Try it free

Compliance

  • Latest Dynatrace
  • Reference

Compliance events cover findings from compliance rule evaluations and completed compliance scans. Both Dynatrace-generated and third-party ingested data are supported.

Query

Provides an overview of compliance events by event type.

fetch security.events
| filter in(event.type, {"COMPLIANCE_FINDING", "COMPLIANCE_SCAN_COMPLETED"})
| summarize {events = count()}, by: {event.type}
| sort events desc

Lists the most recent compliance events across the domain.

fetch security.events
| filter in(event.type, {"COMPLIANCE_FINDING", "COMPLIANCE_SCAN_COMPLETED"})
| sort timestamp desc

Counts compliance events by provider and product.

fetch security.events
| filter in(event.type, {"COMPLIANCE_FINDING", "COMPLIANCE_SCAN_COMPLETED"})
| summarize {events = count()}, by: {event.provider, product.name}
| sort events desc

Compliance finding

A compliance finding is generated when an object—such as a cloud resource, host, or Kubernetes workload—is evaluated against a single compliance rule during a scan. The event records the rule, the compliance standard it belongs to, and the pass or fail result for that object. Compliance findings are available for both Dynatrace-generated data and findings ingested from third-party tools. A related compliance scan completed event summarizes an entire assessment once all objects have been evaluated.

Query

Lists the most recent compliance findings.

fetch security.events
| filter event.type == "COMPLIANCE_FINDING"
| sort timestamp desc

Counts compliance findings by result status level.

fetch security.events
| filter event.type == "COMPLIANCE_FINDING"
| summarize {findings = count()}, by: {compliance.result.status.level}
| sort findings desc

Counts failed compliance findings by provider.

fetch security.events
| filter event.type == "COMPLIANCE_FINDING"
| filter compliance.result.status.level == "FAILED"
     OR compliance.status == "FAILED"
| summarize {failed = count()}, by: {event.provider}
| sort failed desc

Event data fields

General event information.

AttributeTypeDescriptionExamples

event.kind

string

stable
Display name: Event kind
Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.
Tags: permission

SECURITY_EVENT

event.type

string

stable
Display name: Event type
The unique type identifier of a given event.
Tags: permission

COMPLIANCE_FINDING

timestamp

timestamp

stable
Display name: Timestamp
The time (UNIX Epoch time in nanoseconds) when the event was ingested.

1649822520123123123

Finding data fields

Information about the finding.

AttributeTypeDescriptionExamples

aws.account.id

string

resource stable
Display name: AWS account ID
The 12-digit number, such as 123456789012, that uniquely identifies an AWS account.
Tags: permission primary-field

123456789012

aws.account.name

string

resource experimental
Display name: AWS account name
Name associated with the AWS account.

example.com

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

azure.tenant.name

string

resource experimental
Display name: Azure tenant name
Name assigned to the Azure tenant.

MyAzureTenant

cloud.provider

string

resource stable
Display name: Cloud provider
Name of the cloud provider.

alibaba_cloud

finding.id

string

stable
Display name: Finding ID
Unique identifier string of a finding.

F-2GJ3LSUM

finding.time.created

timestamp

stable
Display name: Finding created
Time when the finding was created.

2024-06-24T04:47:21.154000000+02:00

gcp.organization.id

string

resource experimental
Display name: GCP organization ID
Unique, immutable identifier assigned to an organization resource.

123456789012

gcp.organization.name

string

resource experimental
Display name: GCP organization name
Name assigned to the GCP organization.

dynatrace.com

hypervisor.type

string

resource experimental
Display name: Hypervisor type
Virtualization hypervisor identified. For physical machines, this value is empty.

KVM; VMWARE

k8s.cluster.name

string

resource stable
Display name: Kubernetes cluster name
The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable.
Tags: permission primary-field

unguard-dev; acme-prod10

k8s.cluster.uid

string

resource stable
Display name: Kubernetes cluster UID
A pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.

