Detection finding events represent alerts or detections generated by security tools or Dynatrace detection rules. Detections are available for both Dynatrace-generated and third-party ingested data.
Query
Provides an overview of detection findings by normalized risk level.
A detection finding is an alert raised by a security tool or a Dynatrace detection rule when it observes suspicious or malicious activity—for example, an exploit attempt, a policy violation, or anomalous behavior. Detection findings are available for both Dynatrace-generated data and findings ingested from third-party security tools, and are primarily consumed in the Threats & Exploits app. Unlike a vulnerability finding, which reports a known weakness in a scanned object, a detection finding reports activity that was observed.
Query
Lists the most recent detection findings.
fetch security.events
|filter event.type == "DETECTION_FINDING"
|sort timestamp desc
Counts detection findings by normalized risk level.
Core event metadata. These fields identify the event record and are added automatically by Dynatrace during ingest.
Attribute
Type
Description
Examples
event.id
string
stable Display name: Event ID In combination with timestamp, this field uniquely identifies a specific event.
1669863368163_07755297913417681159
event.kind
string
stable Display name: Event kind Describes the general nature of the event, without detailing the event's specific contents. It helps to determine the record type of a raw event. Tags: permission
SECURITY_EVENT
event.type
string
stable Display name: Event type The unique type identifier of a given event. Tags: permission
DETECTION_FINDING
timestamp
timestamp
stable Display name: Timestamp Time (UNIX Epoch time in nanoseconds) when the event was ingested.
1649822520123123123
Finding fields
Information about the security finding.
Attribute
Type
Description
Examples
finding.id
string
stable Display name: Finding ID Unique identifier string of a finding.
Information about the product or tool that raised the detection finding.
Attribute
Type
Description
Examples
event.provider
string
stable Display name: Event provider Source of the event, for example, the name of the component or system that generated the event. Tags: permission
OneAgent; AWS Security Hub; Amazon GuardDuty
product.name
string
resourceexperimental Product name.
Runtime Application Protection; GuardDuty
product.vendor
string
resourceexperimental Product vendor.
Dynatrace; Amazon
Optional fields
Optional fields for detection findings (their existence in an event does not influence if they're displayed in T&E or not).
Attribute
Type
Description
Examples
event.end
string
stable Display name: Event end Timestamp of latest activity associated with this finding in UTC (given in Grail preferred Linux timestamp nano precision format).
1757405399
event.start
string
stable Display name: Event start Timestamp of earliest activity associated with this finding in UTC (given in Grail preferred Linux timestamp nano precision format).
1757405398
threat.attack.subtechnique.ids
string[]
experimental MITRE ATT&CK sub-technique identifiers for this detection, in T{parent}.{sub} dotted format. Independent of threat.attack.technique.ids—no positional alignment is assumed or required. The parent technique is encoded in the sub-technique ID itself, for example, T1059.003 belongs to technique T1059). Omit when no sub-technique information is available; don't use empty string placeholders. Sub-technique names are derivable from IDs via the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.subtechnique.ids, "T1059.003")
['T1059.003']; ['T1059.003', 'T1078.002']
threat.attack.subtechnique.names
string[]
experimental Human-readable names of the MITRE ATT&CK sub-techniques for this detection. Optional companion to threat.attack.subtechnique.ids. When populated, elements must correspond positionally to threat.attack.subtechnique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide sub-technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.
experimental MITRE ATT&CK tactic identifiers for this detection, in TA-prefixed format. A detection may map to zero or more tactics. Omit or set to an empty array when tactic information is unavailable from the producing source. Tactic names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.tactic.ids, "TA0002")
['TA0002']; ['TA0002', 'TA0004']
threat.attack.tactic.names
string[]
experimental Human-readable names of the MITRE ATT&CK tactics for this detection. Optional companion to threat.attack.tactic.ids. When populated, elements must correspond positionally to threat.attack.tactic.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide tactic names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.
experimental MITRE ATT&CK technique identifiers for this detection, in T-prefixed format. A detection may map to zero or more techniques. The primary pivot field for ATT&CK heat maps and technique coverage dashboards. Technique names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.technique.ids, "T1059")
['T1059']; ['T1059', 'T1078']
threat.attack.technique.names
string[]
experimental Human-readable names of the MITRE ATT&CK techniques for this detection. Optional companion to threat.attack.technique.ids. When populated, elements must correspond positionally to threat.attack.technique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.
['Command and Scripting Interpreter']; ['Command and Scripting Interpreter', 'Valid Accounts']
threat.attack.version
string
experimental Version of the MITRE ATT&CK framework used to classify this detection. Useful for audit and reproducibility, since tactic and technique IDs can be added or renumbered across major ATT&CK versions. Some producers don't embed the framework version in their event payloads; omit when version provenance can't be reliably determined. Use bare version numbers without a "v" prefix.
14.1; 15.1; 16.0
Dynatrace enriched fields
Fields added by Dynatrace to normalize and enrich the finding with platform-level risk assessment and Smartscape entity resolution.
Attribute
Type
Description
Examples
dt.security.risk.level
string
stable Display name: Security risk level Risk score level, mapped and normalized by Dynatrace.
LOW; MEDIUM; HIGH; CRITICAL; NONE; NOT_AVAILABLE
dt.smartscape_source.id
smartscapeId
resourcestable Display name: Smartscape source ID The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1 Tags: smartscape-id
stable Display name: Smartscape source type The entity type of the entity whose identifier is held in dt.smartscape_source.id.
K8S_CLUSTER; AWS_LAMBDA_FUNCTION
1
The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.
A detection finding generated by Dynatrace Runtime Application Protection, reporting a blocked SQL injection attempt against a Node.js process. Dynatrace resolves the targeted process to a Smartscape entity and adds dt.smartscape_source.* during ingest.
{
"event.kind":"SECURITY_EVENT",
"event.type":"DETECTION_FINDING",
"event.provider":"OneAgent",
"product.vendor":"Dynatrace",
"product.name":"Runtime Application Protection",
"finding.id":"A-35VEHCHS",
"finding.title":"Blocked SQL injection attempt at Query.ErrorPacket() (Query.js:83:17)",
A detection finding ingested from Akamai SIEM reporting a cross-site scripting attempt against a web endpoint, showing the finding metadata, the affected object (the targeted URL), and the normalized Dynatrace risk level.