Enrich threat observables with Security Enrichment

• Latest Dynatrace
• How-to guide
• Published Apr 14, 2026

Enrich observables with threat‑intelligence data in a unified experience in Dynatrace.

Get started

Overview

How enrichment threat observables works

Security Enrichment gives you a unified, flexible way to enrich supported observables (currently IP addresses, with more observable types to follow) with intelligence from any source. You can integrate commercial, open‑source, or proprietary threat‑intelligence services to add reputation, geolocation, and other contextual data directly into your Dynatrace security workflows.

It provides a single interface to:

For an easy onboarding, Security Enrichment provides preset blueprints for AbuseIPDB and VirusTotal. Each blueprint includes the correct endpoints, request format, and response mapping, so you only need to provide your API key from the corresponding provider. You can also create custom enrichment connections to integrate any HTTP‑based API—internal or external—into your security analysis.

Use cases

Once you configure Security Enrichment, you can enrich observables such as IP addresses with data from any supported or custom threat‑intelligence source.

Key use cases include:

Requirements

Vendor requirements

Register with your chosen threat‑intelligence provider (for example, AbuseIPDB, VirusTotal, or any custom API) and obtain an API key if required.

Dynatrace requirements

To use Security Enrichment, you need the following Dynatrace platform permissions.

For the complete list of permissions required, go to Hub, select Security Enrichment, and display Technical information.

Activation and setup

Follow the steps below to connect to a threat‑intelligence source, normalize its data, and validate the integration.

1. Create a connection

2. Normalize enrichment results with custom mapping

Optional

Custom mapping lets you transform the raw JSON returned by an external API into the format Dynatrace uses for enrichment. When a request completes, Dynatrace stores the provider’s raw response as the integrationResponse. Your mapping then converts that data into a mappedResponse, which Dynatrace uses to display normalized, consistent enrichment results across all threat‑intelligence sources. You can view the mapped output in the enrichment report shown in other Dynatrace apps.

Example: From raw response to normalized fields

The following example illustrates how a raw provider response becomes a normalized mappedResponse:

{
"data": {
    "ipAddress": "192.0.2.12",
    "isPublic": true,
    "ipVersion": 4,
    "isWhitelisted": false,
    "abuseConfidenceScore": 0,
    "countryCode": "AT",
    "usageType": "Commercial",
    "isp": "Wien Energie GmbH",
    "domain": "wienenergie.at",
    "hostnames": [],
    "isTor": false,
    "totalReports": 0,
    "numDistinctUsers": 0,
    "lastReportedAt": null
  }
}

You can map these fields to normalized enrichment fields using DQL:

fields
  `geo.country.iso_code` = data[countryCode],
  `reputation.level` = if(
    isNull(data[abuseConfidenceScore]),
    null,
    else: if(
      data[isWhitelisted],
      "Benign",
      else: if(
        data[abuseConfidenceScore] == 0,
        "Unreported",
        else: if(
          data[abuseConfidenceScore] < 50,
          "Inconclusive",
          else: if(
            data[abuseConfidenceScore] < 80,
            "Suspicious",
            else: "Malicious"
          )
        )
      )
    )
  ),
  `last_reported` = parse(data[lastReportedAt], "ISO8601:result"),
  `product.vendor` = "AbuseIPDB",
  `report.reference` = concat("https://www.abuseipdb.com/check/", data[ipAddress])

This produces the following mappedResponse, which Dynatrace uses for normalized display:

{
  "geo.country.iso_code": "AT",
  "reputation.level": "Unreported",
  "last_reported": null,
  "product.vendor": "AbuseIPDB",
  "report.reference": "https://www.abuseipdb.com/check/192.0.2.12"
}

3. Test your configuration

Optional

Use Test connection to verify that your enrichment connection is configured correctly and that Dynatrace can successfully call the external API.

This helps you confirm:

Next steps

After creating the connection, you can manage it in Dynatrace under Settings > Security Enrichment using the context menu. Depending on your permissions, you may see both your own connections and those shared by others, even if they don’t appear in your consumption points. If you have admin permissions, an admin banner is displayed, and you can view and edit all connections, including those not shared with you. From there, you can:

Share connections

Sharing controls who can see, use, or modify a connection in Security Enrichment and in other Dynatrace apps.

For details on sharing and permissions, see Access control for Connectors.

View enrichment results

Enrichment results appear across Investigations, Threats & Exploits, and Workflows, where you can run on‑demand enrichment to fetch live threat‑intelligence data for any observable. Dynatrace sends a request using your configured connection and displays the normalized result, giving you up‑to‑date context during triage, detection analysis, or workflow automation.

You can run on‑demand enrichment wherever observables appear in Dynatrace:

Licensing and cost

For billing information, see Events powered by Grail.

FAQ

How do I migrate from the previous AbuseIPDB or VirusTotal integrations to Security Enrichment?

After creating the connection and updating your workflows, you can use the new connection for all enrichment operations; the previous integrations are no longer used but don’t need to be deleted.

Why does my test connection fail?

A test connection usually fails for one of these reasons:

To troubleshoot:

Why don't other users see my connection?

Connections are not automatically visible to everyone.

Other users can only see and use a connection if one of these is true:

If a connection is not shared, it remains visible only to its owner. Also, access level matters:

If someone can't find your connection, open Share access and confirm that the user or group has the intended permission. For details about sharing and permission levels, see Share connections.

Why do I need to allowlist external requests?

Dynatrace needs to reach your threat‑intelligence provider to fetch enrichment data, so the provider’s domain must be allowlisted.

Why does the geolocation in enrichment results differ from Dynatrace geolocation?

Geolocation fields returned by enrichment providers (such as geo.country.iso_code, geo.country.name, and city or coordinate information when available) come directly from the external threat‑intelligence service. These values may differ from the geolocation used in Dynatrace features such as Real User Monitoring (RUM) or platform‑level geolocation.

Differences can occur because each provider uses its own geolocation database, update cycle, and mapping rules.

Why does the raw response differ from the normalized result?

The raw response is returned directly by the external API. The normalized result reflects the custom mapping you defined in Custom mapping.