To include or exclude specific processes from being monitored by Application Security, you can set up fine-grained monitoring rules for Third-party Vulnerability Analytics, based on properties such as process group tag, host tag, and management zone.
If you define custom monitoring rules, the global third-party vulnerability detection control mode applies to all processes that are not matched by a rule.
You can define custom monitoring rules through the Dynatrace web UI or the Settings API.
For Kubernetes environments, you need to add tags both on the host and on the Kubernetes node.
After you add, edit, or remove a rule, it can take up to 15 minutes for changes to take effect throughout the system. The configured monitoring rules are evaluated periodically (on internal worker runs) and on-demand (through calls to the REST API).
Regardless of the calling context, the rule evaluation stays the same: given a set of entities, the algorithm decides whether a specific entity should be monitored. The rules are processed in order until the first match. Note that each rule must be unique.
When you have a rule in place for a management zone or tag, and you add an entity to the same management zone or add the same tag to an entity, it can take up to 15 minutes until the change is reflected in your monitoring rule.
For example, if you have a Do not monitor if host tag equals 'testsystem' rule, and you add the tag testsystem to a host, it can take up to 15 minutes until the newly tagged host stops being monitored.
If a rule matches a specific entity, the configured mode (Monitor, Do not monitor) is used and subsequent rules are not evaluated for this particular entity.
If no rule matches a specific entity, the global third-party vulnerability detection control mode is used.