1c7a24c7-ff51-46e0-bcc9-c52637ceec57

k8s.namespace.name

string

resource stable
Display name: Kubernetes namespace name
The name of the namespace that the pod is running in.
Tags: permission primary-field

default; kube-system

k8s.namespace.uid

string

resource experimental
Display name: Kubernetes namespace UID
The UID of the namespace.

bfb1ba44-3bcb-467d-a2dc-188fd74d1db5

k8s.node.name

string

resource stable
Display name: Kubernetes node name
Name of the node.

cluster-pool-1-c3c7423d-azth

k8s.pod.name

string

resource stable
Display name: Kubernetes pod name
The name of the pod.

checkoutservice-7895755b94-mzs5m

k8s.pod.uid

string

resource stable
Display name: Kubernetes pod UID
The UID of the pod.

275ecb36-5aa8-4c2a-9c47-d8bb681b9aff

k8s.workload.name

string

resource stable
Display name: Kubernetes workload name
The name of the workload.

checkoutservice

k8s.workload.uid

string

resource experimental
Display name: Kubernetes workload UID
The UID of the workload.

786a41e4-e673-44bb-bb30-18888f797a2b

vmware.vcenter.name

string

resource experimental
Display name: VMware vcenter name
Name of the VMware vCenter server managing the multi-hypervisor environment.

my-vcenter.lab.dynatrace.org

Scan data fields

Information about the scan that generated the finding.

AttributeTypeDescriptionExamples

product.name

string

resource experimental
Product name.

Tenable; Snyk

scan.id

string

resource experimental
Unique identifier of the scan.

00000000-0000-0000-0000-000000000000

Rule data fields

Information about the compliance rule and the compliance standard it belongs to.

AttributeTypeDescriptionExamples

compliance.rule.id

string

experimental
Display name: Compliance rule ID
Unique identifier of a compliance rule.

CIS-66577

compliance.rule.metadata_json

string

experimental
Any additional metadata associated with the compliance rule.

{\"Section\":\"Kubernetes - v1.9.0\",\"Recommendation ID\":\"1.2.16\",\"Recommendation section\":\"1.2 - Control Plane Components - API Server\", \"Level\":\"L1\"}

compliance.rule.severity.level

string

experimental
Display name: Compliance rule severity level
Original severity of a compliance rule reported by the vendor.

CRITICAL; HIGH; MEDIUM; LOW

compliance.rule.severity.score

double

experimental
Number assigned to the respective severity. For example, 10 corresponds to 'CRITICAL', 7 to 'HIGH', 4 to 'MEDIUM', and 1 to 'LOW'.

10.0; 7.0; 4.0; 1.0

compliance.rule.title

string

experimental
Display name: Compliance rule title
Short description of a compliance rule.

The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination

Standard data fields

AttributeTypeDescriptionExamples

compliance.standard.name

string

experimental
Display name: Compliance standard name
Name of a compliance standard.

CIS Elastic Kubernetes Service (EKS) - v1.7.0; NIST SP 800-53 Revision 5.1.1 - Kubernetes

compliance.standard.short_name

string

experimental
Display name: Compliance standard short name
Short name of a compliance standard.

DISA STIG; NIST

compliance.standard.url

string

experimental
Display name: Compliance standard URL
Link to the official documentation source about the compliance standard.

DISA STIG; NIST

Result fields

Information about the result of the compliance scan.

AttributeTypeDescriptionExamples

aws.resource.name

string

resource stable
Display name: AWS resource name
Name of the resource for named resources, value of the "Name" tag in AWS for non-named resources (if unavailable, same as aws.resource.id).

my-ec2-instance

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

compliance.result.description

string

experimental
Display name: Compliance result description
Details about the compliance result status.

Object not matching standard inclusion criteria

compliance.result.object.evidence_json

string

experimental
Display name: Compliance result object evidence JSON
Reasoning or evidence for the compliance status of this object.

