Threats & Exploits

Threats & Exploits streamlines the triage of security findings, offering an up-to-date view of the application security threat landscape enhanced by Dynatrace deep observability. It helps you immediately detect zero-day vulnerabilities and take defensive measures to protect against exploitation.

1 of 5

To get started

Once you open Threats & Exploits , you can see the list of findings from your ingested data.

Learning modules

Understand essential concepts and key terms used in the Threats & Exploits app.

Exploits

Any request (call) from a certain client IP to your application code with malicious intent (for example, to access or delete protected information with SQL injection) targeting a code-level vulnerability.

Action

The action taken by the monitoring authority as a response of a detection. In the case of Dynatrace-monitored environments, the action taken by Runtime Application Protection (RAP action).

Actor IP

The client IP address from which the request originated.

• Example: 10.9.3.4

Target

The attacked host, service, or database.

• Example: HOST-IG-1-5001

Affected object

The object that is affected by an exploit (for Dynatrace-monitored findings, the process).

• Example: BloatedDotNetSoftwareGroup-IG-1

Entry point

A point in the code where an attacker could enter the application, for example, by passing user input fields to the application (such as a login form or search bar).

Entry point function

The function where the malicious payload was accessed in the attacked process.

• Example: System.Data.SqlClient.SqlCommand.ExecuteReader()

URL path

The path used in the HTTP request to reach and potentially exploit the vulnerability.

• Example: /user/1218/bio

User-controlled input

The input used to exploit the vulnerability. If there's a key for the input (for example, an HTTP parameter name or an HTTP header name), it's displayed after the colon.

• Example: HTTP parameter value: bioText

HTTP headers and parameters

The HTTP headers and parameters of the request. Only the HTTP parameters used in the vulnerable functions are listed. Some headers identify the originating (client) IP address when a client connects to a web server through an HTTP proxy, a CDN, or a load balancer. The headers for identifying the client IP address aren't configurable.

Code location

Shows where the actual vulnerability is in the code (the location where the vulnerable function is called from).

• Example: SQL injection at DatabaseManager.updateBio():82

Vulnerable function

The function that used a part of the attacker's payload, which resulted in the exploitation of the vulnerability.

• Example: System.Data.SqlClient.SqlCommand.ExecuteReader()