
Names of the management zones to which the affected entity belongs.
mz1affected_entity.namestring
stable
Name of the affected entity.
Name of the affected entity.
prod_process_group_1; prod_hostaffected_entity.reachable_data_assets.countlong
experimental
Number of reachable data assets.
Number of reachable data assets.
1affected_entity.reachable_data_assets.idsarray
experimental
IDs of the data assets that can be reached by the affected entities of the vulnerability.
IDs of the data assets that can be reached by the affected entities of the vulnerability.
DATABASE-1affected_entity.reachable_data_assets.namesarray
experimental
Names of the data assets that can be reached by the affected entities of the vulnerability.
Names of the data assets that can be reached by the affected entities of the vulnerability.
prod_database_1affected_entity.typestring
stable
Type of affected entity.
Type of affected entity.
PROCESS_GROUP; HOST; KUBERNETES_NODEaffected_entity.vulnerable_component.idstring
stable
ID of the vulnerable component causing the vulnerability.
ID of the vulnerable component causing the vulnerability.
SOFTWARE_COMPONENT-D8FCFFB4FDF7A3FFaffected_entity.vulnerable_component.namestring
stable
Name of the vulnerable component causing the vulnerability.
Name of the vulnerable component causing the vulnerability.
log4j-core-2.6.2.jaraffected_entity.vulnerable_component.package_namestring
experimental
Package name of the vulnerable component causing the vulnerability.
Package name of the vulnerable component causing the vulnerability.
k8s.io/kubernetes; github.com/kubernetes/kubernetes/pkg/kubelet/kuberuntimeaffected_entity.vulnerable_component.short_namestring
stable
Short name of the vulnerable component causing the vulnerability.
Short name of the vulnerable component causing the vulnerability.
log4jaffected_entity.vulnerable_functionsarray
stable
Vulnerable functions detected, containing or causing the vulnerability.
Vulnerable functions detected, containing or causing the vulnerability.
org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)affected_entity.vulnerable_functions_not_availablearray
experimental
Vulnerable functions detected which Dynatrace can't tell if they're in use due to limited insights.
Vulnerable functions detected which Dynatrace can't tell if they're in use due to limited insights.
org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)affected_entity.vulnerable_functions_not_in_usearray
experimental
Vulnerable functions detected which are not actively used.
Vulnerable functions detected which are not actively used.
org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)Related entities
Attribute
Type
Description
Examples
related_entities.applications.countlong
stable
Number of related applications.
Number of related applications.
1related_entities.applications.idsarray
stable
IDs of the applications related to the vulnerability's affected entities.
IDs of the applications related to the vulnerability's affected entities.
APPLICATION-1related_entities.applications.namesarray
stable
Names of the applications related to the vulnerability's affected entities.
Names of the applications related to the vulnerability's affected entities.
prod_application_1related_entities.databases.countlong
stable
Number of related databases.
Number of related databases.
1related_entities.databases.idsarray
stable
IDs of the databases related to the vulnerability's affected entities.
IDs of the databases related to the vulnerability's affected entities.
DATABASE-1related_entities.databases.namesarray
stable
Names of the databases related to the vulnerability's affected entities.
Names of the databases related to the vulnerability's affected entities.
prod_database_1related_entities.hosts.countlong
stable
Number of related hosts.
Number of related hosts.
1related_entities.hosts.idsarray
stable
IDs of the hosts related to the vulnerability's affected entities.
IDs of the hosts related to the vulnerability's affected entities.
HOST-1related_entities.hosts.namesarray
stable
Names of the hosts related to the vulnerability's affected entities.
Names of the hosts related to the vulnerability's affected entities.
prod_host_1related_entities.kubernetes_clusters.countlong
stable
Number of related Kubernetes clusters.
Number of related Kubernetes clusters.
1related_entities.kubernetes_clusters.idsarray
stable
IDs of the Kubernetes clusters related to the vulnerability's affected entities.
IDs of the Kubernetes clusters related to the vulnerability's affected entities.
KUBERNETES_CLUSTER-1related_entities.kubernetes_clusters.namesarray
stable
Names of the Kubernetes clusters related to the vulnerability's affected entities.
Names of the Kubernetes clusters related to the vulnerability's affected entities.
prod_kubernetes_cluster_1related_entities.kubernetes_workloads.countlong
stable
Number of related Kubernetes workloads.
Number of related Kubernetes workloads.
