Try it free

Security events

  • Latest Dynatrace
  • Reference

Security events are a special type of data representing security-relevant data generated by Dynatrace, but also third-party vendors. The security events models are organized into the following subcategories:

  • Detection
  • Vulnerability
  • Compliance
  • Threat intelligence

In the security.events table, the data is separated in different buckets, depending on the origin of the data. For Dynatrace generated data, data is stored in the default_securityevents_builtin bucket, data ingested through the ingest APIs is stored in the default_securityevents bucket, unless rerouted to another bucket in OpenPipeline.

Query

Provides an overview of all security events by event type.

fetch security.events
| summarize {events = count()}, by: {event.type}
| sort events desc

Lists the most recent security events across all security event domains.

fetch security.events
| sort timestamp desc

Counts security events by provider and event type to show which sources generate which kinds of events.

fetch security.events
| summarize {events = count()}, by: {event.provider, event.type}
| sort events desc

Shared fields

The following field groups are shared across security event models.

Affected entities fields

AttributeTypeDescriptionExamples

affected_entities.affected_processes.count

long

resource stable
Number of affected processes.

50

affected_entities.count

long

resource stable
Number of affected entities.

1

affected_entities.hosts.count

long

resource stable
Number of affected hosts.

2

affected_entities.kubernetes_nodes.count

long

resource stable
Number of affected nodes.

2

affected_entities.management_zones.ids

array

resource stable
IDs of the management zones to which the affected entities belong.

mzid1

affected_entities.management_zones.names

array

resource stable
Names of the management zones to which the affected entities belong.

mz1

affected_entities.monitored_processes.count

long

resource stable
Number of processes of the process group.

100

affected_entities.previous.count

long

resource deprecated
Number of affected entities before the last change event.

1

affected_entities.previous.hosts.count

long

resource deprecated
Number of affected hosts before the last change event.

5

affected_entities.previous.kubernetes_nodes.count

long

resource deprecated
Number of affected Kubernetes nodes before the last change event.

5

affected_entities.previous.process_groups.count

long

resource deprecated
Number of affected process groups before the last change event.

2

affected_entities.process_groups.count

long

resource stable
Number of affected process groups.

2

affected_entities.types

array

resource stable
Types of affected entities.

PROCESS_GROUP; HOST; KUBERNETES_NODE

affected_entities.vulnerable_components.ids

array

resource stable
Dynatrace IDs of the vulnerable components causing the vulnerability.

SOFTWARE_COMPONENT-0000000000000001; SOFTWARE_COMPONENT-0000000000000002; SOFTWARE_COMPONENT-0000000000000003

affected_entities.vulnerable_components.names

array

resource stable
Names of the vulnerable components causing the vulnerability. |

com.fasterxml.jackson.core:jackson-databind:2.10.0; node-sass:4.14.1

affected_entities.vulnerable_functions

array

resource stable
Vulnerable functions detected, containing or causing the vulnerability.

org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)

Affected entity fields

AttributeTypeDescriptionExamples

affected_entity.affected_processes.ids

array

resource stable
IDs of the processes that are currently affected by the vulnerability.

PROCESS_GROUP_INSTANCE-1

affected_entity.affected_processes.names

array

resource stable
Names of the processes that are currently affected by the vulnerability.

prod_process_group_instance_1

affected_entity.id

string

resource stable
ID of the affected entity.

PROCESS_GROUP-1; HOST-1

affected_entity.management_zones.ids

array

resource stable
IDs of the management zones to which the affected entity belongs.

mzid1

affected_entity.management_zones.names

array

resource stable
Names of the management zones to which the affected entity belongs.

mz1

affected_entity.monitored_processes.count

long

resource stable
Number of affected processes.

100

affected_entity.name

string

resource stable
Name of the affected entity.

prod_process_group_1; prod_host

affected_entity.type

string

resource stable
Type of affected entity.

PROCESS_GROUP; HOST; KUBERNETES_NODE

affected_entity.vulnerable_component.id

string

resource stable
ID of the vulnerable component causing the vulnerability.

SOFTWARE_COMPONENT-D8FCFFB4FDF7A3FF

affected_entity.vulnerable_component.name

string

resource stable
Name of the vulnerable component causing the vulnerability.

log4j-core-2.6.2.jar

affected_entity.vulnerable_component.short_name

string

resource stable
Short name of the vulnerable component causing the vulnerability.

log4j

affected_entity.vulnerable_functions

array

resource stable
Vulnerable functions detected, containing or causing the vulnerability.

org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)

Related entities fields

AttributeTypeDescriptionExamples

related_entities.applications.count

long

resource stable
Number of related applications.

1

related_entities.applications.ids

array

resource stable
IDs of the applications related to the vulnerability's affected entities.

APPLICATION-1

related_entities.applications.names

array

resource stable
Names of the applications related to the vulnerability's affected entities.

prod_application_1

related_entities.databases.count

long

resource stable
Number of related databases.

1

related_entities.databases.ids

array

resource stable
IDs of the databases related to the vulnerability's affected entities.

DATABASE-1

related_entities.databases.names

array

resource stable
Names of the databases related to the vulnerability's affected entities.

prod_database_1

related_entities.hosts.count

long

resource stable
Number of related hosts.

1

related_entities.hosts.ids

array

resource stable
IDs of the hosts related to the vulnerability's affected entities.

HOST-1

related_entities.hosts.names

array

resource stable
Names of the hosts related to the vulnerability's affected entities.

prod_host_1

related_entities.kubernetes_clusters.count

long

resource stable
Number of related Kubernetes clusters.

1

related_entities.kubernetes_clusters.ids

array

resource stable
IDs of the Kubernetes clusters related to the vulnerability's affected entities.

