Vulnerability

Latest Dynatrace
Reference

Vulnerability events cover finding ingestion, change events, and state reports. Vulnerability finding events are the primary model for third-party ingested scan results. State and change events (vulnerability.event, entity.event, vulnerability.state, entity.state) are produced by Dynatrace-generated vulnerability management only.

Query

Provides an overview of vulnerability events by event type.

fetch security.events
| filter in(event.type, {"VULNERABILITY_FINDING", "VULNERABILITY_STATE_REPORT_EVENT", "VULNERABILITY_STATUS_CHANGE_EVENT", "VULNERABILITY_SCAN"})
| summarize {events = count()}, by: {event.type}
| sort events desc

Lists the most recent vulnerability events across the domain.

fetch security.events
| filter in(event.type, {"VULNERABILITY_FINDING", "VULNERABILITY_STATE_REPORT_EVENT", "VULNERABILITY_STATUS_CHANGE_EVENT", "VULNERABILITY_SCAN"})
| sort timestamp desc

Counts unique vulnerability findings by normalized risk level.

fetch security.events
| filter event.type == "VULNERABILITY_FINDING"
| dedup {object.id, vulnerability.id, component.name, component.version}, sort: {timestamp desc}
| summarize {findings = count()}, by: {dt.security.risk.level}
| sort findings desc

Entity change

An entity change event is generated by Dynatrace Runtime Vulnerability Analytics (RVA) whenever the status or assessment of a vulnerability changes for a specific affected entity—for example, when a vulnerability becomes resolved on one process group while remaining open on another. Each event captures the transition for a single vulnerability and affected-entity pair. Entity change events are exclusive to Dynatrace-generated findings; third-party scanners report point-in-time vulnerability findings instead.

Query

Lists the most recent entity-level vulnerability status change events.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATUS_CHANGE_EVENT"
| filter event.level == "ENTITY"
| sort timestamp desc

Counts entity-level status changes by affected entity type.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATUS_CHANGE_EVENT"
| filter event.level == "ENTITY"
| summarize {changes = count()}, by: {affected_entity.type}
| sort changes desc

Counts newly opened entity-level status changes by affected entity type.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATUS_CHANGE_EVENT"
| filter event.level == "ENTITY"
| filter event.status_transition == "NEW_OPEN"
| summarize {changes = count()}, by: {affected_entity.type}
| sort changes desc

Event data

General event information.

Attribute	Type	Description	Examples
`event.category`	string	stable Display name: `Event category` Categorization based on the product and data generating this event.	`VULNERABILITY_MANAGEMENT`
`event.change_list`	array	resource stable List of attributes updated as part of the change event. Values in the list match a `previous` field.	`vulnerability.risk.score`; `affected_entities.count`; `related_entities.databases.count`
`event.description`	string	stable Display name: `Event description` Human-readable description of an event.	`Status of S-49 Remote Code Execution for prod_process_group_1 has changed to OPEN.`; `Environment impact of S-49 Remote Code Execution for prod_process_group_1 has changed.`
`event.group_label`	string	experimental Display name: `Event group label` Group label of an event.	`CHANGE_EVENT`
`event.kind`	string	stable Display name: `Event kind` Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: `permission`	`SECURITY_EVENT`
`event.level`	string	resource stable Main reference point to which the event or data is related. Possible values are `Vulnerability` (shows the global aggregation across the entire environment and comprises all entities and management zones) and `Entity` (shows the assessment based on the entity itself).	`ENTITY`
`event.name`	string	stable Display name: `Event name` The human readable display name of an event type.	`Vulnerable entity status change event`
`event.provider`	string	stable Display name: `Event provider` Source of the event, for example, the name of the component or system that generated the event. Tags: `permission`	`Dynatrace`
`event.provider_product`	string	resource stable Name of the product providing this event.	`Runtime Vulnerability Analytics`; `Snyk Container`
`event.status`	string	stable Display name: `Event status` Status of an event as being either Active or Closed.	`OPEN`; `RESOLVED`; `MUTED`
`event.status_transition`	string	experimental Display name: `Status transition` An enum that shows the transition of the above event state.	`NEW_OPEN`; `REOPEN`; `CLOSE`; `MUTE`; `UNMUTE`
`event.trigger.type`	string	resource stable Type of event trigger (for example, whether it was generated by the system, ingested via API, or triggered by the user).	`DT_PLATFORM`; `USER_ACTION`
`event.trigger.user`	string	resource stable ID of the user who triggered the event. If generated by Dynatrace, the value is `SYSTEM`.	`SYSTEM`; `<user_id>`
`event.type`	string	stable Display name: `Event type` The unique type identifier of a given event. Tags: `permission`	`VULNERABILITY_STATUS_CHANGE_EVENT`
`timestamp`	timestamp	stable Display name: `Timestamp` The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.	`1649822520123123123`

Vulnerability data

Information about the vulnerability at the entity level and its global parent, as well as its previous values.

