Try it free

Detection

  • Latest Dynatrace
  • Reference

Detection finding events represent alerts or detections generated by security tools or Dynatrace detection rules. Detections are available for both Dynatrace-generated and third-party ingested data.

Query

Provides an overview of detection findings by normalized risk level.

fetch security.events
| filter event.type == "DETECTION_FINDING"
| summarize {findings = count()}, by: {dt.security.risk.level}
| sort findings desc

Lists the most recent detection findings across the domain.

fetch security.events
| filter event.type == "DETECTION_FINDING"
| sort timestamp desc

Counts detection findings by provider and product.

fetch security.events
| filter event.type == "DETECTION_FINDING"
| summarize {findings = count()}, by: {event.provider, product.name}
| sort findings desc

Detection finding

A detection finding is an alert raised by a security tool or a Dynatrace detection rule when it observes suspicious or malicious activity—for example, an exploit attempt, a policy violation, or anomalous behavior. Detection findings are available for both Dynatrace-generated data and findings ingested from third-party security tools, and are primarily consumed in the Threats & Exploits app. Unlike a vulnerability finding, which reports a known weakness in a scanned object, a detection finding reports activity that was observed. Native Dynatrace findings (produced by the Automated Detections capability) additionally carry detection.* fields (the configured detection strategy) and scan.* fields (the scan that produced them); ingested third-party findings do not.

Query

Lists the most recent detection findings.

fetch security.events
| filter event.type == "DETECTION_FINDING"
| sort timestamp desc

Counts detection findings by normalized risk level.

fetch security.events
| filter event.type == "DETECTION_FINDING"
| summarize {findings = count()}, by: {dt.security.risk.level}
| sort findings desc

Counts critical and high detection findings by finding type and risk level.

fetch security.events
| filter event.type == "DETECTION_FINDING"
| filter in(dt.security.risk.level, {"CRITICAL", "HIGH"})
| summarize {findings = count()}, by: {finding.type, dt.security.risk.level}
| sort findings desc

Event metadata

Core event metadata. These fields identify the event record and are added automatically by Dynatrace during ingest.

AttributeTypeDescriptionExamples

event.id

string

stable
Display name: Event ID
In combination with timestamp, this field uniquely identifies a specific event.

1669863368163_07755297913417681159

event.kind

string

stable
Display name: Event kind
Describes the general nature of the event, without detailing the event's specific contents. It helps to determine the record type of a raw event.
Tags: permission

SECURITY_EVENT

event.type

string

stable
Display name: Event type
The unique type identifier of a given event.
Tags: permission

DETECTION_FINDING

timestamp

timestamp

stable
Display name: Timestamp
Time (UNIX Epoch time in nanoseconds) when the event was ingested.

1649822520123123123

Finding fields

Information about the security finding.

AttributeTypeDescriptionExamples

finding.id

string

stable
Display name: Finding ID
Unique identifier string of a finding.

A-2GJ3LSUM; arn:aws:guardduty:us-east-1:124381674733:detector/14c0550905ccbe6e5d5455071c73c1e5/finding/5c3665bd5af0488e94f482fc549a37c1

finding.time.created

timestamp

stable
Display name: Finding created
Time when the finding was created.

2024-06-24T04:47:21.154000000+02:00

finding.title

string

stable
Display name: Finding title
Title or summary of the finding.

Title of finding

finding.type

string

stable
Display name: Finding type
Original type of the finding reported by the vendor.

SQL injection; Command injection; JNDI injection; SSRF; TTPs/Execution/Execution:Runtime-SuspiciousShellCreated

Affected object fields

Information about the object in which the detection finding was raised.

AttributeTypeDescriptionExamples

object.id

string

resource experimental
Identifier of the affected object. Either this or object.name has to be set.

HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1

object.name

string

resource experimental
Name of the affected object. Either this or object.id has to be set.

kube-controller-manager-k8s-mst01-t12; daemonset-25qlv

object.type

string

resource experimental
Type of the affected object.

host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE

Source and product fields

Information about the product or tool that raised the detection finding.

AttributeTypeDescriptionExamples

event.provider

string

stable
Display name: Event provider
Source of the event, for example, the name of the component or system that generated the event.
Tags: permission

OneAgent; AWS Security Hub; Amazon GuardDuty

product.name

string

resource experimental
Product name.

Runtime Application Protection; GuardDuty

product.vendor

string

resource experimental
Product vendor.

Dynatrace; Amazon

Optional fields

Optional fields for detection findings (their existence in an event does not influence if they're displayed in T&E or not).

