Detections

event.id

string

stableDisplay name: Event IDIn combination with timestamp, this field uniquely identifies a specific event.

1669863368163_07755297913417681159

event.type

string

stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission

DETECTION_FINDING

finding.id

string

stableDisplay name: Finding IDUnique identifier string of a finding.

A-2GJ3LSUM; arn:aws:guardduty:us-east-1:124381674733:detector/14c0550905ccbe6e5d5455071c73c1e5/finding/5c3665bd5af0488e94f482fc549a37c1

finding.title

string

stableDisplay name: Finding titleTitle or summary of the finding.

Title of finding

object.id

string

resource experimentalIdentifier of the affected object. Either this or object.name has to be set.

HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1

object.type

string

resource experimentalType of the affected object.

host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE

event.provider

string

stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission

OneAgent; AWS Security Hub; Amazon GuardDuty

product.vendor

string

resource experimentalProduct vendor.

Dynatrace; Amazon

event.end

string

stableDisplay name: Event endTimestamp of latest activity associated with this finding in UTC (given in Grail preferred Linux timestamp nano precision format).

1757405399

threat.attack.subtechnique.ids

string[]

experimentalMITRE ATT&CK sub-technique identifiers for this detection, in T{parent}.{sub} dotted format. Independent of threat.attack.technique.ids—no positional alignment is assumed or required. The parent technique is encoded in the sub-technique ID itself, for example, T1059.003 belongs to technique T1059). Omit when no sub-technique information is available; don't use empty string placeholders. Sub-technique names are derivable from IDs via the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.subtechnique.ids, "T1059.003")

['T1059.003']; ['T1059.003', 'T1078.002']

threat.attack.tactic.ids

string[]

experimentalMITRE ATT&CK tactic identifiers for this detection, in TA-prefixed format. A detection may map to zero or more tactics. Omit or set to an empty array when tactic information is unavailable from the producing source. Tactic names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.tactic.ids, "TA0002")

['TA0002']; ['TA0002', 'TA0004']

threat.attack.technique.ids

string[]

experimentalMITRE ATT&CK technique identifiers for this detection, in T-prefixed format. A detection may map to zero or more techniques. The primary pivot field for ATT&CK heat maps and technique coverage dashboards. Technique names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.technique.ids, "T1059")

['T1059']; ['T1059', 'T1078']

threat.attack.version

string

experimentalVersion of the MITRE ATT&CK framework used to classify this detection. Useful for audit and reproducibility, since tactic and technique IDs can be added or renumbered across major ATT&CK versions. Some producers don't embed the framework version in their event payloads; omit when version provenance can't be reliably determined. Use bare version numbers without a "v" prefix.

14.1; 15.1; 16.0

dt.security.risk.level

string

stableDisplay name: Security risk levelRisk score level, mapped and normalized by Dynatrace.

LOW; MEDIUM; HIGH; CRITICAL; NONE; NOT_AVAILABLE

dt.smartscape_source.type

string

stableDisplay name: Smartscape source typeThe entity type of the entity whose identifier is held in dt.smartscape_source.id.

K8S_CLUSTER; AWS_LAMBDA_FUNCTION