Try it free

Compliance

  • Latest Dynatrace
  • Reference

Compliance events cover findings from compliance rule evaluations and completed compliance scans. Both Dynatrace-generated and third-party ingested data are supported.

Compliance finding

A compliance finding event is generated when an object is evaluated against a compliance rule during a scan. The event contains the results of this evaluation and the compliance status of the given object.

Query

Lists the most recent compliance findings.

fetch security.events
| filter event.type == "COMPLIANCE_FINDING"
| sort timestamp desc

Counts compliance findings by result status level.

fetch security.events
| filter event.type == "COMPLIANCE_FINDING"
| summarize {findings = count()}, by: {compliance.result.status.level}
| sort findings desc

Event data fields

General event information.

AttributeTypeDescriptionExamples

event.kind

string

stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission

SECURITY_EVENT

event.type

string

stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission

COMPLIANCE_FINDING

timestamp

timestamp

stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event was ingested.

1649822520123123123

Finding data fields

Information about the finding.

AttributeTypeDescriptionExamples

aws.account.id

string

resource stableDisplay name: AWS account IDThe 12-digit number, such as 123456789012, that uniquely identifies an AWS account.Tags: permission primary-field

123456789012

aws.account.name

string

resource experimentalDisplay name: AWS account nameName associated with the AWS account.

example.com

azure.tenant.id

string

resource experimentalDisplay name: Azure tenant IDUnique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

azure.tenant.name

string

resource experimentalDisplay name: Azure tenant nameName assigned to the Azure tenant.

MyAzureTenant

cloud.provider

string

resource stableDisplay name: Cloud providerName of the cloud provider.

alibaba_cloud

finding.id

string

stableDisplay name: Finding IDUnique identifier string of a finding.

F-2GJ3LSUM

finding.time.created

timestamp

stableDisplay name: Finding createdTime when the finding was created.

2024-06-24T04:47:21.154000000+02:00

gcp.organization.id

string

resource experimentalDisplay name: GCP organization IDUnique, immutable identifier assigned to an organization resource.

123456789012

gcp.organization.name

string

resource experimentalDisplay name: GCP organization nameName assigned to the GCP organization.

dynatrace.com

hypervisor.type

string

resource experimentalDisplay name: Hypervisor typeVirtualization hypervisor identified. For physical machines, this value is empty.

KVM; VMWARE

k8s.cluster.name

string

resource stableDisplay name: Kubernetes cluster nameThe user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable.Tags: permission primary-field

unguard-dev; acme-prod10

k8s.cluster.uid

string

resource stableDisplay name: Kubernetes cluster UIDA pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.

1c7a24c7-ff51-46e0-bcc9-c52637ceec57

k8s.namespace.name

string

resource stableDisplay name: Kubernetes namespace nameThe name of the namespace that the pod is running in.Tags: permission primary-field

default; kube-system

k8s.namespace.uid

string

resource experimentalDisplay name: Kubernetes namespace UIDThe UID of the namespace.

bfb1ba44-3bcb-467d-a2dc-188fd74d1db5

k8s.node.name

string

resource stableDisplay name: Kubernetes node nameName of the node.

cluster-pool-1-c3c7423d-azth

k8s.pod.name

string

resource stableDisplay name: Kubernetes pod nameThe name of the pod.

checkoutservice-7895755b94-mzs5m

k8s.pod.uid

string

resource stableDisplay name: Kubernetes pod UIDThe UID of the pod.

275ecb36-5aa8-4c2a-9c47-d8bb681b9aff

k8s.workload.name

string

resource stableDisplay name: Kubernetes workload nameThe name of the workload.

checkoutservice

k8s.workload.uid

string

resource experimentalDisplay name: Kubernetes workload UIDThe UID of the workload.

786a41e4-e673-44bb-bb30-18888f797a2b

vmware.vcenter.name

string

resource experimentalDisplay name: VMware vcenter nameName of the VMware vCenter server managing the multi-hypervisor environment.

my-vcenter.lab.dynatrace.org

Scan data fields

Information about the scan that generated the finding.

AttributeTypeDescriptionExamples

product.name

string

resource experimentalProduct name.

Tenable; Snyk

scan.id

string

resource experimentalUnique identifier of the scan.

00000000-0000-0000-0000-000000000000

Rule data fields

Information about the compliance rule and the compliance standard it belongs to.

AttributeTypeDescriptionExamples

compliance.rule.id

string

experimentalDisplay name: Compliance rule IDUnique identifier of a compliance rule.

CIS-66577

compliance.rule.metadata_json

string

experimentalAny additional metadata associated with the compliance rule.

