Compliance events cover findings from compliance rule evaluations and completed compliance scans. Both Dynatrace-generated and third-party ingested data are supported.
Provides an overview of compliance events by event type.
fetch security.events| filter in(event.type, {"COMPLIANCE_FINDING", "COMPLIANCE_SCAN_COMPLETED"})| summarize {events = count()}, by: {event.type}| sort events desc
Lists the most recent compliance events across the domain.
fetch security.events| filter in(event.type, {"COMPLIANCE_FINDING", "COMPLIANCE_SCAN_COMPLETED"})| sort timestamp desc
Counts compliance events by provider and product.
fetch security.events| filter in(event.type, {"COMPLIANCE_FINDING", "COMPLIANCE_SCAN_COMPLETED"})| summarize {events = count()}, by: {event.provider, product.name}| sort events desc
A compliance finding is generated when an object—such as a cloud resource, host, or Kubernetes workload—is evaluated against a single compliance rule during a scan. The event records the rule, the compliance standard it belongs to, and the pass or fail result for that object. Compliance findings are available for both Dynatrace-generated data and findings ingested from third-party tools. A related compliance scan completed event summarizes an entire assessment once all objects have been evaluated.
Lists the most recent compliance findings.
fetch security.events| filter event.type == "COMPLIANCE_FINDING"| sort timestamp desc
Counts compliance findings by result status level.
fetch security.events| filter event.type == "COMPLIANCE_FINDING"| summarize {findings = count()}, by: {compliance.result.status.level}| sort findings desc
Counts failed compliance findings by provider.
fetch security.events| filter event.type == "COMPLIANCE_FINDING"| filter compliance.result.status.level == "FAILED"OR compliance.status == "FAILED"| summarize {failed = count()}, by: {event.provider}| sort failed desc
General event information.
| Attribute | Type | Description | Examples |
|---|---|---|---|
event.kind | string | stable Display name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission | SECURITY_EVENT |
event.type | string | stable Display name: Event typeThe unique type identifier of a given event. Tags: permission | COMPLIANCE_FINDING |
timestamp | timestamp | stable Display name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event was ingested. | 1649822520123123123 |
Information about the finding.
| Attribute | Type | Description | Examples |
|---|---|---|---|
aws.account.id | string | resource stable Display name: AWS account IDThe 12-digit number, such as 123456789012, that uniquely identifies an AWS account. Tags: permission primary-field | 123456789012 |
aws.account.name | string | resource experimental Display name: AWS account nameName associated with the AWS account. | example.com |
azure.tenant.id | string | resource experimental Display name: Azure tenant IDUnique, immutable identifier assigned to the Azure tenant. | 37c4add3-612a-483d-8b24-cccbb35d3306 |
azure.tenant.name | string | resource experimental Display name: Azure tenant nameName assigned to the Azure tenant. | MyAzureTenant |
cloud.provider | string | resource stable Display name: Cloud providerName of the cloud provider. | alibaba_cloud |
finding.id | string | stable Display name: Finding IDUnique identifier string of a finding. | F-2GJ3LSUM |
finding.time.created | timestamp | stable Display name: Finding createdTime when the finding was created. | 2024-06-24T04:47:21.154000000+02:00 |
gcp.organization.id | string | resource experimental Display name: GCP organization IDUnique, immutable identifier assigned to an organization resource. | 123456789012 |
gcp.organization.name | string | resource experimental Display name: GCP organization nameName assigned to the GCP organization. | dynatrace.com |
hypervisor.type | string | resource experimental Display name: Hypervisor typeVirtualization hypervisor identified. For physical machines, this value is empty. | KVM; VMWARE |
k8s.cluster.name | string | resource stable Display name: Kubernetes cluster nameThe user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: permission primary-field | unguard-dev; acme-prod10 |
k8s.cluster.uid | string | resource stable Display name: Kubernetes cluster UIDA pseudo-ID for the cluster, by default set to the UID of the kube-system namespace. | 1c7a24c7-ff51-46e0-bcc9-c52637ceec57 |
k8s.namespace.name | string | resource stable Display name: Kubernetes namespace nameThe name of the namespace that the pod is running in. Tags: permission primary-field | default; kube-system |
k8s.namespace.uid | string | resource experimental Display name: Kubernetes namespace UIDThe UID of the namespace. | bfb1ba44-3bcb-467d-a2dc-188fd74d1db5 |
k8s.node.name | string | resource stable Display name: Kubernetes node nameName of the node. | cluster-pool-1-c3c7423d-azth |
k8s.pod.name | string | resource stable Display name: Kubernetes pod nameThe name of the pod. | checkoutservice-7895755b94-mzs5m |
k8s.pod.uid | string | resource stable Display name: Kubernetes pod UIDThe UID of the pod. | 275ecb36-5aa8-4c2a-9c47-d8bb681b9aff |
k8s.workload.name | string | resource stable Display name: Kubernetes workload nameThe name of the workload. | checkoutservice |
k8s.workload.uid | string | resource experimental Display name: Kubernetes workload UIDThe UID of the workload. | 786a41e4-e673-44bb-bb30-18888f797a2b |
vmware.vcenter.name | string | resource experimental Display name: VMware vcenter nameName of the VMware vCenter server managing the multi-hypervisor environment. | my-vcenter.lab.dynatrace.org |
Information about the scan that generated the finding.
