Dynatrace security feeds are curated threat and vulnerability intelligence sources that Dynatrace provisions directly to your environment as lookup tables in Grail. You can query them with the DQL load command, exactly as you query your own lookup data.
Use security feeds to answer questions that the finding events alone can't answer, such as:
| Feed | File path | Content |
|---|---|---|
Dynatrace Library Vulnerability Feed |
| The library vulnerability records of the Dynatrace Vulnerability feed, a curated vulnerability intelligence source that Dynatrace Application Security uses to detect third-party vulnerabilities. |
To list the feeds available in your environment, run the following query:
fetch dt.system.files| filter startsWith(name, "/dt/security/")
The /dt/ path prefix is reserved for files that Dynatrace provisions and maintains. These files are read-only: you can't upload, overwrite, or delete them, and they don't count toward the lookup file limits of your environment. The fields of a feed can change, and a feed can be discontinued at any time. Please don't build automation that depends on a fixed schema.
Security feeds are available on Dynatrace SaaS environments running the latest generation of the Dynatrace platform.
To use Dynatrace Library Vulnerability Feed, ensure that:
If you turn off Third-party Vulnerability Analytics, Dynatrace removes the feed's lookup table from your environment. Turning the setting back on restores the table with the next feed update.
Security feeds are stored as files in Grail, so the same permission model applies as for lookup data. To read a feed, the policy bound to your user group must grant storage:files:read for the feed's path.
You can grant this with a policy statement that covers all Dynatrace security feeds:
ALLOW storage:files:read WHERE storage:file-path startsWith "/dt/security/";
Configure policies in Account Management under Identity & access management > Policy management. For details, see Permissions in Grail.
Only read access applies. The storage:files:write and storage:files:delete permissions have no effect on the /dt/ prefix, because Dynatrace manages these files.
When you query a feed from a workflow or an API client, the platform token or OAuth client you use must also carry the storage:files:read permission.
Dynatrace refreshes each feed automatically. To see the update timestamp and the metadata of the feeds you have access to, query the dt.system.files table:
fetch dt.system.files| filter startsWith(name, "/dt/security/")| fieldsKeep name, display_name, description, modified.timestamp
load "/dt/security/vulnerabilities/libraries"
Check whether the feed covers a specific vulnerability—in this example, Log4Shell (CVE-2021-44228).
load "/dt/security/vulnerabilities/libraries"| filter in("CVE-2021-44228", vulnerability.cve_ids)
Get the vulnerabilities that affect a specific package, excluding withdrawn records.
load "/dt/security/vulnerabilities/libraries"| filter in("log4j:log4j", vulnerability.package_names)| filter isNull(vulnerability.withdrawn)
Narrow the previous example down to the vulnerabilities that are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
load "/dt/security/vulnerabilities/libraries"| filter in("org.apache.struts:struts2-core", vulnerability.package_names)| filter isNull(vulnerability.withdrawn) and vulnerability.exploit.in_cisa_kev
Get the vulnerabilities whose origin source was published in the last seven days.
load "/dt/security/vulnerabilities/libraries"| filter toTimestamp(vulnerability.origin_published) > now()-7d
Add feed details to the VULNERABILITY_FINDING events in security.events with the lookup command.
fetch security.events| filter event.type == "VULNERABILITY_FINDING"| filter dt.openpipeline.source == "built-in-security-events"| filter finding.severity == "HIGH"| lookup [load "/dt/security/vulnerabilities/libraries"| fields vulnerability.id, vulnerability.cwe_ids, vulnerability.exploit.in_cisa_kev, vulnerability.aliases], sourceField: vulnerability.id, lookupField: vulnerability.id, prefix: "vuln."
Select only the fields you need in the load subquery and keep the query timeframe short. The lookup command is subject to the join limits, and a feed can hold a large number of records.
The feeds use the field names and types defined in the Semantic Dictionary. For the vulnerability namespace, see Global field reference.
To inspect the fields of a feed in your environment, load a single record:
load "/dt/security/vulnerabilities/libraries"| limit 1
Access to the Dynatrace Library Vulnerability Feed is subject to the feed usage terms of the Dynatrace Vulnerability feed. In particular, you may not copy the feed, extract it from your Dynatrace environment, or use it to build a competing offering.
Dynatrace provisions and retains the security feeds free of charge. Querying a feed outside of the Dynatrace Application Security apps generates Events powered by Grail query consumption, the same as any other lookup data in Grail. For details, see the Events powered by Grail overview.