1related_entities.kubernetes_workloads.idsarray
stable
IDs of the Kubernetes workloads related to the vulnerability's affected entities.
IDs of the Kubernetes workloads related to the vulnerability's affected entities.
KUBERNETES_WORKLOAD-1related_entities.kubernetes_workloads.namesarray
stable
Names of the Kubernetes workloads related to the vulnerability's affected entities.
Names of the Kubernetes workloads related to the vulnerability's affected entities.
prod_kubernetes_workload_1related_entities.services.countlong
stable
Number of related services.
Number of related services.
1related_entities.services.idsarray
stable
IDs of the services related to the vulnerability's affected entities.
IDs of the services related to the vulnerability's affected entities.
SERVICE-1related_entities.services.namesarray
stable
Names of the services related to the vulnerability's affected entities.
Names of the services related to the vulnerability's affected entities.
prod_service_1Vulnerability change events
Vulnerability change events are change events at the vulnerability level. An event is generated whenever a vulnerability undergoes a status or assessment change.
fetch events| filter event.kind == "SECURITY_EVENT"| filter event.category == "VULNERABILITY_MANAGEMENT"| filter event.type == "VULNERABILITY_STATUS_CHANGE_EVENT"fetch events| filter event.kind == "SECURITY_EVENT"| filter event.category == "VULNERABILITY_MANAGEMENT"| filter event.type == "VULNERABILITY_ASSESSMENT_CHANGE_EVENT"fetch events| filter event.kind == "SECURITY_EVENT"| filter event.category == "VULNERABILITY_MANAGEMENT"| filter event.type == "VULNERABILITY_IMPACT_CHANGE_EVENT"
Vulnerability state: Event data
This section contains general event information.
Attribute
Type
Description
Examples
event.categorystring
stable
Standard categorization based on the significance of an event according to the ITIL event management standard (previously known as
Standard categorization based on the significance of an event according to the ITIL event management standard (previously known as
severity level).VULNERABILITY_MANAGEMENTevent.change_listarray
stable
List of attributes updated as part of the change event. Values in the list match a
List of attributes updated as part of the change event. Values in the list match a
previous field.vulnerability.risk.score; affected_entities.count; related_entities.databases.countevent.descriptionstring
stable
Human-readable description of an event.
Human-readable description of an event.
S-49 Remote Code Execution status has changed to OPEN.; S-49 Remote Code Execution assessment has changed.event.group_labelstring
experimental
Group label of an event.
Group label of an event.
CHANGE_EVENTevent.kindstring
stable
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permissionSECURITY_EVENTevent.levelstring
stable
Main reference point to which the event or data is related. Possible values are
Main reference point to which the event or data is related. Possible values are
Vulnerability (shows the global aggregation across the entire environment and comprises all entities and management zones) and Entity (shows the assessment based on the entity itself).VULNERABILITYevent.namestring
stable
The human readable display name of an event type.
The human readable display name of an event type.
Vulnerability status change event; Vulnerability assessment change eventevent.providerstring
stable
Source of the event, for example the name of the component or system that generated the event.
Tags:
Source of the event, for example the name of the component or system that generated the event.
Tags:
permissionDynatraceevent.provider_productstring
stable
Name of the product providing this event.
Name of the product providing this event.
Runtime Vulnerability Analytics; Snyk Containerevent.statusstring
stable
Status of an event as being either Active or Closed.
Status of an event as being either Active or Closed.
OPEN; RESOLVED; MUTEDevent.status_transitionstring
experimental
An enum that shows the transition of the above event state.
An enum that shows the transition of the above event state.
NEW_OPEN; REOPEN; CLOSE; MUTE; UNMUTEevent.trigger.typestring
stable
Type of event trigger (for example, whether it was generated by the system, ingested via API, or triggered by the user).
Type of event trigger (for example, whether it was generated by the system, ingested via API, or triggered by the user).
DT_PLATFORM; USER_ACTIONevent.trigger.userstring
stable
ID of the user who triggered the event. If generated by Dynatrace, the value is
ID of the user who triggered the event. If generated by Dynatrace, the value is
SYSTEM.SYSTEM; <user_id>event.typestring
stable
The unique type identifier of a given event.
Tags:
The unique type identifier of a given event.
Tags:
permissionVULNERABILITY_STATUS_CHANGE_EVENT; VULNERABILITY_ASSESSMENT_CHANGE_EVENTtimestamptimestamp
stable
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.