{\"Section\":\"Kubernetes - v1.9.0\",\"Recommendation ID\":\"1.2.16\",\"Recommendation section\":\"1.2 - Control Plane Components - API Server\", \"Level\":\"L1\"}

compliance.rule.severity.level

string

experimentalDisplay name: Compliance rule severity levelOriginal severity of a compliance rule reported by the vendor.

CRITICAL; HIGH; MEDIUM; LOW

compliance.rule.severity.score

double

experimentalNumber assigned to the respective severity. For example, 10 corresponds to 'CRITICAL', 7 to 'HIGH', 4 to 'MEDIUM', and 1 to 'LOW'.

10.0; 7.0; 4.0; 1.0

compliance.rule.title

string

experimentalDisplay name: Compliance rule titleShort description of a compliance rule.

The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination

Standard data fields

AttributeTypeDescriptionExamples

compliance.standard.name

string

experimentalDisplay name: Compliance standard nameName of a compliance standard.

CIS Elastic Kubernetes Service (EKS) - v1.7.0; NIST SP 800-53 Revision 5.1.1 - Kubernetes

compliance.standard.short_name

string

experimentalDisplay name: Compliance standard short nameShort name of a compliance standard.

DISA STIG; NIST

compliance.standard.url

string

experimentalDisplay name: Compliance standard URLLink to the official documentation source about the compliance standard.

DISA STIG; NIST

Result fields

Information about the result of the compliance scan.

AttributeTypeDescriptionExamples

aws.resource.name

string

resource stableDisplay name: AWS resource nameName of the resource for named resources, value of the "Name" tag in AWS for non-named resources (if unavailable, same as aws.resource.id).

my-ec2-instance

azure.resource.id

string

resource experimentalDisplay name: Azure resource IDA unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimentalDisplay name: Azure resource nameUser-provided name of the Azure cloud resource.

demo-aks

compliance.result.description

string

experimentalDisplay name: Compliance result descriptionDetails about the compliance result status.

Object not matching standard inclusion criteria

compliance.result.object.evidence_json

string

experimentalDisplay name: Compliance result object evidence JSONReasoning or evidence for the compliance status of this object.

[{\"type\":\"AUTOMATIC\",\"description\":\"Controller Manager version\",\"value\":\"1.28.0\"},{\"type\":\"AUTOMATIC\",\"description\":\"Property tls-min-version status\",\"value\":\"Not set\"}]

compliance.result.object.name

string

deprecatedDisplay name: Compliance result object nameName of the object evaluated for compliance.

kube-controller-manager-k8s-mst01-t12; daemonset-25qlv

compliance.result.object.type

string

experimentalDisplay name: Compliance result object typeType of the object evaluated for compliance.

k8scluster; k8spod; k8sservice

compliance.result.status.level

string

experimentalDisplay name: Compliance result status levelResult status of the given resource object as evaluated by a scan.

FAILED; PASSED; MANUAL; NOT_RELEVANT

compliance.result.status.score

double

experimentalDisplay name: Compliance result status scoreNumber assigned to the respective result status. For example, 10 corresponds to 'FAILED', 7 to 'MANUAL', 4 to 'PASSED', and 1 to 'NOT_RELEVANT'.

10.0; 7.0; 4.0; 1.0

object.id

string

resource experimentalIdentifier of the affected object.

HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1

object.name

string

resource experimentalName of the affected object.

kube-controller-manager-k8s-mst01-t12; daemonset-25qlv

object.type

string

resource experimentalType of the affected object.

host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE

Dynatrace enriched fields

Fields added by Dynatrace when the affected entity is resolved in Smartscape. These fields are populated automatically during event ingest and link the finding to the Dynatrace entity model.

AttributeTypeDescriptionExamples

dt.entity.cloud_application

string

resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_deployment instead.**Display name: Cloud applicationAn entity ID of an entity of type CLOUD_APPLICATION.Tags: entity-id

CLOUD_APPLICATION-3AB5BBF3E09A7942

dt.entity.cloud_application_instance

string

resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_pod instead.**Display name: Cloud application instanceAn entity ID of an entity of type CLOUD_APPLICATION_INSTANCE.Tags: entity-id

CLOUD_APPLICATION_INSTANCE-E0D8F94D9065F24F

dt.entity.cloud_application_namespace

string

resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_namespace instead.**Display name: Cloud application namespaceAn entity ID of an entity of type CLOUD_APPLICATION_NAMESPACE. A CLOUD_APPLICATION_NAMESPACE is a Kubernetes namespace.Tags: entity-id