Attribute	Type	Description	Examples
`entry_points.entry_point_jsons`	string[]	resource deprecated Use `entry_points` instead. JSON representation of entry points of a vulnerability.	`['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs_json": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']`
`vulnerability.code_location.name`	string	stable Display name: `Vulnerability code location name` Name of the code location where the code-level vulnerability was detected.	`org.dynatrace.profileservice.BioController.markdownToHtml(String):80`
`vulnerability.cvss.base_score`	double	stable Display name: `Vulnerability CVSS base score` Vulnerability's CVSS base score provided by NVD.	`8.1`
`vulnerability.cvss.vector`	string	experimental Display name: `Vulnerability CVSS vector` Vulnerability's CVSS vector defined by the provider.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.cvss.version`	string	stable Display name: `Vulnerability CVSS version` Vulnerability's CVSS score version.	`3.1`; `4.0`
`vulnerability.davis_assessment.assessment_mode`	string	stable Display name: `Vulnerability assessment mode` Availability of the information based on which the assessment of the vulnerability at the entity level has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.davis_assessment.assessment_mode_reasons`	string[]	experimental Display name: `Vulnerability Davis assessment mode reasons` Reasons for the assessment mode at the entity level.	`['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']`
`vulnerability.davis_assessment.data_assets_status`	string	stable Display name: `Vulnerability data assets status` Affected entity's reachability by a database.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.davis_assessment.exploit_status`	string	stable Display name: `Vulnerability exploit status` Public exploits status of the vulnerability at the entity level.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.davis_assessment.exposure_status`	string	stable Display name: `Vulnerability exposure status` Internet exposure status of the vulnerability at the entity level.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.davis_assessment.level`	string	stable Display name: `Vulnerability Davis security level` Risk level, based on Davis Security Score, of the vulnerability at the entity level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.davis_assessment.score`	double	stable Display name: `Vulnerability Davis security score` Davis Security Score (1-10) calculated by Dynatrace for the vulnerability at the entity level.	`8.1`
`vulnerability.davis_assessment.vulnerable_function_status`	string	stable Display name: `Vulnerability vulnerable function status` Usage status of the vulnerable functions causing the vulnerability at the entity level.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.description`	string	stable Display name: `Vulnerability description` Detailed description of the vulnerability in CommonMark markdown. Covers the technical nature of the issue, the conditions under which it can be exploited, and its potential impact. Used for display in vulnerability detail views and as context in ITSM ticket bodies.	`Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies.`
`vulnerability.display_id`	string	stable Display name: `Vulnerability display ID` Dynatrace user-readable identifier for the vulnerability.	`S-1234`
`vulnerability.external_id`	string	deprecated Use `vulnerability.id` instead, it carries the vulnerability identifier directly, so this field is no longer needed. Display name: `Vulnerability external ID` Carries the actual vulnerability identifier (CVE, Snyk ID, etc.) when `vulnerability.id` holds a security problem ID.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.external_url`	string	deprecated Use `vulnerability.references` on the vulnerability lookup table instead, which contains typed external links (advisories, source-code fixes, package homepages, etc.) including the original advisory pages this field used to point at. Display name: `Vulnerability external URL` Contains a link to an external resource describing the vulnerability in more detail.	`https://example.com`
`vulnerability.first_seen`	timestamp	stable Display name: `Vulnerability first seen` Timestamp of when the vulnerability at the entity level was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.id`	string	stable Display name: `Vulnerability ID` Dynatrace Security Problem identifier for the vulnerability. ¹	`SECURITY_PROBLEM-123456789`
`vulnerability.is_fix_available`	boolean	experimental Display name: `Vulnerability is fix available` Indicates if a vulnerability fix is available.
`vulnerability.mute.change_date`	timestamp	stable Display name: `Vulnerability mute change date` Timestamp of the last muted or unmuted action of the vulnerability at the entity level.	`2023-03-22T13:19:36.945Z`
`vulnerability.mute.comment`	string	experimental Display name: `Vulnerability mute comment` Comment for muting or unmuting the vulnerability at entity level.	`Muted because it's a false positive.`
`vulnerability.mute.reason`	string	stable Display name: `Vulnerability mute reason` Reason for muting or unmuting the vulnerability at the entity level.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.mute.status`	string	stable Display name: `Vulnerability mute status` Mute status of the vulnerability at the entity level.	`MUTED`; `NOT_MUTED`
`vulnerability.mute.user`	string	stable Display name: `Vulnerability mute user` User who last changed the mute status of the vulnerability at the entity level.	`user@example.com`
`vulnerability.parent.davis_assessment.assessment_mode`	string	stable Display name: `Vulnerability parent assessment mode` Availability of the information based on which the vulnerability assessment has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.parent.davis_assessment.data_assets_status`	string	stable Display name: `Vulnerability parent data assets status` Vulnerability's reachability of related data assets by affected entities.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.parent.davis_assessment.exposure_status`	string	stable Display name: `Vulnerability parent exposure status` Vulnerability's internet exposure status.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.parent.davis_assessment.level`	string	stable Display name: `Vulnerability parent Davis security level` Vulnerability's Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.parent.davis_assessment.score`	double	stable Display name: `Vulnerability parent Davis security score` Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.	`8.1`
`vulnerability.parent.davis_assessment.vulnerable_function_status`	string	stable Display name: `Vulnerability parent vulnerable function status` Usage status of vulnerable functions causing the vulnerability. Status is `IN_USE` when there's at least one vulnerable function in use by an application.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.parent.first_seen`	string	stable Display name: `Vulnerability parent first seen` Timestamp of when the vulnerability was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.parent.mute.change_date`	timestamp	stable Display name: `Vulnerability parent mute change date` Timestamp of the last mute or unmute action of the vulnerability.	`2023-03-22T13:19:36.945Z`
`vulnerability.parent.mute.reason`	string	stable Display name: `Vulnerability parent mute reason` Reason for muting or unmuting the vulnerability.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.parent.mute.status`	string	stable Display name: `Vulnerability parent mute status` Vulnerability's mute status.	`MUTED`; `NOT_MUTED`
`vulnerability.parent.mute.user`	string	stable Display name: `Vulnerability parent mute user` User who last changed the vulnerability's mute status.	`user@example.com`
`vulnerability.parent.resolution.change_date`	string	stable Display name: `Vulnerability parent resolution change date` Timestamp of the vulnerability's last resolution status change.	`2023-03-22T13:19:37.466Z`
`vulnerability.parent.resolution.status`	string	stable Display name: `Vulnerability parent resolution status` Current status of the vulnerability.	`OPEN`; `RESOLVED`
`vulnerability.parent.risk.level`	string	stable Display name: `Vulnerability parent risk level` Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.parent.risk.score`	double	stable Display name: `Vulnerability parent risk score` Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.previous.cvss.base_score`	double	stable Display name: `Vulnerability previous CVSS base score` Vulnerability's previous CVSS base score (in case the CVSS base score has changed).	`8.1`
`vulnerability.previous.davis_assessment.data_assets_status`	string	stable Display name: `Vulnerability previous data assets status` Vulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.previous.davis_assessment.exploit_status`	string	stable Display name: `Vulnerability previous exploit status` Vulnerability's previous public exploit status (in case the public exploit status has changed).	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.previous.davis_assessment.exposure_status`	string	stable Display name: `Vulnerability previous exposure status` Vulnerability's previous internet exposure status (in case the internet exposure status has changed).	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.previous.davis_assessment.level`	string	stable Display name: `Vulnerability previous Davis security level` Vulnerability's previous risk level (in case the risk level has changed).	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.previous.davis_assessment.score`	double	stable Display name: `Vulnerability previous Davis security score` Vulnerability's previous Davis Security Score (in case Davis Security Score has changed).	`8.1`
`vulnerability.previous.davis_assessment.vulnerable_function_status`	string	stable Display name: `Vulnerability previous vulnerable function status` Vulnerability's previous vulnerable function status (in case the vulnerable function status has changed).	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.previous.external_id`	string	deprecated Use `vulnerability.previous.id` instead. Parallels the deprecation of `vulnerability.external_id`. Display name: `Vulnerability previous external ID` Previous `vulnerability.external_id` of the vulnerability.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.previous.mute.change_date`	string	stable Display name: `Vulnerability previous mute change date` Timestamp of the vulnerability's previous mute status (in case the mute status has changed).	`2023-03-22T13:19:36.945Z`
`vulnerability.previous.mute.comment`	string	experimental Display name: `Vulnerability previous mute comment` Comment of the vulnerability's previous mute status.	`Muted because it's a false positive.`
`vulnerability.previous.mute.reason`	string	stable Display name: `Vulnerability previous mute reason` Reason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).	`Muted: False positive`
`vulnerability.previous.mute.status`	string	stable Display name: `Vulnerability previous mute status` Vulnerability's previous mute status (in case the mute status has changed).	`MUTED`; `NOT_MUTED`
`vulnerability.previous.mute.user`	string	stable Display name: `Vulnerability previous mute user` User who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).	`user@example.com`
`vulnerability.previous.resolution.status`	string	stable Display name: `Vulnerability previous resolution status` Vulnerability's previous resolution status (in case the resolution status has changed).	`OPEN`; `RESOLVED`
`vulnerability.previous.risk.level`	string	stable Display name: `Vulnerability previous risk level` Vulnerability's previous risk score level (in case the risk score level has changed).	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`
`vulnerability.previous.risk.score`	double	stable Display name: `Vulnerability previous risk score` Vulnerability's previous risk score (in case the risk score has changed).	`8.1`
`vulnerability.previous.tracking_link.text`	string	experimental Display name: `Vulnerability previous tracking link text` Display text of the previous tracking link that was set by the user.	`P-1000 Vulnerability CVE-2024-0001`
`vulnerability.previous.tracking_link.url`	string	experimental Display name: `Vulnerability previous tracking link URL` URL of the previous tracking link that was set by the user.	`https://example.com/Project1/P-1000`
`vulnerability.references.cve`	string[]	deprecated Use `vulnerability.cve_ids` instead. Display name: `Vulnerability CVE references` Contains a list of CVE IDs related to this vulnerabily.	`['CVE-2021-41079']`
`vulnerability.references.cwe`	string[]	deprecated Use `vulnerability.cwe_ids` instead. Display name: `Vulnerability CWE references` Contains a list of CVE IDs related to this vulnerabily.	`['CWE-20']`
`vulnerability.references.owasp`	string[]	deprecated Use `vulnerability.owasp_ids` instead. Display name: `Vulnerability OWASP references` Contains a list of OWASP IDs related to this vulnerability.	`['2021:A3']`
`vulnerability.remediation.description`	string	experimental Display name: `Vulnerability remediation description` Human-readable upgrade or mitigation instructions for the vulnerability. Describes what action to take to address the issue — typically which version to upgrade to or which configuration to change. Plain text or CommonMark markdown. Intended for display in dashboards and ITSM ticket bodies; not machine-parseable.	`Upgrade component to version 1.2.3 or higher`
`vulnerability.resolution.change_date`	timestamp	stable Display name: `Vulnerability resolution change date` Timestamp of the last resolution status change of the vulnerability at the entity level.	`2023-03-22T13:19:37.466Z`
`vulnerability.resolution.status`	string	stable Display name: `Vulnerability resolution status` Resolution status of the vulnerability at the entity level.	`OPEN`; `RESOLVED`
`vulnerability.risk.level`	string	stable Display name: `Vulnerability risk level` Vulnerability's risk score level defined by the provider at the entity level. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.risk.scale`	string	stable Display name: `Vulnerability risk scale` Scale by which the risk score and risk score level defined by the provider for the vulnerability at the entity level are measured.	`Davis Security Score`
`vulnerability.risk.score`	double	stable Display name: `Vulnerability risk score` Risk score defined by the provider for the vulnerability at the entity level. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.stack`	string	experimental Display name: `Vulnerability stack` Level of the vulnerable component in the technological stack.	`CODE`; `CODE_LIBRARY`; `SOFTWARE`; `CONTAINER_ORCHESTRATION`
`vulnerability.technology`	string	stable Display name: `Vulnerability technology` Technology of the vulnerable component.	`JAVA`; `DOTNET`; `GO`; `PHP`; `NODE_JS`
`vulnerability.title`	string	stable Display name: `Vulnerability title` Short, human-readable title of the vulnerability. Plain text, recommended to be no longer than 120 characters. Used for display in dashboards, notifications, and ITSM ticket subject lines.	`Eclipse Jetty cookie parsing vulnerability`; `Log4Shell: Remote code injection in Log4j`
`vulnerability.tracking_link.text`	string	experimental Display name: `Vulnerability tracking link text` Display text of the tracking link that was set by the user.	`P-1000 Vulnerability CVE-2024-0001`
`vulnerability.tracking_link.url`	string	experimental Display name: `Vulnerability tracking link URL` URL of the tracking link that was set by the user.	`https://example.com/Project1/P-1000`
`vulnerability.type`	string	stable Display name: `Vulnerability type` Classification of the vulnerability based on commonly accepted enums, such as CWE.	`Improper Input Validation`
`vulnerability.url`	string	stable Display name: `Vulnerability URL` Dynatrace URL to the details page of the vulnerability. \|	`https://example.com`