[{\"type\":\"AUTOMATIC\",\"description\":\"Controller Manager version\",\"value\":\"1.28.0\"},{\"type\":\"AUTOMATIC\",\"description\":\"Property tls-min-version status\",\"value\":\"Not set\"}]

compliance.result.object.name

string

deprecated
Display name: Compliance result object name
Name of the object evaluated for compliance.

kube-controller-manager-k8s-mst01-t12; daemonset-25qlv

compliance.result.object.type

string

experimental
Display name: Compliance result object type
Type of the object evaluated for compliance.

k8scluster; k8spod; k8sservice

compliance.result.status.level

string

experimental
Display name: Compliance result status level
Result status of the given resource object as evaluated by a scan.

FAILED; PASSED; MANUAL; NOT_RELEVANT

compliance.result.status.score

double

experimental
Display name: Compliance result status score
Number assigned to the respective result status. For example, 10 corresponds to 'FAILED', 7 to 'MANUAL', 4 to 'PASSED', and 1 to 'NOT_RELEVANT'.

10.0; 7.0; 4.0; 1.0

object.id

string

resource experimental
Identifier of the affected object.

HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1

object.name

string

resource experimental
Name of the affected object.

kube-controller-manager-k8s-mst01-t12; daemonset-25qlv

object.type

string

resource experimental
Type of the affected object.

host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE

Dynatrace enriched fields

Fields added by Dynatrace when the affected entity is resolved in Smartscape. These fields are populated automatically during event ingest and link the finding to the Dynatrace entity model.

AttributeTypeDescriptionExamples

dt.entity.cloud_application

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_deployment instead.
Display name: Cloud application
An entity ID of an entity of type CLOUD_APPLICATION.
Tags: entity-id

CLOUD_APPLICATION-3AB5BBF3E09A7942

dt.entity.cloud_application_instance

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_pod instead.
Display name: Cloud application instance
An entity ID of an entity of type CLOUD_APPLICATION_INSTANCE.
Tags: entity-id

CLOUD_APPLICATION_INSTANCE-E0D8F94D9065F24F

dt.entity.cloud_application_namespace

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_namespace instead.
Display name: Cloud application namespace
An entity ID of an entity of type CLOUD_APPLICATION_NAMESPACE. A CLOUD_APPLICATION_NAMESPACE is a Kubernetes namespace.
Tags: entity-id

CLOUD_APPLICATION_NAMESPACE-C61324AA70F57BCB

dt.entity.kubernetes_cluster

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_cluster instead.
Display name: Kubernetes cluster
An entity ID of an entity of type KUBERNETES_CLUSTER.
Tags: entity-id

KUBERNETES_CLUSTER-E0D8F94D9065F24F

dt.entity.kubernetes_node

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_node instead.
Display name: Kubernetes node
An entity ID of an entity of type KUBERNETES_NODE.
Tags: entity-id

KUBERNETES_NODE-874C66B68CE15070

dt.smartscape_source.id

smartscapeId

resource stable
Display name: Smartscape source ID
The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1
Tags: smartscape-id

K8S_CLUSTER-E0D8F94D9065F24F; AWS_LAMBDA_FUNCTION-E0D8F94D9065F24F

dt.smartscape_source.type

string

stable
Display name: Smartscape source type
The entity type of the entity whose identifier is held in dt.smartscape_source.id.

K8S_CLUSTER; AWS_LAMBDA_FUNCTION

dt.source_entity

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.id instead.
Display name: Source entity
The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. 2
Tags: entity-id

HOST-E0D8F94D9065F24F; PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F

1

The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.

2

The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.