| Attribute | Type | Description | Examples |
|---|---|---|---|
product.name | string | experimental Name of the product that emitted the data 1 | Defender for Cloud; Sentinel; EKS; AKS; GKE; OpenShift; GuardDuty |
scan.id | string | resource experimental Unique identifier of the scan. | 00000000-0000-0000-0000-000000000000 |
Required when using product.* fields. Use the official product name as marketed by the vendor. Should be specific enough to identify the product uniquely within a vendor.
Information about the compliance rule and the compliance standard it belongs to.
| Attribute | Type | Description | Examples |
|---|---|---|---|
compliance.rule.id | string | experimental Display name: Compliance rule IDUnique identifier of a compliance rule. | CIS-66577 |
compliance.rule.metadata_json | string | experimental Any additional metadata associated with the compliance rule. | {\"Section\":\"Kubernetes - v1.9.0\",\"Recommendation ID\":\"1.2.16\",\"Recommendation section\":\"1.2 - Control Plane Components - API Server\", \"Level\":\"L1\"} |
compliance.rule.severity.level | string | experimental Display name: Compliance rule severity levelOriginal severity of a compliance rule reported by the vendor. | CRITICAL; HIGH; MEDIUM; LOW |
compliance.rule.severity.score | double | experimental Number assigned to the respective severity. For example, 10 corresponds to 'CRITICAL', 7 to 'HIGH', 4 to 'MEDIUM', and 1 to 'LOW'. | 10.0; 7.0; 4.0; 1.0 |
compliance.rule.title | string | experimental Display name: Compliance rule titleShort description of a compliance rule. | The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination |
| Attribute | Type | Description | Examples |
|---|---|---|---|
compliance.standard.name | string | experimental Display name: Compliance standard nameName of a compliance standard. | CIS Elastic Kubernetes Service (EKS) - v1.7.0; NIST SP 800-53 Revision 5.1.1 - Kubernetes |
compliance.standard.short_name | string | experimental Display name: Compliance standard short nameShort name of a compliance standard. | DISA STIG; NIST |
compliance.standard.url | string | experimental Display name: Compliance standard URLLink to the official documentation source about the compliance standard. | DISA STIG; NIST |
Information about the result of the compliance scan.