These events use the Security Problem ID, not the vulnerability's own identifier.

Extensions

Affected entity

Information about the vulnerability's affected entity and related entities.

Attribute	Type	Description	Examples
`affected_entity.affected_processes.ids`	array	resource stable IDs of the processes that are currently affected by the vulnerability.	`PROCESS_GROUP_INSTANCE-1`
`affected_entity.affected_processes.names`	array	resource stable Names of the processes that are currently affected by the vulnerability.	`prod_process_group_instance_1`
`affected_entity.id`	string	resource stable ID of the affected entity.	`PROCESS_GROUP-1`; `HOST-1`
`affected_entity.management_zones.ids`	array	resource stable IDs of the management zones to which the affected entity belongs.	`mzid1`
`affected_entity.management_zones.names`	array	resource stable Names of the management zones to which the affected entity belongs.	`mz1`
`affected_entity.name`	string	resource stable Name of the affected entity.	`prod_process_group_1`; `prod_host`
`affected_entity.reachable_data_assets.count`	long	resource experimental Number of reachable data assets.	`1`
`affected_entity.reachable_data_assets.ids`	array	resource experimental IDs of the data assets that can be reached by the affected entities of the vulnerability.	`DATABASE-1`
`affected_entity.reachable_data_assets.names`	array	resource experimental Names of the data assets that can be reached by the affected entities of the vulnerability.	`prod_database_1`
`affected_entity.type`	string	resource stable Type of affected entity.	`PROCESS_GROUP`; `HOST`; `KUBERNETES_NODE`
`affected_entity.vulnerable_component.id`	string	resource stable ID of the vulnerable component causing the vulnerability.	`SOFTWARE_COMPONENT-D8FCFFB4FDF7A3FF`
`affected_entity.vulnerable_component.name`	string	resource stable Name of the vulnerable component causing the vulnerability.	`log4j-core-2.6.2.jar`
`affected_entity.vulnerable_component.package_name`	string	resource experimental Package name of the vulnerable component causing the vulnerability.	`k8s.io/kubernetes`; `github.com/kubernetes/kubernetes/pkg/kubelet/kuberuntime`
`affected_entity.vulnerable_component.short_name`	string	resource stable Short name of the vulnerable component causing the vulnerability.	`log4j`
`affected_entity.vulnerable_functions`	array	resource stable Vulnerable functions detected, containing or causing the vulnerability.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`
`affected_entity.vulnerable_functions_not_available`	array	resource experimental Vulnerable functions detected which Dynatrace can't tell if they're in use due to limited insights.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`
`affected_entity.vulnerable_functions_not_in_use`	array	resource experimental Vulnerable functions detected which are not actively used.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`

Attribute	Type	Description	Examples
`related_entities.applications.count`	long	resource stable Number of related applications.	`1`
`related_entities.applications.ids`	array	resource stable IDs of the applications related to the vulnerability's affected entities.	`APPLICATION-1`
`related_entities.databases.count`	long	resource stable Number of related databases.	`1`
`related_entities.databases.ids`	array	resource stable IDs of the databases related to the vulnerability's affected entities.	`DATABASE-1`
`related_entities.hosts.count`	long	resource stable Number of related hosts.	`1`
`related_entities.hosts.ids`	array	resource stable IDs of the hosts related to the vulnerability's affected entities.	`HOST-1`
`related_entities.kubernetes_clusters.count`	long	resource stable Number of related Kubernetes clusters.	`1`
`related_entities.kubernetes_clusters.ids`	array	resource stable IDs of the Kubernetes clusters related to the vulnerability's affected entities.	`KUBERNETES_CLUSTER-1`
`related_entities.kubernetes_workloads.count`	long	resource stable Number of related Kubernetes workloads.	`1`
`related_entities.kubernetes_workloads.ids`	array	resource stable IDs of the Kubernetes workloads related to the vulnerability's affected entities.	`KUBERNETES_WORKLOAD-1`
`related_entities.services.count`	long	resource stable Number of related services.	`1`
`related_entities.services.ids`	array	resource stable IDs of the services related to the vulnerability's affected entities.	`SERVICE-1`