CLOUD_APPLICATION_NAMESPACE-C61324AA70F57BCB

dt.entity.kubernetes_cluster

string

resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_cluster instead.**Display name: Kubernetes clusterAn entity ID of an entity of type KUBERNETES_CLUSTER.Tags: entity-id

KUBERNETES_CLUSTER-E0D8F94D9065F24F

dt.entity.kubernetes_node

string

resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_node instead.**Display name: Kubernetes nodeAn entity ID of an entity of type KUBERNETES_NODE.Tags: entity-id

KUBERNETES_NODE-874C66B68CE15070

dt.smartscape_source.id

smartscapeId

resource stableDisplay name: Smartscape source IDThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1Tags: smartscape-id

K8S_CLUSTER-E0D8F94D9065F24F; AWS_LAMBDA_FUNCTION-E0D8F94D9065F24F

dt.smartscape_source.type

string

stableDisplay name: Smartscape source typeThe entity type of the entity whose identifier is held in dt.smartscape_source.id.

K8S_CLUSTER; AWS_LAMBDA_FUNCTION

dt.source_entity

string

resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.id instead.**Display name: Source entityThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. 2Tags: entity-id

HOST-E0D8F94D9065F24F; PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F

1

The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.

2

The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.

Concept

A compliance finding is generated when an object—such as a cloud resource, host, or Kubernetes workload—is evaluated against a single compliance rule during a scan. The event records the rule, the compliance standard it belongs to, and the pass or fail result for that object. Compliance findings are available for both Dynatrace-generated data and findings ingested from third-party tools.

A related compliance scan completed event summarizes an entire assessment once all objects have been evaluated.

Examples

Security Posture Management — NIST compliance on a Kubernetes node

A compliance finding generated by Dynatrace Security Posture Management, reporting that a Kubernetes node passed a NIST SP 800-53 rule. Dynatrace resolves the node to a Smartscape entity and adds dt.smartscape_source.* during ingest.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "COMPLIANCE_FINDING",
  "product.name": "Security Posture Management",


  "finding.id": "8b0d367e-f160-4f20-a217-74495f885e49",
  "finding.time.created": "2026-07-13T23:18:31.255000000Z",


  "compliance.standard.short_name": "NIST",
  "compliance.standard.name": "NIST SP 800-53 Revision 5.2.0 - Kubernetes",
  "compliance.rule.id": "NIST-88103",
  "compliance.rule.title": "Kubernetes must remove old components after updated versions have been installed",
  "compliance.rule.severity.level": "CRITICAL",


  "compliance.result.object.type": "k8snode",
  "compliance.result.object.name": "ip-10-178-49-189.ec2.internal",
  "compliance.result.status.level": "PASSED",


  "k8s.cluster.name": "unguard-dev",
  "k8s.cluster.uid": "1c7a24c7-ff51-46e0-bcc9-c52637ceec57",
  "object.id": "KUBERNETES_NODE-A4FD546F75B122CB",
  "object.type": "KUBERNETES_NODE",
  "object.name": "ip-10-178-49-189.ec2.internal",


  "scan.id": "ec083fbf-320d-4144-b1b8-830949fc6e0b",


  "dt.smartscape_source.id": "KUBERNETES_NODE-A4FD546F75B122CB",
  "dt.smartscape_source.type": "KUBERNETES_NODE"
}

Failed CIS rule on an AWS S3 bucket

A compliance finding reporting that an S3 bucket failed a CIS AWS Foundations Benchmark rule, showing the evaluated object, the rule, the standard it belongs to, and the result status.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "COMPLIANCE_FINDING",
  "product.name": "Security Hub",


  "finding.id": "718d05672dd1b8da4f278097000b01696304dc3fbf07d3be5b87d634e3588ab4",
  "finding.time.created": "2026-04-24T13:07:50.848000000Z",


  "compliance.standard.short_name": "CIS AWS",
  "compliance.standard.name": "CIS Amazon Web Services Foundations Benchmark",
  "compliance.rule.id": "2.1.2",
  "compliance.rule.title": "Ensure S3 Bucket Policy is set to deny HTTP requests",
  "compliance.rule.severity.level": "HIGH",


  "compliance.result.status.level": "FAILED",
  "compliance.result.description": "The bucket policy does not deny requests made over HTTP.",


  "object.id": "arn:aws:s3:::guarddutytesterstack-attackbucketc9ba3df1-hjia1oepw3mr",
  "object.type": "AWS::S3::Bucket",
  "object.name": "guarddutytesterstack-attackbucketc9ba3df1-hjia1oepw3mr",


  "scan.id": "6f9e2c1a-0b3d-4a2e-9f1c-2d7b8e5a4c30"
}

Compliance scan completed

A compliance scan completed event is generated when a scan of a configuration dataset against compliance rules is completed.