1649822520123123123Vulnerability state: Vulnerability data
This section contains information about the vulnerability and its status and assessment changes.
Attribute
Type
Description
Examples
vulnerability.cvss.base_scoredouble
stable
Vulnerability's CVSS base score provided by NVD.
Vulnerability's CVSS base score provided by NVD.
8.1vulnerability.cvss.vectorstring
experimental
Vulnerability's CVSS vector defined by the provider.
Vulnerability's CVSS vector defined by the provider.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:Hvulnerability.cvss.versionstring
stable
Vulnerability's CVSS score version.
Vulnerability's CVSS score version.
3.1vulnerability.davis_assessment.assessment_modestring
stable
Availability of the information based on which the vulnerability assessment has been done.
Availability of the information based on which the vulnerability assessment has been done.
FULL; NOT_AVAILABLE; REDUCEDvulnerability.davis_assessment.assessment_mode_reasonsstring[]
experimental
Reasons for the assessment mode.
Reasons for the assessment mode.
[LIMITED_BY_CONFIGURATION, LIMITED_AGENT_SUPPORT]vulnerability.davis_assessment.data_assets_statusstring
stable
Vulnerability's reachability of related data assets by affected entities.
Vulnerability's reachability of related data assets by affected entities.
NOT_AVAILABLE; NOT_DETECTED; REACHABLEvulnerability.davis_assessment.exploit_statusstring
stable
Vulnerability's public exploits status.
Vulnerability's public exploits status.
AVAILABLE; NOT_AVAILABLEvulnerability.davis_assessment.exposure_statusstring
stable
Vulnerability's internet exposure status.
Vulnerability's internet exposure status.
NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORKvulnerability.davis_assessment.levelstring
stable
Vulnerability's risk level based on Davis Security Score.
Vulnerability's risk level based on Davis Security Score.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.davis_assessment.scoredouble
stable
Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.
Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.
8.1vulnerability.davis_assessment.vulnerable_function_statusstring
stable
Usage status of the vulnerable functions causing the vulnerability.
Usage status of the vulnerable functions causing the vulnerability.
IN_USE; NOT_AVAILABLE; NOT_IN_USEvulnerability.descriptionstring
stable
Description of the vulnerability.
Description of the vulnerability.
More detailed description about improper input validation vulnerability.vulnerability.display_idstring
stable
Dynatrace user-readable identifier for the vulnerability.
Dynatrace user-readable identifier for the vulnerability.
S-1234vulnerability.external_idstring
stable
External provider's unique identifier for the vulnerability.
External provider's unique identifier for the vulnerability.
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646vulnerability.external_urlstring
stable
External provider's URL to the details page of the vulnerability.
External provider's URL to the details page of the vulnerability.
https://example.comvulnerability.first_seentimestamp
stable
Timestamp of when the vulnerability was first detected.
Timestamp of when the vulnerability was first detected.
2023-03-22T13:19:36.945Zvulnerability.idstring
stable
Dynatrace unique identifier for the vulnerability.
Dynatrace unique identifier for the vulnerability.
2039861408676243188vulnerability.is_fix_availableboolean
experimental
Indicates if a vulnerability fix is available.
Indicates if a vulnerability fix is available.
vulnerability.mute.change_datetimestamp
stable
Timestamp of the vulnerability's last muted or unmuted action.
Timestamp of the vulnerability's last muted or unmuted action.
2023-03-22T13:19:36.945Zvulnerability.mute.reasonstring
stable
Reason for muting or unmuting the vulnerability.
Reason for muting or unmuting the vulnerability.
FALSE_POSITIVE; IGNORE; AFFECTED; CONFIGURATION_NOT_AFFECTED; OTHERvulnerability.mute.statusstring
stable
Vulnerability's mute status.
Vulnerability's mute status.
MUTED; NOT_MUTEDvulnerability.mute.userstring
stable
User who last changed the vulnerability's mute status.
User who last changed the vulnerability's mute status.
user@example.comvulnerability.previous.cvss.base_scoredouble
stable
Vulnerability's previous CVSS base score (in case the CVSS base score has changed).
Vulnerability's previous CVSS base score (in case the CVSS base score has changed).
8.1vulnerability.previous.davis_assessment.data_assets_statusstring
stable
Vulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).
Vulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).