| Attribute | Type | Description | Examples |
|---|---|---|---|
aws.resource.name | string | resource stable Display name: AWS resource nameName of the resource for named resources, value of the "Name" tag in AWS for non-named resources (if unavailable, same as aws.resource.id). | my-ec2-instance |
azure.resource.id | string | resource experimental Display name: Azure resource IDA unique, immutable identifier assigned to each Azure cloud resource. | /subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks |
azure.resource.name | string | resource experimental Display name: Azure resource nameUser-provided name of the Azure cloud resource. | demo-aks |
compliance.result.description | string | experimental Display name: Compliance result descriptionDetails about the compliance result status. | Object not matching standard inclusion criteria |
compliance.result.object.evidence_json | string | experimental Display name: Compliance result object evidence JSONReasoning or evidence for the compliance status of this object. | [{\"type\":\"AUTOMATIC\",\"description\":\"Controller Manager version\",\"value\":\"1.28.0\"},{\"type\":\"AUTOMATIC\",\"description\":\"Property tls-min-version status\",\"value\":\"Not set\"}] |
compliance.result.object.name | string | deprecated Display name: Compliance result object nameName of the object evaluated for compliance. | kube-controller-manager-k8s-mst01-t12; daemonset-25qlv |
compliance.result.object.type | string | experimental Display name: Compliance result object typeType of the object evaluated for compliance. | k8scluster; k8spod; k8sservice |
compliance.result.status.level | string | experimental Display name: Compliance result status levelResult status of the given resource object as evaluated by a scan. | FAILED; PASSED; MANUAL; NOT_RELEVANT |
compliance.result.status.score | double | experimental Display name: Compliance result status scoreNumber assigned to the respective result status. For example, 10 corresponds to 'FAILED', 7 to 'MANUAL', 4 to 'PASSED', and 1 to 'NOT_RELEVANT'. | 10.0; 7.0; 4.0; 1.0 |
object.id | string | resource experimental Identifier of the affected object. | HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1 |
object.name | string | resource experimental Name of the affected object. | kube-controller-manager-k8s-mst01-t12; daemonset-25qlv |
object.type | string | resource experimental Type of the affected object. | host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE |
Fields added by Dynatrace when the affected entity is resolved in Smartscape. These fields are populated automatically during event ingest and link the finding to the Dynatrace entity model.
| Attribute | Type | Description | Examples |
|---|---|---|---|
dt.entity.cloud_application | string | resource deprecated This field is deprecated and will be removed in the future. Use dt.smartscape.k8s_deployment instead.Display name: Cloud applicationAn entity ID of an entity of type CLOUD_APPLICATION. Tags: entity-id | CLOUD_APPLICATION-3AB5BBF3E09A7942 |
dt.entity.cloud_application_instance | string | resource deprecated This field is deprecated and will be removed in the future. Use dt.smartscape.k8s_pod instead.Display name: Cloud application instanceAn entity ID of an entity of type CLOUD_APPLICATION_INSTANCE. Tags: entity-id | CLOUD_APPLICATION_INSTANCE-E0D8F94D9065F24F |
dt.entity.cloud_application_namespace | string | resource deprecated This field is deprecated and will be removed in the future. Use dt.smartscape.k8s_namespace instead.Display name: Cloud application namespaceAn entity ID of an entity of type CLOUD_APPLICATION_NAMESPACE. A CLOUD_APPLICATION_NAMESPACE is a Kubernetes namespace. Tags: entity-id | CLOUD_APPLICATION_NAMESPACE-C61324AA70F57BCB |
dt.entity.kubernetes_cluster | string | resource deprecated This field is deprecated and will be removed in the future. Use dt.smartscape.k8s_cluster instead.Display name: Kubernetes clusterAn entity ID of an entity of type KUBERNETES_CLUSTER. Tags: entity-id | KUBERNETES_CLUSTER-E0D8F94D9065F24F |
dt.entity.kubernetes_node | string | resource deprecated This field is deprecated and will be removed in the future. Use dt.smartscape.k8s_node instead.Display name: Kubernetes nodeAn entity ID of an entity of type KUBERNETES_NODE. Tags: entity-id | KUBERNETES_NODE-874C66B68CE15070 |
dt.smartscape_source.id | smartscapeId | resource stable Display name: Smartscape source IDThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1 Tags: smartscape-id | K8S_CLUSTER-E0D8F94D9065F24F; AWS_LAMBDA_FUNCTION-E0D8F94D9065F24F |
dt.smartscape_source.type | string | stable Display name: Smartscape source typeThe entity type of the entity whose identifier is held in dt.smartscape_source.id. | K8S_CLUSTER; AWS_LAMBDA_FUNCTION |
dt.source_entity | string | resource deprecated This field is deprecated and will be removed in the future. Use dt.smartscape_source.id instead.Display name: Source entityThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. 2 Tags: entity-id | HOST-E0D8F94D9065F24F; PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F |
The value of this field will be based on the value of one of the dt.smartscape.<type> fields. This means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.
The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.
A compliance finding generated by Dynatrace Security Posture Management, reporting that a Kubernetes node passed a NIST SP 800-53 rule. Dynatrace resolves the node to a Smartscape entity and adds dt.smartscape_source.* during ingest.