Examples

Runtime Vulnerability Analytics — Entity-level vulnerability status changed to resolved

A vulnerability status change event at the entity level, generated when Dynatrace resolved the vulnerability for a specific process group after the library was updated.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_STATUS_CHANGE_EVENT",
  "event.level": "ENTITY",
  "event.group_label": "CHANGE_EVENT",
  "event.provider": "Dynatrace",
  "event.provider_product": "Runtime Vulnerability Analytics",

  "event.description": "Status of S-8418 Apache MINA vulnerable to Deserialization of Untrusted Data for BloatedJavaSoftwareGroup-IG-1 has changed to RESOLVED",
  "event.status_transition": "CLOSE",
  "event.status": "RESOLVED",
  "event.trigger.type": "DT_PLATFORM",
  "event.trigger.user": "SYSTEM",
  "event.change_list": ["vulnerability.resolution.status"],

  "vulnerability.id": "18269550188425474761",
  "vulnerability.display_id": "S-8418",
  "vulnerability.external_id": "DTV-2026-JAVA-0000321",
  "vulnerability.title": "Apache MINA vulnerable to Deserialization of Untrusted Data",
  "vulnerability.references.cve": ["CVE-2026-41635"],
  "vulnerability.risk.level": "CRITICAL",
  "vulnerability.risk.score": 9.8,
  "vulnerability.resolution.status": "RESOLVED",
  "vulnerability.previous.resolution.status": "OPEN",
  "vulnerability.mute.status": "NOT_MUTED",
  "vulnerability.stack": "CODE_LIBRARY",
  "vulnerability.type": "Deserialization of Untrusted Data",
  "vulnerability.technology": "JAVA",

  "affected_entity.id": "PROCESS_GROUP-A15E7F3CFFF5B15F",
  "affected_entity.name": "BloatedJavaSoftwareGroup-IG-1",
  "affected_entity.type": "PROCESS_GROUP"
}

Entity state

An entity state event is a periodic snapshot, emitted by Dynatrace Runtime Vulnerability Analytics (RVA), of a vulnerability's current status on a single affected entity. RVA re-reports the open state at regular intervals and reports a resolved state once, so a deduplicated latest snapshot per vulnerability and affected-entity pair reflects the current exposure. Entity state events are exclusive to Dynatrace-generated findings.

Query

Lists the most recent entity-level vulnerability state report events.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATE_REPORT_EVENT"
| filter event.level == "ENTITY"
| sort timestamp desc

Counts distinct affected entities in the current state by entity type.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATE_REPORT_EVENT"
| filter event.level == "ENTITY"
| dedup {vulnerability.display_id, affected_entity.id}, sort: {timestamp desc}
| summarize {affected_entities = countDistinctExact(affected_entity.id)}, by: {affected_entity.type}
| sort affected_entities desc

Counts entities currently exposed by a vulnerability with the vulnerable function actively in use, by entity type.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATE_REPORT_EVENT"
| filter event.level == "ENTITY"
| dedup {vulnerability.display_id, affected_entity.id}, sort: {timestamp desc}
| filter vulnerability.davis_assessment.vulnerable_function_status == "IN_USE"
| summarize {affected_entities = countDistinctExact(affected_entity.id)}, by: {affected_entity.type}
| sort affected_entities desc

Event data

General event information.

Attribute	Type	Description	Examples
`event.category`	string	stable Display name: `Event category` Categorization based on the product and data generating this event.	`VULNERABILITY_MANAGEMENT`
`event.description`	string	stable Display name: `Event description` Human-readable description of an event.	`S-49 Remote Code Execution state event reported`
`event.group_label`	string	experimental Display name: `Event group label` Group label of an event.	`STATE_REPORT`
`event.kind`	string	stable Display name: `Event kind` Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: `permission`	`SECURITY_EVENT`
`event.level`	string	resource stable Main reference point to which the event or data is related. Possible values are `Vulnerability` (shows the global aggregation across the entire environment and comprises all entities and management zones) and `Entity` (shows the assessment based on the entity itself).	`ENTITY`
`event.name`	string	stable Display name: `Event name` The human readable display name of an event type.	`Vulnerability historical state report event`
`event.provider`	string	stable Display name: `Event provider` Source of the event, for example, the name of the component or system that generated the event. Tags: `permission`	`OneAgent`; `K8S`; `Davis`; `VMWare`; `GCP`; `AWS`; `LIMA_USAGE_STREAM`
`event.provider_product`	string	resource stable Name of the product providing this event.	`Runtime Vulnerability Analytics`; `Snyk Container`
`event.status`	string	stable Display name: `Event status` Status of an event as being either Active or Closed.	`OPEN`; `RESOLVED`; `MUTED`
`event.type`	string	stable Display name: `Event type` The unique type identifier of a given event. Tags: `permission`	`VULNERABILITY_STATE_REPORT_EVENT`
`timestamp`	timestamp	stable Display name: `Timestamp` The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.	`1649822520123123123`

Vulnerability data

Information about the vulnerability at the entity level and its global vulnerability, with a focus on the affected entities