NOT_AVAILABLE; NOT_DETECTED; REACHABLEvulnerability.previous.davis_assessment.exploit_statusstring
stable
Vulnerability's previous public exploit status (in case the public exploit status has changed).
Vulnerability's previous public exploit status (in case the public exploit status has changed).
AVAILABLE; NOT_AVAILABLEvulnerability.previous.davis_assessment.exposure_statusstring
stable
Vulnerability's previous internet exposure status (in case the internet exposure status has changed).
Vulnerability's previous internet exposure status (in case the internet exposure status has changed).
NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORKvulnerability.previous.davis_assessment.levelstring
stable
Vulnerability's previous risk level (in case the risk level has changed).
Vulnerability's previous risk level (in case the risk level has changed).
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.previous.davis_assessment.scoredouble
stable
Vulnerability's previous Davis Security Score (in case Davis Security Score has changed).
Vulnerability's previous Davis Security Score (in case Davis Security Score has changed).
8.1vulnerability.previous.davis_assessment.vulnerable_function_statusstring
stable
Vulnerability's previous vulnerable function status (in case the vulnerable function status has changed).
Vulnerability's previous vulnerable function status (in case the vulnerable function status has changed).
IN_USE; NOT_AVAILABLE; NOT_IN_USEvulnerability.previous.mute.change_datestring
stable
Timestamp of the vulnerability's previous mute status (in case the mute status has changed).
Timestamp of the vulnerability's previous mute status (in case the mute status has changed).
2023-03-22T13:19:36.945Zvulnerability.previous.mute.reasonstring
stable
Reason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).
Reason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).
Muted: False positivevulnerability.previous.mute.statusstring
stable
Vulnerability's previous mute status (in case the mute status has changed).
Vulnerability's previous mute status (in case the mute status has changed).
MUTED; NOT_MUTEDvulnerability.previous.mute.userstring
stable
User who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).
User who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).
user@example.comvulnerability.previous.resolution.statusstring
stable
Vulnerability's previous resolution status (in case the resolution status has changed).
Vulnerability's previous resolution status (in case the resolution status has changed).
OPEN; RESOLVEDvulnerability.previous.risk.levelstring
stable
Vulnerability's previous risk score level (in case the risk score level has changed).
Vulnerability's previous risk score level (in case the risk score level has changed).
LOW; MEDIUM; HIGH; CRITICALvulnerability.previous.risk.scoredouble
stable
Vulnerability's previous risk score (in case the risk score has changed).
Vulnerability's previous risk score (in case the risk score has changed).
8.1vulnerability.references.cvestring[]
stable
List of the vulnerability's CVE IDs.
List of the vulnerability's CVE IDs.
[CVE-2021-41079]vulnerability.references.cwestring[]
stable
List of the vulnerability's CWE IDs.
List of the vulnerability's CWE IDs.
[CWE-20]vulnerability.references.owaspstring[]
stable
List of vulnerability's OWASP IDs.
List of vulnerability's OWASP IDs.
[2021:A3]vulnerability.remediation.descriptionstring
experimental
Description of the vulnerability's remediation advice.
Description of the vulnerability's remediation advice.
Upgrade component to version 1.2.3 or highervulnerability.resolution.change_datetimestamp
stable
Timestamp of the vulnerability's last resolution status change.
Timestamp of the vulnerability's last resolution status change.
2023-03-22T13:19:37.466Zvulnerability.resolution.statusstring
stable
Vulnerability's resolution status.
Vulnerability's resolution status.
OPEN; RESOLVEDvulnerability.risk.levelstring
stable
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.risk.scalestring
stable
Scale by which the vulnerability's risk score and risk score level defined by the provider are measured.
Scale by which the vulnerability's risk score and risk score level defined by the provider are measured.
Davis Security Scorevulnerability.risk.scoredouble
stable
Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
8.1vulnerability.stackstring
experimental
Level of the vulnerable component in the technological stack.
Level of the vulnerable component in the technological stack.
CODE; CODE_LIBRARY; SOFTWARE; CONTAINER_ORCHESTRATIONvulnerability.technologystring
stable
Technology of the vulnerable component.
Technology of the vulnerable component.
JAVA; DOTNET; GO; PHP; NODE_JSvulnerability.titlestring
stable
Title of the vulnerability.
Title of the vulnerability.
Improper Input Validationvulnerability.typestring
stable
Classification of the vulnerability based on commonly accepted enums, such as CWE.
Classification of the vulnerability based on commonly accepted enums, such as CWE.