{"event.kind": "SECURITY_EVENT","event.type": "COMPLIANCE_FINDING","product.name": "Security Posture Management","finding.id": "8b0d367e-f160-4f20-a217-74495f885e49","finding.time.created": "2026-07-13T23:18:31.255000000Z","compliance.standard.short_name": "NIST","compliance.standard.name": "NIST SP 800-53 Revision 5.2.0 - Kubernetes","compliance.rule.id": "NIST-88103","compliance.rule.title": "Kubernetes must remove old components after updated versions have been installed","compliance.rule.severity.level": "CRITICAL","compliance.result.object.type": "k8snode","compliance.result.object.name": "ip-10-178-49-189.ec2.internal","compliance.result.status.level": "PASSED","k8s.cluster.name": "unguard-dev","k8s.cluster.uid": "1c7a24c7-ff51-46e0-bcc9-c52637ceec57","object.id": "KUBERNETES_NODE-A4FD546F75B122CB","object.type": "KUBERNETES_NODE","object.name": "ip-10-178-49-189.ec2.internal","scan.id": "ec083fbf-320d-4144-b1b8-830949fc6e0b","dt.smartscape_source.id": "KUBERNETES_NODE-A4FD546F75B122CB","dt.smartscape_source.type": "KUBERNETES_NODE"}
A compliance finding reporting that an S3 bucket failed a CIS AWS Foundations Benchmark rule, showing the evaluated object, the rule, the standard it belongs to, and the result status.
{"event.kind": "SECURITY_EVENT","event.type": "COMPLIANCE_FINDING","product.name": "Security Hub","finding.id": "718d05672dd1b8da4f278097000b01696304dc3fbf07d3be5b87d634e3588ab4","finding.time.created": "2026-04-24T13:07:50.848000000Z","compliance.standard.short_name": "CIS AWS","compliance.standard.name": "CIS Amazon Web Services Foundations Benchmark","compliance.rule.id": "2.1.2","compliance.rule.title": "Ensure S3 Bucket Policy is set to deny HTTP requests","compliance.rule.severity.level": "HIGH","compliance.result.status.level": "FAILED","compliance.result.description": "The bucket policy does not deny requests made over HTTP.","object.id": "arn:aws:s3:::guarddutytesterstack-attackbucketc9ba3df1-hjia1oepw3mr","object.type": "AWS::S3::Bucket","object.name": "guarddutytesterstack-attackbucketc9ba3df1-hjia1oepw3mr","scan.id": "6f9e2c1a-0b3d-4a2e-9f1c-2d7b8e5a4c30"}
A compliance scan completed event is generated once a compliance assessment finishes evaluating all of its objects. It summarizes the scan—the standard evaluated, the tool that ran it, and the scope of the assessment—and complements the individual compliance finding events produced during the same scan. Compliance scan completed events are available for both Dynatrace-generated data (Security Posture Management) and assessments ingested from third-party tools.
Lists the most recent completed compliance scans.
fetch security.events| filter event.type == "COMPLIANCE_SCAN_COMPLETED"| sort timestamp desc
Counts completed compliance scans by product.
fetch security.events| filter event.type == "COMPLIANCE_SCAN_COMPLETED"| summarize {scans = count()}, by: {product.name}| sort scans desc
Counts completed compliance scans by cloud provider and product.
fetch security.events| filter event.type == "COMPLIANCE_SCAN_COMPLETED"| summarize {scans = count()}, by: {cloud.provider, product.name}| sort scans desc
General event information.
| Attribute | Type | Description | Examples |
|---|---|---|---|
event.kind | string | stable Display name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission | SECURITY_EVENT |
event.type | string | stable Display name: Event typeThe unique type identifier of a given event. Tags: permission | COMPLIANCE_SCAN_COMPLETED |
timestamp | timestamp | stable Display name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event was ingested. | 1649822520123123123 |
Details about the performed compliance scan.