Attribute	Type	Description	Examples
`entry_points.entry_point_jsons`	string[]	resource deprecated Use `entry_points` instead. JSON representation of entry points of a vulnerability.	`['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs_json": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']`
`vulnerability.code_location.name`	string	stable Display name: `Vulnerability code location name` Name of the code location where the code-level vulnerability was detected.	`org.dynatrace.profileservice.BioController.markdownToHtml(String):80`
`vulnerability.cvss.base_score`	double	stable Display name: `Vulnerability CVSS base score` Vulnerability's CVSS base score provided by NVD.	`8.1`
`vulnerability.cvss.vector`	string	experimental Display name: `Vulnerability CVSS vector` Vulnerability's CVSS vector defined by the provider.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.cvss.version`	string	stable Display name: `Vulnerability CVSS version` Vulnerability's CVSS score version.	`3.1`; `4.0`
`vulnerability.davis_assessment.assessment_mode`	string	stable Display name: `Vulnerability assessment mode` Availability of the information based on which the assessment of the vulnerability at the entity level has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.davis_assessment.assessment_mode_reasons`	string[]	experimental Display name: `Vulnerability Davis assessment mode reasons` Reasons for the assessment mode at the entity level.	`['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']`
`vulnerability.davis_assessment.data_assets_status`	string	stable Display name: `Vulnerability data assets status` Affected entity's reachability by a database.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.davis_assessment.exploit_status`	string	stable Display name: `Vulnerability exploit status` Public exploits status of the vulnerability at the entity level.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.davis_assessment.exposure_status`	string	stable Display name: `Vulnerability exposure status` Internet exposure status of the vulnerability at the entity level.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.davis_assessment.level`	string	stable Display name: `Vulnerability Davis security level` Risk level, based on Davis Security Score, of the vulnerability at the entity level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.davis_assessment.score`	double	stable Display name: `Vulnerability Davis security score` Davis Security Score (1-10) calculated by Dynatrace for the vulnerability at the entity level.	`8.1`
`vulnerability.davis_assessment.vector`	string	experimental Display name: `Vulnerability Davis assessment vector` Vulnerability's CVSS vector, adjusted with observability data; this vector is calculated by Dynatrace.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.davis_assessment.vulnerable_function_status`	string	stable Display name: `Vulnerability vulnerable function status` Usage status of the vulnerable functions causing the vulnerability at the entity level.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.description`	string	stable Display name: `Vulnerability description` Detailed description of the vulnerability in CommonMark markdown. Covers the technical nature of the issue, the conditions under which it can be exploited, and its potential impact. Used for display in vulnerability detail views and as context in ITSM ticket bodies.	`Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies.`
`vulnerability.display_id`	string	stable Display name: `Vulnerability display ID` Dynatrace user-readable identifier for the vulnerability.	`S-1234`
`vulnerability.external_id`	string	deprecated Use `vulnerability.id` instead, it carries the vulnerability identifier directly, so this field is no longer needed. Display name: `Vulnerability external ID` Carries the actual vulnerability identifier (CVE, Snyk ID, etc.) when `vulnerability.id` holds a security problem ID.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.external_url`	string	deprecated Use `vulnerability.references` on the vulnerability lookup table instead, which contains typed external links (advisories, source-code fixes, package homepages, etc.) including the original advisory pages this field used to point at. Display name: `Vulnerability external URL` Contains a link to an external resource describing the vulnerability in more detail.	`https://example.com`
`vulnerability.id`	string	stable Display name: `Vulnerability ID` Dynatrace Security Problem identifier for the vulnerability. ¹	`SECURITY_PROBLEM-123456789`
`vulnerability.is_fix_available`	boolean	experimental Display name: `Vulnerability is fix available` Indicates if a vulnerability fix is available.
`vulnerability.mute.change_date`	timestamp	stable Display name: `Vulnerability mute change date` Timestamp of the last muted or unmuted action of the vulnerability at the entity level.	`2023-03-22T13:19:36.945Z`
`vulnerability.mute.comment`	string	experimental Display name: `Vulnerability mute comment` Comment for muting or unmuting the vulnerability at entity level.	`Muted because it's a false positive.`
`vulnerability.mute.reason`	string	stable Display name: `Vulnerability mute reason` Reason for muting or unmuting the vulnerability at the entity level.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.mute.status`	string	stable Display name: `Vulnerability mute status` Mute status of the vulnerability at the entity level.	`MUTED`; `NOT_MUTED`
`vulnerability.mute.user`	string	stable Display name: `Vulnerability mute user` User who last changed the mute status of the vulnerability at the entity level.	`user@example.com`
`vulnerability.parent.davis_assessment.assessment_mode`	string	stable Display name: `Vulnerability parent assessment mode` Availability of the information based on which the vulnerability assessment has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.parent.davis_assessment.data_assets_status`	string	stable Display name: `Vulnerability parent data assets status` Vulnerability's reachability of related data assets by affected entities.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.parent.davis_assessment.exposure_status`	string	stable Display name: `Vulnerability parent exposure status` Vulnerability's internet exposure status.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.parent.davis_assessment.level`	string	stable Display name: `Vulnerability parent Davis security level` Vulnerability's Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.parent.davis_assessment.score`	double	stable Display name: `Vulnerability parent Davis security score` Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.	`8.1`
`vulnerability.parent.davis_assessment.vulnerable_function_status`	string	stable Display name: `Vulnerability parent vulnerable function status` Usage status of vulnerable functions causing the vulnerability. Status is `IN_USE` when there's at least one vulnerable function in use by an application.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.parent.first_seen`	string	stable Display name: `Vulnerability parent first seen` Timestamp of when the vulnerability was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.parent.mute.change_date`	timestamp	stable Display name: `Vulnerability parent mute change date` Timestamp of the last mute or unmute action of the vulnerability.	`2023-03-22T13:19:36.945Z`
`vulnerability.parent.mute.reason`	string	stable Display name: `Vulnerability parent mute reason` Reason for muting or unmuting the vulnerability.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.parent.mute.status`	string	stable Display name: `Vulnerability parent mute status` Vulnerability's mute status.	`MUTED`; `NOT_MUTED`
`vulnerability.parent.mute.user`	string	stable Display name: `Vulnerability parent mute user` User who last changed the vulnerability's mute status.	`user@example.com`
`vulnerability.parent.resolution.change_date`	string	stable Display name: `Vulnerability parent resolution change date` Timestamp of the vulnerability's last resolution status change.	`2023-03-22T13:19:37.466Z`
`vulnerability.parent.resolution.status`	string	stable Display name: `Vulnerability parent resolution status` Current status of the vulnerability.	`OPEN`; `RESOLVED`
`vulnerability.parent.risk.level`	string	stable Display name: `Vulnerability parent risk level` Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.parent.risk.score`	double	stable Display name: `Vulnerability parent risk score` Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.references.cve`	string[]	deprecated Use `vulnerability.cve_ids` instead. Display name: `Vulnerability CVE references` Contains a list of CVE IDs related to this vulnerabily.	`['CVE-2021-41079']`
`vulnerability.references.cwe`	string[]	deprecated Use `vulnerability.cwe_ids` instead. Display name: `Vulnerability CWE references` Contains a list of CVE IDs related to this vulnerabily.	`['CWE-20']`
`vulnerability.references.owasp`	string[]	deprecated Use `vulnerability.owasp_ids` instead. Display name: `Vulnerability OWASP references` Contains a list of OWASP IDs related to this vulnerability.	`['2021:A3']`
`vulnerability.remediation.description`	string	experimental Display name: `Vulnerability remediation description` Human-readable upgrade or mitigation instructions for the vulnerability. Describes what action to take to address the issue — typically which version to upgrade to or which configuration to change. Plain text or CommonMark markdown. Intended for display in dashboards and ITSM ticket bodies; not machine-parseable.	`Upgrade component to version 1.2.3 or higher`
`vulnerability.resolution.change_date`	timestamp	stable Display name: `Vulnerability resolution change date` Timestamp of the last status change of the vulnerability at the entity level.	`2023-03-22T13:19:37.466Z`
`vulnerability.resolution.status`	string	stable Display name: `Vulnerability resolution status` Resolution status of the vulnerability at the entity level.	`OPEN`; `RESOLVED`
`vulnerability.risk.level`	string	stable Display name: `Vulnerability risk level` Vulnerability's risk score level defined by the provider at the entity level. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.risk.scale`	string	stable Display name: `Vulnerability risk scale` Scale by which the risk score and risk score level defined by the provider for the vulnerability at the entity level are measured.	`Davis Security Score`
`vulnerability.risk.score`	double	stable Display name: `Vulnerability risk score` Risk score defined by the provider for the vulnerability at the entity level. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.stack`	string	experimental Display name: `Vulnerability stack` Level of the vulnerable component in the technological stack.	`CODE`; `CODE_LIBRARY`; `SOFTWARE`; `CONTAINER_ORCHESTRATION`
`vulnerability.technology`	string	stable Display name: `Vulnerability technology` Technology of the vulnerable component.	`JAVA`; `DOTNET`; `GO`; `PHP`; `NODE_JS`
`vulnerability.title`	string	stable Display name: `Vulnerability title` Short, human-readable title of the vulnerability. Plain text, recommended to be no longer than 120 characters. Used for display in dashboards, notifications, and ITSM ticket subject lines.	`Eclipse Jetty cookie parsing vulnerability`; `Log4Shell: Remote code injection in Log4j`
`vulnerability.tracking_link.text`	string	experimental Display name: `Vulnerability tracking link text` Display text of the tracking link that was set by the user.	`P-1000 Vulnerability CVE-2024-0001`
`vulnerability.tracking_link.url`	string	experimental Display name: `Vulnerability tracking link URL` URL of the tracking link that was set by the user.	`https://example.com/Project1/P-1000`
`vulnerability.type`	string	stable Display name: `Vulnerability type` Classification of the vulnerability based on commonly accepted enums, such as CWE.	`Improper Input Validation`
`vulnerability.url`	string	stable Display name: `Vulnerability URL` Dynatrace URL to the details page of the vulnerability. \|	`https://example.com`

These events use the Security Problem ID, not the vulnerability's own identifier.