Improper Input Validationvulnerability.urlstring
stable
Dynatrace URL to the details page of the vulnerability. |
Dynatrace URL to the details page of the vulnerability. |
https://example.comVulnerability change: Environmental data
Affected entities
This section contains information on changes regarding vulnerability's affected entities.
Attribute
Type
Description
Examples
affected_entities.countlong
stable
Number of affected entities.
Number of affected entities.
1affected_entities.hosts.countlong
stable
Number of affected hosts.
Number of affected hosts.
2affected_entities.kubernetes_nodes.countlong
stable
Number of affected nodes.
Number of affected nodes.
2affected_entities.previous.countlong
deprecated
Number of affected entities before the last change event.
Number of affected entities before the last change event.
1affected_entities.previous.hosts.countlong
deprecated
Number of affected hosts before the last change event.
Number of affected hosts before the last change event.
5affected_entities.previous.kubernetes_nodes.countlong
deprecated
Number of affected Kubernetes nodes before the last change event.
Number of affected Kubernetes nodes before the last change event.
5affected_entities.previous.process_groups.countlong
deprecated
Number of affected process groups before the last change event.
Number of affected process groups before the last change event.
2affected_entities.process_groups.countlong
stable
Number of affected process groups.
Number of affected process groups.
2affected_entities.typesarray
stable
Types of affected entities.
Types of affected entities.
PROCESS_GROUP; HOST; KUBERNETES_NODERelated entities
This section contains information on changes regarding vulnerability's related entities.
Attribute
Type
Description
Examples
related_entities.applications.countlong
stable
Number of related applications.
Number of related applications.
1related_entities.databases.countlong
stable
Number of related databases.
Number of related databases.
1related_entities.hosts.countlong
stable
Number of related hosts.
Number of related hosts.
1related_entities.kubernetes_clusters.countlong
stable
Number of related Kubernetes clusters.
Number of related Kubernetes clusters.
1related_entities.kubernetes_workloads.countlong
stable
Number of related Kubernetes workloads.
Number of related Kubernetes workloads.
1related_entities.previous.databases.countlong
deprecated
Number of related databases before the last change event.
Number of related databases before the last change event.
1related_entities.services.countlong
stable
Number of related services.
Number of related services.
1Vulnerability state events
Vulnerability state events are historical states at the vulnerability level. The current vulnerability state is exported to Grail regularly.
fetch events| filter event.kind == "SECURITY_EVENT"| filter event.category == "VULNERABILITY_MANAGEMENT"| filter event.type == "VULNERABILITY_STATE_REPORT_EVENT"| filter event.level == "VULNERABILITY"
Vulnerability state: Event data
This section contains general event information.
Attribute
Type
Description
Examples
event.categorystring
stable
Categorization based on the product and data generating this event.
Categorization based on the product and data generating this event.
VULNERABILITY_MANAGEMENTevent.descriptionstring
stable
Human-readable description of an event.
Human-readable description of an event.
S-49 Remote Code Execution state event reportedevent.group_labelstring
experimental
Group label of an event.
Group label of an event.
STATE_REPORTevent.kindstring
stable
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permissionSECURITY_EVENTevent.levelstring
stable
Main reference point to which the event or data is related. Possible values are
Main reference point to which the event or data is related. Possible values are
Vulnerability (shows the global aggregation across the entire environment and comprises all entities and management zones) and Entity (shows the assessment based on the entity itself).VULNERABILITYevent.namestring
stable
The human readable display name of an event type.
The human readable display name of an event type.
Vulnerability historical state report eventevent.providerstring
stable
Source of the event, for example the name of the component or system that generated the event.
Tags:
Source of the event, for example the name of the component or system that generated the event.
Tags:
permissionDynatrace; Snykevent.provider_productstring
stable
Name of the product providing this event.
Name of the product providing this event.
Runtime Vulnerability Analytics; Snyk Containerevent.statusstring
stable
Status of an event as being either Active or Closed.
Status of an event as being either Active or Closed.
OPEN; RESOLVED; MUTEDevent.typestring
stable
The unique type identifier of a given event.
Tags:
The unique type identifier of a given event.
Tags:
permissionVULNERABILITY_STATE_REPORT_EVENTtimestamptimestamp
stable
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.
1649822520123123123Vulnerability state: Vulnerability data
This section contains information about the vulnerability.