| Attribute | Type | Description | Examples |
|---|---|---|---|
aws.account.id | string | resource stable Display name: AWS account IDThe 12-digit number, such as 123456789012, that uniquely identifies an AWS account. Tags: permission primary-field | 123456789012 |
aws.account.name | string | resource experimental Display name: AWS account nameName associated with the AWS account. | example.com |
azure.tenant.id | string | resource experimental Display name: Azure tenant IDUnique, immutable identifier assigned to the Azure tenant. | 37c4add3-612a-483d-8b24-cccbb35d3306 |
azure.tenant.name | string | resource experimental Display name: Azure tenant nameName assigned to the Azure tenant. | MyAzureTenant |
cloud.provider | string | resource stable Display name: Cloud providerName of the cloud provider. | alibaba_cloud |
dt.entity.kubernetes_cluster | string | resource deprecated This field is deprecated and will be removed in the future. Use dt.smartscape.k8s_cluster instead.Display name: Kubernetes clusterAn entity ID of an entity of type KUBERNETES_CLUSTER. Tags: entity-id | KUBERNETES_CLUSTER-E0D8F94D9065F24F |
gcp.organization.id | string | resource experimental Display name: GCP organization IDUnique, immutable identifier assigned to an organization resource. | 123456789012 |
gcp.organization.name | string | resource experimental Display name: GCP organization nameName assigned to the GCP organization. | dynatrace.com |
hypervisor.type | string | resource experimental Display name: Hypervisor typeVirtualization hypervisor identified. For physical machines, this value is empty. | KVM; VMWARE |
k8s.cluster.name | string | resource stable Display name: Kubernetes cluster nameThe user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: permission primary-field | unguard-dev; acme-prod10 |
k8s.cluster.uid | string | resource stable Display name: Kubernetes cluster UIDA pseudo-ID for the cluster, by default set to the UID of the kube-system namespace. | 1c7a24c7-ff51-46e0-bcc9-c52637ceec57 |
object.id | string | resource experimental Identifier of the affected object. | HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1 |
object.name | string | resource experimental Name of the affected object. | kube-controller-manager-k8s-mst01-t12; daemonset-25qlv |
object.type | string | resource experimental Type of the affected object. | host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE |
product.name | string | experimental Name of the product that emitted the data 1 | Defender for Cloud; Sentinel; EKS; AKS; GKE; OpenShift; GuardDuty |
product.vendor | string | experimental Organization that owns or distributes the source system that produced the data 2 | Microsoft; Amazon; Google; Red Hat; Dynatrace; Palo Alto Networks |
product.version | string | experimental Version of the product that emitted the data 3 | 1.28.4; 6.9.2.0; 3.11; 2024.1.0 |
scan.id | string | resource experimental Unique identifier of the scan. | 00000000-0000-0000-0000-000000000000 |
scan.result.summary_json | string | resource experimental Summary of the scan results. | {"standardResultSummaries":[{"profileCode":"CIS","compliancePercentage":85}]} |
scan.time.completed | timestamp | resource experimental Time when the scan was completed. | 2024-06-24T04:47:21.154000000+02:00 |
vmware.vcenter.name | string | resource experimental Display name: VMware vcenter nameName of the VMware vCenter server managing the multi-hypervisor environment. | my-vcenter.lab.dynatrace.org |
Required when using product.* fields. Use the official product name as marketed by the vendor. Should be specific enough to identify the product uniquely within a vendor.
Required when using product.* fields. Identifies the top-level vendor regardless of how the data was ingested. For open-source projects, use the primary commercial distributor or sponsoring organization (for example, "Red Hat" for OpenShift, "Google" for GKE). For Dynatrace-produced data, use "Dynatrace".
Optional. Use the version string without a "v" prefix (for example, "1.28.4", not "v1.28.4"), consistent with other version fields in the dictionary (component.version, software_component.version). Use the version as reported by the product itself.
A compliance scan completed event generated by Dynatrace Security Posture Management, summarizing the assessment of a Kubernetes cluster against compliance rules.
{"event.kind": "SECURITY_EVENT","event.type": "COMPLIANCE_SCAN_COMPLETED","product.vendor": "Dynatrace","product.name": "Security Posture Management","scan.id": "ec083fbf-320d-4144-b1b8-830949fc6e0b","scan.time.completed": "2026-07-13T23:18:31.360000000Z","object.id": "KUBERNETES_CLUSTER-CD2312A4DE740409","object.type": "KUBERNETES_CLUSTER","object.name": "unguard-dev","k8s.cluster.name": "unguard-dev","k8s.cluster.uid": "1c7a24c7-ff51-46e0-bcc9-c52637ceec57"}