Extensions

This section contains information about the vulnerability's affected and related entities.

Affected entity fields

Attribute	Type	Description	Examples
`affected_entity.affected_processes.ids`	array	resource stable IDs of the processes that are currently affected by the vulnerability.	`PROCESS_GROUP_INSTANCE-1`
`affected_entity.affected_processes.names`	array	resource stable Names of the processes that are currently affected by the vulnerability.	`prod_process_group_instance_1`
`affected_entity.id`	string	resource stable ID of the affected entity.	`PROCESS_GROUP-1`; `HOST-1`
`affected_entity.management_zones.ids`	array	resource stable IDs of the management zones to which the affected entity belongs.	`mzid1`
`affected_entity.management_zones.names`	array	resource stable Names of the management zones to which the affected entity belongs.	`mz1`
`affected_entity.name`	string	resource stable Name of the affected entity.	`prod_process_group_1`; `prod_host`
`affected_entity.reachable_data_assets.count`	long	resource experimental Number of reachable data assets.	`1`
`affected_entity.reachable_data_assets.ids`	array	resource experimental IDs of the data assets that can be reached by the affected entities of the vulnerability.	`DATABASE-1`
`affected_entity.reachable_data_assets.names`	array	resource experimental Names of the data assets that can be reached by the affected entities of the vulnerability.	`prod_database_1`
`affected_entity.type`	string	resource stable Type of affected entity.	`PROCESS_GROUP`; `HOST`; `KUBERNETES_NODE`
`affected_entity.vulnerable_component.id`	string	resource stable ID of the vulnerable component causing the vulnerability.	`SOFTWARE_COMPONENT-D8FCFFB4FDF7A3FF`
`affected_entity.vulnerable_component.name`	string	resource stable Name of the vulnerable component causing the vulnerability.	`log4j-core-2.6.2.jar`
`affected_entity.vulnerable_component.package_name`	string	resource experimental Package name of the vulnerable component causing the vulnerability.	`k8s.io/kubernetes`; `github.com/kubernetes/kubernetes/pkg/kubelet/kuberuntime`
`affected_entity.vulnerable_component.short_name`	string	resource stable Short name of the vulnerable component causing the vulnerability.	`log4j`
`affected_entity.vulnerable_functions`	array	resource stable Vulnerable functions detected, containing or causing the vulnerability.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`
`affected_entity.vulnerable_functions_not_available`	array	resource experimental Vulnerable functions detected which Dynatrace can't tell if they're in use due to limited insights.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`
`affected_entity.vulnerable_functions_not_in_use`	array	resource experimental Vulnerable functions detected which are not actively used.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`

Attribute	Type	Description	Examples
`related_entities.applications.count`	long	resource stable Number of related applications.	`1`
`related_entities.applications.ids`	array	resource stable IDs of the applications related to the vulnerability's affected entities.	`APPLICATION-1`
`related_entities.applications.names`	array	resource stable Names of the applications related to the vulnerability's affected entities.	`prod_application_1`
`related_entities.databases.count`	long	resource stable Number of related databases.	`1`
`related_entities.databases.ids`	array	resource stable IDs of the databases related to the vulnerability's affected entities.	`DATABASE-1`
`related_entities.databases.names`	array	resource stable Names of the databases related to the vulnerability's affected entities.	`prod_database_1`
`related_entities.hosts.count`	long	resource stable Number of related hosts.	`1`
`related_entities.hosts.ids`	array	resource stable IDs of the hosts related to the vulnerability's affected entities.	`HOST-1`
`related_entities.hosts.names`	array	resource stable Names of the hosts related to the vulnerability's affected entities.	`prod_host_1`
`related_entities.kubernetes_clusters.count`	long	resource stable Number of related Kubernetes clusters.	`1`
`related_entities.kubernetes_clusters.ids`	array	resource stable IDs of the Kubernetes clusters related to the vulnerability's affected entities.	`KUBERNETES_CLUSTER-1`
`related_entities.kubernetes_clusters.names`	array	resource stable Names of the Kubernetes clusters related to the vulnerability's affected entities.	`prod_kubernetes_cluster_1`
`related_entities.kubernetes_workloads.count`	long	resource stable Number of related Kubernetes workloads.	`1`
`related_entities.kubernetes_workloads.ids`	array	resource stable IDs of the Kubernetes workloads related to the vulnerability's affected entities.	`KUBERNETES_WORKLOAD-1`
`related_entities.kubernetes_workloads.names`	array	resource stable Names of the Kubernetes workloads related to the vulnerability's affected entities.	`prod_kubernetes_workload_1`
`related_entities.services.count`	long	resource stable Number of related services.	`1`
`related_entities.services.ids`	array	resource stable IDs of the services related to the vulnerability's affected entities.	`SERVICE-1`
`related_entities.services.names`	array	resource stable Names of the services related to the vulnerability's affected entities.	`prod_service_1`

Examples

Runtime Vulnerability Analytics — Entity-level vulnerability state snapshot

A vulnerability state report event at the entity level, showing the current state of an open vulnerability for a specific process group and the vulnerable component it contains.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_STATE_REPORT_EVENT",
  "event.level": "ENTITY",
  "event.group_label": "STATE_REPORT",
  "event.provider": "Dynatrace",
  "event.provider_product": "Runtime Vulnerability Analytics",

  "event.description": "S-5774 Potential to access user credentials from the log files when debug logging enabled state event reported",
  "event.status": "OPEN",

  "vulnerability.id": "10985110393469819658",
  "vulnerability.display_id": "S-5774",
  "vulnerability.external_id": "DTV-2019-JAVA-0000054",
  "vulnerability.title": "Potential to access user credentials from the log files when debug logging enabled",
  "vulnerability.references.cve": ["CVE-2019-10212"],
  "vulnerability.risk.level": "CRITICAL",
  "vulnerability.risk.score": 9.8,
  "vulnerability.resolution.status": "OPEN",
  "vulnerability.mute.status": "NOT_MUTED",
  "vulnerability.stack": "CODE_LIBRARY",
  "vulnerability.type": "Insertion of Sensitive Information into Log File",
  "vulnerability.technology": "JAVA",

  "affected_entity.id": "PROCESS_GROUP-A15E7F3CFFF5B15F",
  "affected_entity.name": "BloatedJavaSoftwareGroup-IG-1",
  "affected_entity.type": "PROCESS_GROUP",
  "affected_entity.vulnerable_component.name": "io.undertow:undertow-core:1.4.18.Final",
  "affected_entity.vulnerable_component.short_name": "undertow-core"
}

Vulnerability change

A vulnerability change event is generated by Dynatrace Runtime Vulnerability Analytics (RVA) whenever a vulnerability's overall status or risk assessment changes, aggregated across all of the entities it affects. It complements the per-entity entity change events with a single vulnerability-level view of the transition. Vulnerability change events are exclusive to Dynatrace-generated findings.