Attribute
Type
Description
Examples
vulnerability.code_location.namestring
stable
Name of the code location where the code-level vulnerability was detected.
Name of the code location where the code-level vulnerability was detected.
org.dynatrace.profileservice.BioController.markdownToHtml(String):80vulnerability.cvss.base_scoredouble
stable
Vulnerability's CVSS base score provided by NVD.
Vulnerability's CVSS base score provided by NVD.
8.1vulnerability.cvss.vectorstring
experimental
Vulnerability's CVSS vector defined by the provider.
Vulnerability's CVSS vector defined by the provider.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:Hvulnerability.cvss.versionstring
stable
Vulnerability's CVSS score version.
Vulnerability's CVSS score version.
3.1vulnerability.davis_assessment.assessment_modestring
stable
Availability of the information based on which the vulnerability assessment has been done.
Availability of the information based on which the vulnerability assessment has been done.
FULL; NOT_AVAILABLE; REDUCEDvulnerability.davis_assessment.assessment_mode_reasonsstring[]
experimental
Reasons for the assessment mode.
Reasons for the assessment mode.
[LIMITED_BY_CONFIGURATION, LIMITED_AGENT_SUPPORT]vulnerability.davis_assessment.data_assets_statusstring
stable
Vulnerability's reachability of related data assets by affected entities.
Vulnerability's reachability of related data assets by affected entities.
NOT_AVAILABLE; NOT_DETECTED; REACHABLEvulnerability.davis_assessment.exploit_statusstring
stable
Vulnerability's public exploits status.
Vulnerability's public exploits status.
AVAILABLE; NOT_AVAILABLEvulnerability.davis_assessment.exposure_statusstring
stable
Vulnerability's internet exposure status.
Vulnerability's internet exposure status.
NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORKvulnerability.davis_assessment.levelstring
stable
Vulnerability's risk level based on Davis Security Score.
Vulnerability's risk level based on Davis Security Score.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.davis_assessment.scoredouble
stable
Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.
Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.
8.1vulnerability.davis_assessment.vulnerable_function_statusstring
stable
Usage status of the vulnerable functions causing the vulnerability.
Usage status of the vulnerable functions causing the vulnerability.
IN_USE; NOT_AVAILABLE; NOT_IN_USEvulnerability.descriptionstring
stable
Description of the vulnerability.
Description of the vulnerability.
More detailed description about improper input validation vulnerability.vulnerability.display_idstring
stable
Dynatrace user-readable identifier for the vulnerability.
Dynatrace user-readable identifier for the vulnerability.
S-1234vulnerability.external_idstring
stable
External provider's unique identifier for the vulnerability.
External provider's unique identifier for the vulnerability.
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646vulnerability.external_urlstring
stable
External provider's URL to the details page of the vulnerability.
External provider's URL to the details page of the vulnerability.
https://example.comvulnerability.first_seentimestamp
stable
Timestamp of when the vulnerability was first detected.
Timestamp of when the vulnerability was first detected.
2023-03-22T13:19:36.945Zvulnerability.idstring
stable
Dynatrace unique identifier for the vulnerability.
Dynatrace unique identifier for the vulnerability.
2039861408676243188vulnerability.is_fix_availableboolean
experimental
Indicates if a vulnerability fix is available.
Indicates if a vulnerability fix is available.
vulnerability.mute.change_datetimestamp
stable
Timestamp of the vulnerability's last muted or unmuted action.
Timestamp of the vulnerability's last muted or unmuted action.
2023-03-22T13:19:36.945Zvulnerability.mute.reasonstring
stable
Reason for muting or unmuting the vulnerability.
Reason for muting or unmuting the vulnerability.
FALSE_POSITIVE; IGNORE; AFFECTED; CONFIGURATION_NOT_AFFECTED; OTHERvulnerability.mute.statusstring
stable
Vulnerability's mute status.
Vulnerability's mute status.
MUTED; NOT_MUTEDvulnerability.mute.userstring
stable
User who last changed the vulnerability's mute status.
User who last changed the vulnerability's mute status.
user@example.comvulnerability.references.cvestring[]
stable
List of the vulnerability's CVE IDs.
List of the vulnerability's CVE IDs.
[CVE-2021-41079]vulnerability.references.cwestring[]
stable
List of the vulnerability's CWE IDs.
List of the vulnerability's CWE IDs.
[CWE-20]vulnerability.references.owaspstring[]
stable
List of vulnerability's OWASP IDs.