Examples

Security Posture Management — NIST compliance on a Kubernetes node

A compliance finding generated by Dynatrace Security Posture Management, reporting that a Kubernetes node passed a NIST SP 800-53 rule. Dynatrace resolves the node to a Smartscape entity and adds dt.smartscape_source.* during ingest.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "COMPLIANCE_FINDING",
  "product.name": "Security Posture Management",


  "finding.id": "8b0d367e-f160-4f20-a217-74495f885e49",
  "finding.time.created": "2026-07-13T23:18:31.255000000Z",


  "compliance.standard.short_name": "NIST",
  "compliance.standard.name": "NIST SP 800-53 Revision 5.2.0 - Kubernetes",
  "compliance.rule.id": "NIST-88103",
  "compliance.rule.title": "Kubernetes must remove old components after updated versions have been installed",
  "compliance.rule.severity.level": "CRITICAL",


  "compliance.result.object.type": "k8snode",
  "compliance.result.object.name": "ip-10-178-49-189.ec2.internal",
  "compliance.result.status.level": "PASSED",


  "k8s.cluster.name": "unguard-dev",
  "k8s.cluster.uid": "1c7a24c7-ff51-46e0-bcc9-c52637ceec57",
  "object.id": "KUBERNETES_NODE-A4FD546F75B122CB",
  "object.type": "KUBERNETES_NODE",
  "object.name": "ip-10-178-49-189.ec2.internal",


  "scan.id": "ec083fbf-320d-4144-b1b8-830949fc6e0b",


  "dt.smartscape_source.id": "KUBERNETES_NODE-A4FD546F75B122CB",
  "dt.smartscape_source.type": "KUBERNETES_NODE"
}

Failed CIS rule on an AWS S3 bucket

A compliance finding reporting that an S3 bucket failed a CIS AWS Foundations Benchmark rule, showing the evaluated object, the rule, the standard it belongs to, and the result status.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "COMPLIANCE_FINDING",
  "product.name": "Security Hub",


  "finding.id": "718d05672dd1b8da4f278097000b01696304dc3fbf07d3be5b87d634e3588ab4",
  "finding.time.created": "2026-04-24T13:07:50.848000000Z",


  "compliance.standard.short_name": "CIS AWS",
  "compliance.standard.name": "CIS Amazon Web Services Foundations Benchmark",
  "compliance.rule.id": "2.1.2",
  "compliance.rule.title": "Ensure S3 Bucket Policy is set to deny HTTP requests",
  "compliance.rule.severity.level": "HIGH",


  "compliance.result.status.level": "FAILED",
  "compliance.result.description": "The bucket policy does not deny requests made over HTTP.",


  "object.id": "arn:aws:s3:::guarddutytesterstack-attackbucketc9ba3df1-hjia1oepw3mr",
  "object.type": "AWS::S3::Bucket",
  "object.name": "guarddutytesterstack-attackbucketc9ba3df1-hjia1oepw3mr",


  "scan.id": "6f9e2c1a-0b3d-4a2e-9f1c-2d7b8e5a4c30"
}

Compliance scan completed

A compliance scan completed event is generated once a compliance assessment finishes evaluating all of its objects. It summarizes the scan—the standard evaluated, the tool that ran it, and the scope of the assessment—and complements the individual compliance finding events produced during the same scan. Compliance scan completed events are available for both Dynatrace-generated data (Security Posture Management) and assessments ingested from third-party tools.

Query

Lists the most recent completed compliance scans.

fetch security.events
| filter event.type == "COMPLIANCE_SCAN_COMPLETED"
| sort timestamp desc

Counts completed compliance scans by product.

fetch security.events
| filter event.type == "COMPLIANCE_SCAN_COMPLETED"
| summarize {scans = count()}, by: {product.name}
| sort scans desc

Counts completed compliance scans by cloud provider and product.

fetch security.events
| filter event.type == "COMPLIANCE_SCAN_COMPLETED"
| summarize {scans = count()}, by: {cloud.provider, product.name}
| sort scans desc

Metadata fields

General event information.