Query

Lists the most recent vulnerability-level status change events.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATUS_CHANGE_EVENT"
| filter event.level == "VULNERABILITY"
| sort timestamp desc

Counts vulnerability-level status changes by risk level and transition type.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATUS_CHANGE_EVENT"
| filter event.level == "VULNERABILITY"
| summarize {changes = count()}, by: {vulnerability.risk.level, event.status_transition}
| sort changes desc

Counts newly opened vulnerability-level status changes by risk level.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATUS_CHANGE_EVENT"
| filter event.level == "VULNERABILITY"
| filter event.status_transition == "NEW_OPEN"
| summarize {opened = count()}, by: {vulnerability.risk.level}
| sort opened desc

Event data fields

General event information.

Attribute	Type	Description	Examples
`event.category`	string	stable Display name: `Event category` Standard categorization based on the significance of an event according to the ITIL event management standard (previously known as `severity level`).	`VULNERABILITY_MANAGEMENT`
`event.change_list`	array	resource stable List of attributes updated as part of the change event. Values in the list match a `previous` field.	`vulnerability.risk.score`; `affected_entities.count`; `related_entities.databases.count`
`event.description`	string	stable Display name: `Event description` Human-readable description of an event.	`S-49 Remote Code Execution status has changed to OPEN.`
`event.group_label`	string	experimental Display name: `Event group label` Group label of an event.	`CHANGE_EVENT`
`event.kind`	string	stable Display name: `Event kind` Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: `permission`	`SECURITY_EVENT`
`event.level`	string	resource stable Main reference point to which the event or data is related. Possible values are `Vulnerability` (shows the global aggregation across the entire environment and comprises all entities and management zones) and `Entity` (shows the assessment based on the entity itself).	`VULNERABILITY`
`event.name`	string	stable Display name: `Event name` The human readable display name of an event type.	`Vulnerability status change event`; `Vulnerability external ID change event`
`event.provider`	string	stable Display name: `Event provider` Source of the event, for example, the name of the component or system that generated the event. Tags: `permission`	`Dynatrace`
`event.provider_product`	string	resource stable Name of the product providing this event.	`Runtime Vulnerability Analytics`; `Snyk Container`
`event.status`	string	stable Display name: `Event status` Status of an event as being either Active or Closed.	`OPEN`; `RESOLVED`; `MUTED`
`event.status_transition`	string	experimental Display name: `Status transition` An enum that shows the transition of the above event state.	`NEW_OPEN`; `REOPEN`; `CLOSE`; `MUTE`; `UNMUTE`
`event.trigger.type`	string	resource stable Type of event trigger (for example, whether it was generated by the system, ingested via API, or triggered by the user).	`DT_PLATFORM`; `USER_ACTION`
`event.trigger.user`	string	resource stable ID of the user who triggered the event. If generated by Dynatrace, the value is `SYSTEM`.	`SYSTEM`; `<user_id>`
`event.type`	string	stable Display name: `Event type` The unique type identifier of a given event. Tags: `permission`	`VULNERABILITY_STATUS_CHANGE_EVENT`; `VULNERABILITY_EXTERNAL_ID_CHANGE_EVENT`
`timestamp`	timestamp	stable Display name: `Timestamp` The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.	`1649822520123123123`

Vulnerability data fields

Information about the vulnerability and its status and assessment changes.