AttributeTypeDescriptionExamples

event.end

string

stable
Display name: Event end
Timestamp of latest activity associated with this finding in UTC (given in Grail preferred Linux timestamp nano precision format).

1757405399

event.start

string

stable
Display name: Event start
Timestamp of earliest activity associated with this finding in UTC (given in Grail preferred Linux timestamp nano precision format).

1757405398

threat.attack.subtechnique.ids

string[]

experimental
MITRE ATT&CK sub-technique identifiers for this detection, in T{parent}.{sub} dotted format. Independent of threat.attack.technique.ids—no positional alignment is assumed or required. The parent technique is encoded in the sub-technique ID itself, for example, T1059.003 belongs to technique T1059). Omit when no sub-technique information is available; don't use empty string placeholders. Sub-technique names are derivable from IDs via the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.subtechnique.ids, "T1059.003")

['T1059.003']; ['T1059.003', 'T1078.002']

threat.attack.subtechnique.names

string[]

experimental
Human-readable names of the MITRE ATT&CK sub-techniques for this detection. Optional companion to threat.attack.subtechnique.ids. When populated, elements must correspond positionally to threat.attack.subtechnique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide sub-technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.

['Windows Command Shell']; ['Windows Command Shell', 'Domain Accounts']

threat.attack.tactic.ids

string[]

experimental
MITRE ATT&CK tactic identifiers for this detection, in TA-prefixed format. A detection may map to zero or more tactics. Omit or set to an empty array when tactic information is unavailable from the producing source. Tactic names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.tactic.ids, "TA0002")

['TA0002']; ['TA0002', 'TA0004']

threat.attack.tactic.names

string[]

experimental
Human-readable names of the MITRE ATT&CK tactics for this detection. Optional companion to threat.attack.tactic.ids. When populated, elements must correspond positionally to threat.attack.tactic.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide tactic names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.

['Execution']; ['Execution', 'Privilege Escalation']

threat.attack.technique.ids

string[]

experimental
MITRE ATT&CK technique identifiers for this detection, in T-prefixed format. A detection may map to zero or more techniques. The primary pivot field for ATT&CK heat maps and technique coverage dashboards. Technique names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.technique.ids, "T1059")

['T1059']; ['T1059', 'T1078']

threat.attack.technique.names

string[]

experimental
Human-readable names of the MITRE ATT&CK techniques for this detection. Optional companion to threat.attack.technique.ids. When populated, elements must correspond positionally to threat.attack.technique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.

['Command and Scripting Interpreter']; ['Command and Scripting Interpreter', 'Valid Accounts']

threat.attack.version

string

experimental
Version of the MITRE ATT&CK framework used to classify this detection. Useful for audit and reproducibility, since tactic and technique IDs can be added or renumbered across major ATT&CK versions. Some producers don't embed the framework version in their event payloads; omit when version provenance can't be reliably determined. Use bare version numbers without a "v" prefix.

14.1; 15.1; 16.0

Dynatrace enriched fields

Fields added by Dynatrace to normalize and enrich the finding with platform-level risk assessment and Smartscape entity resolution.

AttributeTypeDescriptionExamples

dt.security.risk.level

string

stable
Display name: Security risk level
Risk score level, mapped and normalized by Dynatrace.

LOW; MEDIUM; HIGH; CRITICAL; NONE; NOT_AVAILABLE

dt.smartscape_source.id

smartscapeId

resource stable
Display name: Smartscape source ID
The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1
Tags: smartscape-id

K8S_CLUSTER-E0D8F94D9065F24F; AWS_LAMBDA_FUNCTION-E0D8F94D9065F24F

dt.smartscape_source.type

string

stable
Display name: Smartscape source type
The entity type of the entity whose identifier is held in dt.smartscape_source.id.

K8S_CLUSTER; AWS_LAMBDA_FUNCTION

1

The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.

Examples

Runtime Application Protection — SQL injection blocked

A detection finding generated by Dynatrace Runtime Application Protection, reporting a blocked SQL injection attempt against a Node.js process. Dynatrace resolves the targeted process to a Smartscape entity and adds dt.smartscape_source.* during ingest.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "DETECTION_FINDING",
  "event.provider": "OneAgent",
  "product.vendor": "Dynatrace",
  "product.name": "Runtime Application Protection",


  "finding.id": "A-35VEHCHS",
  "finding.title": "Blocked SQL injection attempt at Query.ErrorPacket() (Query.js:83:17)",
  "finding.type": "SQL injection",
  "finding.action": "denied",
  "finding.time.created": "2026-07-14T18:07:39.274000000Z",
  "dt.security.risk.level": "CRITICAL",