KUBERNETES_CLUSTER-1

related_entities.kubernetes_clusters.names

array

resource stable
Names of the Kubernetes clusters related to the vulnerability's affected entities.

prod_kubernetes_cluster_1

related_entities.kubernetes_workloads.count

long

resource stable
Number of related Kubernetes workloads.

1

related_entities.kubernetes_workloads.ids

array

resource stable
IDs of the Kubernetes workloads related to the vulnerability's affected entities.

KUBERNETES_WORKLOAD-1

related_entities.kubernetes_workloads.names

array

resource stable
Names of the Kubernetes workloads related to the vulnerability's affected entities.

prod_kubernetes_workload_1

related_entities.previous.databases.count

long

resource deprecated
Number of related databases before the last change event.

1

related_entities.services.count

long

resource stable
Number of related services.

1

related_entities.services.ids

array

resource stable
IDs of the services related to the vulnerability's affected entities.

SERVICE-1

related_entities.services.names

array

resource stable
Names of the services related to the vulnerability's affected entities.

prod_service_1

Vulnerable component fields

AttributeTypeDescriptionExamples

vulnerable_component.name

string

resource experimental
Name of the vulnerable component causing the vulnerability.

sqlite3:3.16.2-5+deb9u3

vulnerable_component.short_name

string

resource experimental
Short name of the vulnerable component causing the vulnerability.

sqlite3

vulnerable_component.version

string

resource experimental
Version of the vulnerable component causing the vulnerability.

3.16.2-5+deb9u3

Security event fields

AttributeTypeDescriptionExamples

event.change_list

array

resource stable
List of attributes updated as part of the change event. Values in the list match a previous field.

vulnerability.risk.score; affected_entities.count; related_entities.databases.count

event.level

string

resource stable
Main reference point to which the event or data is related. Possible values are Vulnerability (shows the global aggregation across the entire environment and comprises all entities and management zones) and Entity (shows the assessment based on the entity itself).

ENTITY; VULNERABILITY

event.provider_product

string

resource stable
Name of the product providing this event.

Runtime Vulnerability Analytics; Snyk Container

event.trigger.type

string

resource stable
Type of event trigger (for example, whether it was generated by the system, ingested via API, or triggered by the user).

DT_PLATFORM; API; USER_ACTION

event.trigger.user

string

resource stable
ID of the user who triggered the event. If generated by Dynatrace, the value is SYSTEM.

SYSTEM; <api_token_id>; <user_id>

event.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

ValueDescription

ENTITY

entity

VULNERABILITY

vulnerability

Object fields

AttributeTypeDescriptionExamples

object.id

string

resource experimental
Identifier of the affected object.

HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1

object.mapping.artifact.type

string

resource experimental
This layer represents the physical object containing the issue.

CODE; CONTAINER_IMAGE; OPERATING_SYSTEM; IAM_KEY

object.mapping.component.type

string

resource experimental
This layer represents the source of the issue within the artifact.

SOFTWARE_COMPONENT; CONFIGURATION

object.mapping.resource.type

string

resource experimental
This layer represents the impacted runtime object.

CLOUD_CLUSTER; CLOUD_NODE; CONTAINER; HOST

object.name

string

resource experimental
Name of the affected object.

kube-controller-manager-k8s-mst01-t12; daemonset-25qlv

object.type

string

resource experimental
Type of the affected object.

host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE

Scan fields

AttributeTypeDescriptionExamples

scan.id

string

resource experimental
Unique identifier of the scan.

00000000-0000-0000-0000-000000000000

scan.name

string

resource experimental
Name of the scan.

US Cloud Scanner

scan.product.name

string

resource experimental
Name of the product that performed the scan.

ECR; Inspector

scan.time.completed

timestamp

resource experimental
Time when the scan was completed.

2024-06-24T04:47:21.154000000+02:00

scan.time.started

timestamp

resource experimental
Time when the scan was started.

2024-06-24T04:47:21.154000000+02:00

scan.vendor

string

resource experimental
Name of the scanner vendor that performed the scan.

AWS

Entry points fields

Resource describing entry points of a vulnerability.

AttributeTypeDescriptionExamples

entry_points

record[]

resource experimental
Entry points of a vulnerability.

['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']

entry_points.entry_point_jsons

string[]

resource deprecatedUse entry_points instead.
JSON representation of entry points of a vulnerability.

['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs_json": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']

Product fields

Product from which the data was collected, in case the data came from an integration with a third-party product.

AttributeTypeDescriptionExamples

product.feature

string

resource experimental
The feature of the product that performed the scan.

Third-party Vulnerability Analytics; Code-level Vulnerability Analytics

product.name

string

resource experimental
Product name.

Tenable; Snyk

product.vendor

string

resource experimental
Product vendor.

Tenable; Snyk

product.version

string

resource experimental
Version of the product that performed the scan.

6.9.2.0

Sink code fields

The individual parts of an application where data from entry points ends up, potentially causing a vulnerability to be exploited.

AttributeTypeDescriptionExamples

sink.code.function

string

resource experimental
Name of the function that executes the command, query, or similar with tainted parameters.

executeQuery

sink.code.namespace

string

resource experimental
Namespace of the sink code function.

com.mysql.jdbc.Statement

sink.code.parameter_types

array

resource experimental
Parameter types as defined in the method signature of the sink code function, which help distinguish in case of method overloads. For example, for a method with the executeQuery(String sql) signature, the parameter types would be ["String"].

[String]

Security events Smartscape fields

Shared Smartscape fields for security events.

AttributeTypeDescriptionExamples

dt.smartscape_source.type

string

stable
Display name: Smartscape source type
The entity type of the entity whose identifier is held in dt.smartscape_source.id.

K8S_CLUSTER; AWS_LAMBDA_FUNCTION

Related tags
Application Security