List of vulnerability's OWASP IDs.
[2021:A3]vulnerability.remediation.descriptionstring
experimental
Description of the vulnerability's remediation advice.
Description of the vulnerability's remediation advice.
Upgrade component to version 1.2.3 or highervulnerability.resolution.change_datetimestamp
stable
Timestamp of the vulnerability's last resolution status change.
Timestamp of the vulnerability's last resolution status change.
2023-03-22T13:19:37.466Zvulnerability.resolution.statusstring
stable
Vulnerability's resolution status.
Vulnerability's resolution status.
OPEN; RESOLVEDvulnerability.risk.levelstring
stable
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONEvulnerability.risk.scalestring
stable
Scale by which the vulnerability's risk score and risk score level defined by the provider are measured.
Scale by which the vulnerability's risk score and risk score level defined by the provider are measured.
Davis Security Scorevulnerability.risk.scoredouble
stable
Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
8.1vulnerability.stackstring
experimental
Level of the vulnerable component in the technological stack.
Level of the vulnerable component in the technological stack.
CODE; CODE_LIBRARY; SOFTWARE; CONTAINER_ORCHESTRATIONvulnerability.technologystring
stable
Technology of the vulnerable component.
Technology of the vulnerable component.
JAVA; DOTNET; GO; PHP; NODE_JSvulnerability.titlestring
stable
Title of the vulnerability.
Title of the vulnerability.
Improper Input Validationvulnerability.typestring
stable
Classification of the vulnerability based on commonly accepted enums, such as CWE.
Classification of the vulnerability based on commonly accepted enums, such as CWE.
Improper Input Validationvulnerability.urlstring
stable
Dynatrace URL to the details page of the vulnerability. |
Dynatrace URL to the details page of the vulnerability. |
https://example.comVulnerability state: Environmental data
This section contains information on the vulnerability's affected and related entities.
Affected entities
Attribute
Type
Description
Examples
affected_entities.affected_processes.countlong
stable
Number of affected processes.
Number of affected processes.
50affected_entities.countlong
stable
Number of affected entities.
Number of affected entities.
1affected_entities.hosts.countlong
stable
Number of affected hosts.
Number of affected hosts.
2affected_entities.kubernetes_nodes.countlong
stable
Number of affected nodes.
Number of affected nodes.
2affected_entities.management_zones.idsarray
stable
IDs of the management zones to which the affected entities belong.
IDs of the management zones to which the affected entities belong.
mzid1affected_entities.management_zones.namesarray
stable
Names of the management zones to which the affected entities belong.
Names of the management zones to which the affected entities belong.
mz1affected_entities.monitored_processes.countlong
stable
Number of processes of the process group.
Number of processes of the process group.
100affected_entities.process_groups.countlong
stable
Number of affected process groups.
Number of affected process groups.
2affected_entities.typesarray
stable
Types of affected entities.
Types of affected entities.
PROCESS_GROUP; HOST; KUBERNETES_NODEaffected_entities.vulnerable_components.idsarray
stable
Dynatrace IDs of the vulnerable components causing the vulnerability.
Dynatrace IDs of the vulnerable components causing the vulnerability.
SOFTWARE_COMPONENT-0000000000000001; SOFTWARE_COMPONENT-0000000000000002; SOFTWARE_COMPONENT-0000000000000003affected_entities.vulnerable_components.namesarray
stable
Names of the vulnerable components causing the vulnerability. |
Names of the vulnerable components causing the vulnerability. |
com.fasterxml.jackson.core:jackson-databind:2.10.0; node-sass:4.14.1affected_entities.vulnerable_functionsarray
stable
Vulnerable functions detected, containing or causing the vulnerability.
Vulnerable functions detected, containing or causing the vulnerability.
org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)Related entities
Attribute
Type
Description
Examples
related_entities.applications.countlong
stable
Number of related applications.
Number of related applications.
1related_entities.databases.countlong
stable
Number of related databases.
Number of related databases.
1related_entities.hosts.countlong
stable
Number of related hosts.
Number of related hosts.
1related_entities.kubernetes_clusters.countlong
stable
Number of related Kubernetes clusters.
Number of related Kubernetes clusters.
1related_entities.kubernetes_workloads.countlong
stable
Number of related Kubernetes workloads.
Number of related Kubernetes workloads.
1related_entities.services.countlong
stable
Number of related services.