Query

Lists the most recent completed compliance scans.

fetch security.events
| filter event.type == "COMPLIANCE_SCAN_COMPLETED"
| sort timestamp desc

Counts completed compliance scans by product.

fetch security.events
| filter event.type == "COMPLIANCE_SCAN_COMPLETED"
| summarize {scans = count()}, by: {product.name}
| sort scans desc

Metadata fields

General event information.

AttributeTypeDescriptionExamples

event.kind

string

stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission

SECURITY_EVENT

event.type

string

stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission

COMPLIANCE_SCAN_COMPLETED

timestamp

timestamp

stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event was ingested.

1649822520123123123

Scan info fields

Details about the performed compliance scan.

AttributeTypeDescriptionExamples

aws.account.id

string

resource stableDisplay name: AWS account IDThe 12-digit number, such as 123456789012, that uniquely identifies an AWS account.Tags: permission primary-field

123456789012

aws.account.name

string

resource experimentalDisplay name: AWS account nameName associated with the AWS account.

example.com

azure.tenant.id

string

resource experimentalDisplay name: Azure tenant IDUnique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

azure.tenant.name

string

resource experimentalDisplay name: Azure tenant nameName assigned to the Azure tenant.

MyAzureTenant

cloud.provider

string

resource stableDisplay name: Cloud providerName of the cloud provider.

alibaba_cloud

dt.entity.kubernetes_cluster

string

resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_cluster instead.**Display name: Kubernetes clusterAn entity ID of an entity of type KUBERNETES_CLUSTER.Tags: entity-id

KUBERNETES_CLUSTER-E0D8F94D9065F24F

gcp.organization.id

string

resource experimentalDisplay name: GCP organization IDUnique, immutable identifier assigned to an organization resource.

123456789012

gcp.organization.name

string

resource experimentalDisplay name: GCP organization nameName assigned to the GCP organization.

dynatrace.com

hypervisor.type

string

resource experimentalDisplay name: Hypervisor typeVirtualization hypervisor identified. For physical machines, this value is empty.

KVM; VMWARE

k8s.cluster.name

string

resource stableDisplay name: Kubernetes cluster nameThe user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable.Tags: permission primary-field

unguard-dev; acme-prod10

k8s.cluster.uid

string

resource stableDisplay name: Kubernetes cluster UIDA pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.

1c7a24c7-ff51-46e0-bcc9-c52637ceec57

object.id

string

resource experimentalIdentifier of the affected object.

HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1

object.name

string

resource experimentalName of the affected object.

kube-controller-manager-k8s-mst01-t12; daemonset-25qlv

object.type

string

resource experimentalType of the affected object.

host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE

product.name

string

resource experimentalProduct name.

Tenable; Snyk

product.vendor

string

resource experimentalProduct vendor.

Tenable; Snyk

product.version

string

resource experimentalVersion of the product that performed the scan.

6.9.2.0

scan.id

string

resource experimentalUnique identifier of the scan.

00000000-0000-0000-0000-000000000000

scan.result.summary_json

string

resource experimentalSummary of the scan results.

{"standardResultSummaries":[{"profileCode":"CIS","compliancePercentage":85}]}

scan.time.completed

timestamp

resource experimentalTime when the scan was completed.

2024-06-24T04:47:21.154000000+02:00

vmware.vcenter.name

string

resource experimentalDisplay name: VMware vcenter nameName of the VMware vCenter server managing the multi-hypervisor environment.

my-vcenter.lab.dynatrace.org

Examples

Security Posture Management — Kubernetes cluster scan completed

A compliance scan completed event generated by Dynatrace Security Posture Management, summarizing the assessment of a Kubernetes cluster against compliance rules.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "COMPLIANCE_SCAN_COMPLETED",
  "product.vendor": "Dynatrace",
  "product.name": "Security Posture Management",


  "scan.id": "ec083fbf-320d-4144-b1b8-830949fc6e0b",
  "scan.time.completed": "2026-07-13T23:18:31.360000000Z",


  "object.id": "KUBERNETES_CLUSTER-CD2312A4DE740409",
  "object.type": "KUBERNETES_CLUSTER",
  "object.name": "unguard-dev",


  "k8s.cluster.name": "unguard-dev",
  "k8s.cluster.uid": "1c7a24c7-ff51-46e0-bcc9-c52637ceec57"
}