  "object.id": "PROCESS-87234EE293F14F76",
  "object.type": "PROCESS",
  "object.name": "BloatedNodeJsSoftwareGroup-IG-1",


  "dt.smartscape_source.id": "PROCESS-87234EE293F14F76",
  "dt.smartscape_source.type": "PROCESS"
}

Akamai SIEM—cross-site scripting attack

A detection finding ingested from Akamai SIEM reporting a cross-site scripting attempt against a web endpoint, showing the finding metadata, the affected object (the targeted URL), and the normalized Dynatrace risk level.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "DETECTION_FINDING",
  "event.provider": "Akamai",
  "product.vendor": "Akamai",
  "product.name": "Akamai SIEM",


  "finding.id": "1753176775716859162-86508-3000110-",
  "finding.title": "Cross-site Scripting (XSS) Attack (SmartDetect)",
  "finding.type": "Cross-site scripting",
  "finding.action": "observed",
  "finding.time.created": "2026-04-24T13:19:00.959138000Z",
  "dt.security.risk.level": "MEDIUM",


  "detection.analytic.name": "Cross-site Scripting (XSS) Attack (SmartDetect)",
  "detection.analytic.type": "Rule",


  "object.id": "atlas-int-01-channel-api.sampledomain.com:443/authz/v2/token",
  "object.type": "URL",
  "object.name": "atlas-int-01-channel-api.sampledomain.com:443/authz/v2/token"
}

Automated Detections—brute force login attempts (native, with executed query)

A native finding produced by the Automated Detections capability (a scheduled DQL detection). In addition to the finding metadata, it carries the native detection.* strategy, the detection.analytic.* classification, the scan.* correlation key, and—because the detection has findingEventIncludeExecutedQuery enabled—the per-finding drilldown query fields (finding.query.*, finding.drilldowns). Correlate with the corresponding detection scan event via scan.id.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "DETECTION_FINDING",
  "event.provider": "Dynatrace Automated Detections",
  "product.vendor": "Dynatrace",
  "product.name": "Automated Detections",


  "finding.id": "A-4KQ2ZP1M",
  "finding.title": "Brute force login attempts against admin on host prod-web-01",
  "finding.type": "Brute force",
  "finding.action": "observed",
  "finding.time.created": "2026-07-14T18:07:39.274000000Z",
  "dt.security.risk.level": "HIGH",


  "detection.id": "5fd01409-c65b-4d93-8fc5-340259c288df",
  "detection.name": "Brute Force Login Attempts",
  "detection.description": "Detects repeated failed authentication attempts against a single user account from the same source IP within a short window.",
  "detection.owner.id": "team-security-ops",


  "detection.analytic.name": "Brute Force Login Attempts",
  "detection.analytic.type": "Rule",
  "detection.analytic.category": "DQL",
  "detection.analytic.id": "5fd01409-c65b-4d93-8fc5-340259c288df",


  "scan.id": "9f3c2e1a-4b7d-4a8e-bc6f-3d2e9a1f7c4b",
  "scan.actor.id": "srv-threat-detection",


  "finding.query.filter": "filter dt.smartscape_source.id == \"PROCESS_GROUP-E0D8F94D9065F24F\"",
  "finding.query.compiled": "fetch logs | filter log.source == \"windows.security\" | filter dt.smartscape_source.id == \"PROCESS_GROUP-E0D8F94D9065F24F\"",
  "finding.query.timeframe.start": "2026-07-14T18:02:00.000000000Z",
  "finding.query.timeframe.end": "2026-07-14T18:07:00.000000000Z",
  "finding.drilldowns": [
    { "title": "Failed logins on affected host", "query": "fetch logs | filter log.source == \"windows.security\" | filter event.type == \"FAILED_LOGIN\" | filter dt.smartscape_source.id == \"PROCESS_GROUP-E0D8F94D9065F24F\"", "timeframe.start": "2026-07-14T18:02:00.000000000Z", "timeframe.end": "2026-07-14T18:07:00.000000000Z" },
    { "title": "Source IPs by attempt count", "query": "fetch logs, from: now()-24h | filter log.source == \"windows.security\" | summarize attempts = count(), by: {source.ip} | sort attempts desc" }
  ],


  "object.id": "PROCESS_GROUP-E0D8F94D9065F24F",
  "object.type": "PROCESS_GROUP",
  "object.name": "prod-web-01 auth service",


  "dt.smartscape_source.id": "PROCESS_GROUP-E0D8F94D9065F24F",
  "dt.smartscape_source.type": "PROCESS_GROUP"
}