Number of related services.
1Vulnerability-finding events
Vulnerability-finding events contain generic sections and fields like metadata, affected entity data and vulnerability data. They can also include extensions (such as container image data for container vulnerability findings) at the end of the page.
Vulnerability-finding events: Metadata
This section contains meta information on the vulnerability-finding event.
Attribute
Type
Description
Examples
event.categorystring
stable
Standard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace).
Standard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace).
VULNERABILITY_MANAGEMENTevent.descriptionstring
stable
Human-readable description of an event.
Human-readable description of an event.
Vulnerability CVE-2023-45871 of component linux:4.19.269-1 was detected in your container image unguard-frontend:latest@054e1d39event.kindstring
stable
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permissionSECURITY_EVENTevent.namestring
stable
The human readable display name of an event type.
The human readable display name of an event type.
Vulnerability finding eventevent.providerstring
stable
Source of the event, for example the name of the component or system that generated the event.
Tags:
Source of the event, for example the name of the component or system that generated the event.
Tags:
permissionAWSevent.provider_productstring
stable
Name of the product providing this event.
Name of the product providing this event.
AWS ECRevent.typestring
stable
The unique type identifier of a given event.
Tags:
The unique type identifier of a given event.
Tags:
permissionVULNERABILITY_FINDING_EVENTtimestamptimestamp
stable
Time (UNIX Epoch time in nanoseconds) when the event originated, typically when the scan was completed. If scan completion time isn't available, it's set to the event creation time.
Time (UNIX Epoch time in nanoseconds) when the event originated, typically when the scan was completed. If scan completion time isn't available, it's set to the event creation time.
1649822520123123123Vulnerability-finding events: Affected entity data
This section contains information about the affected entity (for example a container image).
Attribute
Type
Description
Examples
affected_entity.idstring
stable
ID of the affected entity.
ID of the affected entity.
sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1affected_entity.namestring
stable
Name of the affected entity.
Name of the affected entity.
unguard-frontend:latest@054e1d39affected_entity.typestring
stable
Type of affected entity.
Type of affected entity.
CONTAINER_IMAGEVulnerability-finding events: Vulnerability data
This section contains information about the vulnerability that caused the vulnerability-finding event (vulnerability ID, description, risk level, and so on).
Attribute
Type
Description
Examples
vulnerability.descriptionstring
stable
Description of the vulnerability.
Description of the vulnerability.
More detailed description about improper input validation vulnerability.vulnerability.external_idstring
stable
External provider's unique identifier for the vulnerability.
External provider's unique identifier for the vulnerability.
CVE-2019-19814vulnerability.risk.levelstring
stable
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
CRITICAL; HIGH; MEDIUM; LOW; NONE; NOT_AVAILABLEvulnerability.risk.scoredouble
stable
Normalized score from
Normalized score from
0.0 to 10.0, not directly taken from the provider. Mapped to the maximum of a given range based on the risk level (for example 10.0 for CRITICAL). If no risk level is available, it's set to 0.0.10.0vulnerability.titlestring
stable
Title of the vulnerability.
Title of the vulnerability.
CVE-2019-19814; Improper input validationvulnerable_component.namestring
experimental
Name of the vulnerable component causing the vulnerability.
Name of the vulnerable component causing the vulnerability.
sqlite3:3.16.2-5+deb9u3vulnerable_component.short_namestring
experimental
Short name of the vulnerable component causing the vulnerability.
Short name of the vulnerable component causing the vulnerability.
sqlite3vulnerable_component.versionstring
experimental
Version of the vulnerable component causing the vulnerability.
Version of the vulnerable component causing the vulnerability.
3.16.2-5+deb9u3Extensions
Vulnerability-finding events: Container image data
This section contains container-image—specific data.
Attribute
Type
Description
Examples
container_image.digeststring
experimental
Container image digest uniquely and immutably identifying the vulnerable container image.
Container image digest uniquely and immutably identifying the vulnerable container image.
sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1container_image.registrystring
experimental
Container image registry from which the finding originates.
Container image registry from which the finding originates.
1294385647.eu-central-1container_image.repositorystring
experimental
Container image repository from which the finding originates.
Container image repository from which the finding originates.
unguard-frontendcontainer_image.tagsarray
experimental
List of tags of the vulnerable container image.
List of tags of the vulnerable container image.
[1.0.0]; [1.0.0, 1.0.0-nightly, latest]