Dynatrace Runtime Application Protection leverages code-level insights and transaction analysis to detect and block exploitation attempts on your applications automatically and in real time.
Dynatrace detects SQL injection, JNDI injection, command injection, and SSRF attacks in the following technologies.
Only supported on Windows x86 and Linux x86 systems.
Only .NET Framework 4.5, .NET Core 3.0 or higher, and 64-bit processes are supported.
For .NET and Go technologies, for which automatic deep monitoring is disabled, you need to manually enable deep monitoring on each host. For more information, see Process deep monitoring.
To set up Runtime Application Protection, follow the instructions below.
Contact a Dynatrace product expert via live chat to activate Runtime Application Protection.
To enable Runtime Application Protection globally on your environment
Go to Settings (New) > Analyze and alert > Application security > Application protection (New).
Enable Runtime Application Protection.
Select Enable.
To define the global attack control for all process groups
If you define custom monitoring rules based on certain process groups or vulnerability types, the custom rules override the global attack control for the selected technology, and Runtime Application Protection continues to monitor the attacks based on your rules.
code-level attack evaluation and enable the feature for the technologies you want to monitor.OneAgent version 1.309 To detect SSRF attacks, you also need to enable SSRF attack evaluation. See below for instructions.
Java SSRF code-level vulnerability and attack evaluation.After you set up Runtime Application Protection, you can
Runtime Application Protection is licensed based on the consumption of GiB-hours if you're using the Dynatrace Platform Subscription (DPS) licensing model, or Application Security units (ASUs) if you're using the Dynatrace classic licensing.