AttributeTypeDescriptionExamples

event.kind

string

stable
Display name: Event kind
Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.
Tags: permission

SECURITY_EVENT

event.type

string

stable
Display name: Event type
The unique type identifier of a given event.
Tags: permission

COMPLIANCE_SCAN_COMPLETED

timestamp

timestamp

stable
Display name: Timestamp
The time (UNIX Epoch time in nanoseconds) when the event was ingested.

1649822520123123123

Scan info fields

Details about the performed compliance scan.

AttributeTypeDescriptionExamples

aws.account.id

string

resource stable
Display name: AWS account ID
The 12-digit number, such as 123456789012, that uniquely identifies an AWS account.
Tags: permission primary-field

123456789012

aws.account.name

string

resource experimental
Display name: AWS account name
Name associated with the AWS account.

example.com

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

azure.tenant.name

string

resource experimental
Display name: Azure tenant name
Name assigned to the Azure tenant.

MyAzureTenant

cloud.provider

string

resource stable
Display name: Cloud provider
Name of the cloud provider.

alibaba_cloud

dt.entity.kubernetes_cluster

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_cluster instead.
Display name: Kubernetes cluster
An entity ID of an entity of type KUBERNETES_CLUSTER.
Tags: entity-id

KUBERNETES_CLUSTER-E0D8F94D9065F24F

gcp.organization.id

string

resource experimental
Display name: GCP organization ID
Unique, immutable identifier assigned to an organization resource.

123456789012

gcp.organization.name

string

resource experimental
Display name: GCP organization name
Name assigned to the GCP organization.

dynatrace.com

hypervisor.type

string

resource experimental
Display name: Hypervisor type
Virtualization hypervisor identified. For physical machines, this value is empty.

KVM; VMWARE

k8s.cluster.name

string

resource stable
Display name: Kubernetes cluster name
The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable.
Tags: permission primary-field

unguard-dev; acme-prod10

k8s.cluster.uid

string

resource stable
Display name: Kubernetes cluster UID
A pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.

1c7a24c7-ff51-46e0-bcc9-c52637ceec57

object.id

string

resource experimental
Identifier of the affected object.

HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1

object.name

string

resource experimental
Name of the affected object.

kube-controller-manager-k8s-mst01-t12; daemonset-25qlv

object.type

string

resource experimental
Type of the affected object.

host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE

product.name

string

resource experimental
Product name.

Tenable; Snyk

product.vendor

string

resource experimental
Product vendor.

Tenable; Snyk

product.version

string

resource experimental
Version of the product that performed the scan.

6.9.2.0

scan.id

string

resource experimental
Unique identifier of the scan.

00000000-0000-0000-0000-000000000000

scan.result.summary_json

string

resource experimental
Summary of the scan results.

{"standardResultSummaries":[{"profileCode":"CIS","compliancePercentage":85}]}

scan.time.completed

timestamp

resource experimental
Time when the scan was completed.

2024-06-24T04:47:21.154000000+02:00

vmware.vcenter.name

string

resource experimental
Display name: VMware vcenter name
Name of the VMware vCenter server managing the multi-hypervisor environment.

my-vcenter.lab.dynatrace.org

Examples

Security Posture Management — Kubernetes cluster scan completed

A compliance scan completed event generated by Dynatrace Security Posture Management, summarizing the assessment of a Kubernetes cluster against compliance rules.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "COMPLIANCE_SCAN_COMPLETED",
  "product.vendor": "Dynatrace",
  "product.name": "Security Posture Management",


  "scan.id": "ec083fbf-320d-4144-b1b8-830949fc6e0b",
  "scan.time.completed": "2026-07-13T23:18:31.360000000Z",


  "object.id": "KUBERNETES_CLUSTER-CD2312A4DE740409",
  "object.type": "KUBERNETES_CLUSTER",
  "object.name": "unguard-dev",


  "k8s.cluster.name": "unguard-dev",
  "k8s.cluster.uid": "1c7a24c7-ff51-46e0-bcc9-c52637ceec57"
}