Attribute	Type	Description	Examples
`vulnerability.cvss.base_score`	double	stable Display name: `Vulnerability CVSS base score` Vulnerability's CVSS base score provided by NVD.	`8.1`
`vulnerability.cvss.vector`	string	experimental Display name: `Vulnerability CVSS vector` Vulnerability's CVSS vector defined by the provider.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.cvss.version`	string	stable Display name: `Vulnerability CVSS version` Vulnerability's CVSS score version.	`3.1`; `4.0`
`vulnerability.davis_assessment.assessment_mode`	string	stable Display name: `Vulnerability assessment mode` Availability of the information based on which the vulnerability assessment has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.davis_assessment.assessment_mode_reasons`	string[]	experimental Display name: `Vulnerability Davis assessment mode reasons` Reasons for the assessment mode.	`['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']`
`vulnerability.davis_assessment.data_assets_status`	string	stable Display name: `Vulnerability data assets status` Vulnerability's reachability of related data assets by affected entities.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.davis_assessment.exploit_status`	string	stable Display name: `Vulnerability exploit status` Vulnerability's public exploits status.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.davis_assessment.exposure_status`	string	stable Display name: `Vulnerability exposure status` Vulnerability's internet exposure status.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.davis_assessment.level`	string	stable Display name: `Vulnerability Davis security level` Vulnerability's risk level based on Davis Security Score.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.davis_assessment.score`	double	stable Display name: `Vulnerability Davis security score` Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.	`8.1`
`vulnerability.davis_assessment.vulnerable_function_status`	string	stable Display name: `Vulnerability vulnerable function status` Usage status of the vulnerable functions causing the vulnerability.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.description`	string	stable Display name: `Vulnerability description` Detailed description of the vulnerability in CommonMark markdown. Covers the technical nature of the issue, the conditions under which it can be exploited, and its potential impact. Used for display in vulnerability detail views and as context in ITSM ticket bodies.	`Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies.`
`vulnerability.display_id`	string	stable Display name: `Vulnerability display ID` Dynatrace user-readable identifier for the vulnerability.	`S-1234`
`vulnerability.external_id`	string	deprecated Use `vulnerability.id` instead, it carries the vulnerability identifier directly, so this field is no longer needed. Display name: `Vulnerability external ID` Carries the actual vulnerability identifier (CVE, Snyk ID, etc.) when `vulnerability.id` holds a security problem ID.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.external_url`	string	deprecated Use `vulnerability.references` on the vulnerability lookup table instead, which contains typed external links (advisories, source-code fixes, package homepages, etc.) including the original advisory pages this field used to point at. Display name: `Vulnerability external URL` Contains a link to an external resource describing the vulnerability in more detail.	`https://example.com`
`vulnerability.first_seen`	timestamp	stable Display name: `Vulnerability first seen` Timestamp of when the vulnerability was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.id`	string	stable Display name: `Vulnerability ID` Dynatrace Security Problem identifier for the vulnerability. ¹	`SECURITY_PROBLEM-123456789`
`vulnerability.is_fix_available`	boolean	experimental Display name: `Vulnerability is fix available` Indicates if a vulnerability fix is available.
`vulnerability.mute.change_date`	timestamp	stable Display name: `Vulnerability mute change date` Timestamp of the vulnerability's last muted or unmuted action.	`2023-03-22T13:19:36.945Z`
`vulnerability.mute.reason`	string	stable Display name: `Vulnerability mute reason` Reason for muting or unmuting the vulnerability.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.mute.status`	string	stable Display name: `Vulnerability mute status` Vulnerability's mute status.	`MUTED`; `NOT_MUTED`
`vulnerability.mute.user`	string	stable Display name: `Vulnerability mute user` User who last changed the vulnerability's mute status.	`user@example.com`
`vulnerability.previous.cvss.base_score`	double	stable Display name: `Vulnerability previous CVSS base score` Vulnerability's previous CVSS base score (in case the CVSS base score has changed).	`8.1`
`vulnerability.previous.cvss.vector`	string	experimental Display name: `Vulnerability previous CVSS vector` Vulnerability's previous CVSS vector defined by the provider (in case the CVSS vector has changed).	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.previous.davis_assessment.data_assets_status`	string	stable Display name: `Vulnerability previous data assets status` Vulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.previous.davis_assessment.exploit_status`	string	stable Display name: `Vulnerability previous exploit status` Vulnerability's previous public exploit status (in case the public exploit status has changed).	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.previous.davis_assessment.exposure_status`	string	stable Display name: `Vulnerability previous exposure status` Vulnerability's previous internet exposure status (in case the internet exposure status has changed).	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.previous.davis_assessment.level`	string	stable Display name: `Vulnerability previous Davis security level` Vulnerability's previous risk level (in case the risk level has changed).	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.previous.davis_assessment.score`	double	stable Display name: `Vulnerability previous Davis security score` Vulnerability's previous Davis Security Score (in case Davis Security Score has changed).	`8.1`
`vulnerability.previous.davis_assessment.vulnerable_function_status`	string	stable Display name: `Vulnerability previous vulnerable function status` Vulnerability's previous vulnerable function status (in case the vulnerable function status has changed).	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.previous.mute.change_date`	string	stable Display name: `Vulnerability previous mute change date` Timestamp of the vulnerability's previous mute status (in case the mute status has changed).	`2023-03-22T13:19:36.945Z`
`vulnerability.previous.mute.reason`	string	stable Display name: `Vulnerability previous mute reason` Reason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).	`Muted: False positive`
`vulnerability.previous.mute.status`	string	stable Display name: `Vulnerability previous mute status` Vulnerability's previous mute status (in case the mute status has changed).	`MUTED`; `NOT_MUTED`
`vulnerability.previous.mute.user`	string	stable Display name: `Vulnerability previous mute user` User who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).	`user@example.com`
`vulnerability.previous.resolution.status`	string	stable Display name: `Vulnerability previous resolution status` Vulnerability's previous resolution status (in case the resolution status has changed).	`OPEN`; `RESOLVED`
`vulnerability.previous.risk.level`	string	stable Display name: `Vulnerability previous risk level` Vulnerability's previous risk score level (in case the risk score level has changed).	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`
`vulnerability.previous.risk.score`	double	stable Display name: `Vulnerability previous risk score` Vulnerability's previous risk score (in case the risk score has changed).	`8.1`
`vulnerability.references.cve`	string[]	deprecated Use `vulnerability.cve_ids` instead. Display name: `Vulnerability CVE references` Contains a list of CVE IDs related to this vulnerabily.	`['CVE-2021-41079']`
`vulnerability.references.cwe`	string[]	deprecated Use `vulnerability.cwe_ids` instead. Display name: `Vulnerability CWE references` Contains a list of CVE IDs related to this vulnerabily.	`['CWE-20']`
`vulnerability.references.owasp`	string[]	deprecated Use `vulnerability.owasp_ids` instead. Display name: `Vulnerability OWASP references` Contains a list of OWASP IDs related to this vulnerability.	`['2021:A3']`
`vulnerability.remediation.description`	string	experimental Display name: `Vulnerability remediation description` Human-readable upgrade or mitigation instructions for the vulnerability. Describes what action to take to address the issue — typically which version to upgrade to or which configuration to change. Plain text or CommonMark markdown. Intended for display in dashboards and ITSM ticket bodies; not machine-parseable.	`Upgrade component to version 1.2.3 or higher`
`vulnerability.resolution.change_date`	timestamp	stable Display name: `Vulnerability resolution change date` Timestamp of the vulnerability's last resolution status change.	`2023-03-22T13:19:37.466Z`
`vulnerability.resolution.status`	string	stable Display name: `Vulnerability resolution status` Vulnerability's resolution status.	`OPEN`; `RESOLVED`
`vulnerability.risk.level`	string	stable Display name: `Vulnerability risk level` Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.risk.scale`	string	stable Display name: `Vulnerability risk scale` Scale by which the vulnerability's risk score and risk score level defined by the provider are measured.	`Davis Security Score`
`vulnerability.risk.score`	double	stable Display name: `Vulnerability risk score` Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.stack`	string	experimental Display name: `Vulnerability stack` Level of the vulnerable component in the technological stack.	`CODE`; `CODE_LIBRARY`; `SOFTWARE`; `CONTAINER_ORCHESTRATION`
`vulnerability.technology`	string	stable Display name: `Vulnerability technology` Technology of the vulnerable component.	`JAVA`; `DOTNET`; `GO`; `PHP`; `NODE_JS`
`vulnerability.title`	string	stable Display name: `Vulnerability title` Short, human-readable title of the vulnerability. Plain text, recommended to be no longer than 120 characters. Used for display in dashboards, notifications, and ITSM ticket subject lines.	`Eclipse Jetty cookie parsing vulnerability`; `Log4Shell: Remote code injection in Log4j`
`vulnerability.type`	string	stable Display name: `Vulnerability type` Classification of the vulnerability based on commonly accepted enums, such as CWE.	`Improper Input Validation`
`vulnerability.url`	string	stable Display name: `Vulnerability URL` Dynatrace URL to the details page of the vulnerability. \|	`https://example.com`

These events use the Security Problem ID, not the vulnerability's own identifier.

Extensions

Affected entity fields

Information on changes regarding vulnerability's affected entities.

Attribute	Type	Description	Examples
`affected_entities.count`	long	resource stable Number of affected entities.	`1`
`affected_entities.hosts.count`	long	resource stable Number of affected hosts.	`2`
`affected_entities.kubernetes_nodes.count`	long	resource stable Number of affected nodes.	`2`
`affected_entities.previous.count`	long	resource deprecated Number of affected entities before the last change event.	`1`
`affected_entities.previous.hosts.count`	long	resource deprecated Number of affected hosts before the last change event.	`5`
`affected_entities.previous.kubernetes_nodes.count`	long	resource deprecated Number of affected Kubernetes nodes before the last change event.	`5`
`affected_entities.previous.process_groups.count`	long	resource deprecated Number of affected process groups before the last change event.	`2`
`affected_entities.process_groups.count`	long	resource stable Number of affected process groups.	`2`
`affected_entities.types`	array	resource stable Types of affected entities.	`PROCESS_GROUP`; `HOST`; `KUBERNETES_NODE`

Information on changes regarding vulnerability's related entities.

Attribute	Type	Description	Examples
`related_entities.applications.count`	long	resource stable Number of related applications.	`1`
`related_entities.databases.count`	long	resource stable Number of related databases.	`1`
`related_entities.hosts.count`	long	resource stable Number of related hosts.	`1`
`related_entities.kubernetes_clusters.count`	long	resource stable Number of related Kubernetes clusters.	`1`
`related_entities.kubernetes_workloads.count`	long	resource stable Number of related Kubernetes workloads.	`1`
`related_entities.previous.databases.count`	long	resource deprecated Number of related databases before the last change event.	`1`
`related_entities.services.count`	long	resource stable Number of related services.	`1`

Examples

Runtime Vulnerability Analytics — Vulnerability status changed to resolved

A vulnerability status change event at the vulnerability level, generated when Dynatrace automatically resolved a vulnerability after the affected library was removed from all process groups.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_STATUS_CHANGE_EVENT",
  "event.level": "VULNERABILITY",
  "event.group_label": "CHANGE_EVENT",
  "event.provider": "Dynatrace",
  "event.provider_product": "Runtime Vulnerability Analytics",

  "event.description": "S-7593 Infinite loop in Apache MINA status has changed to RESOLVED",
  "event.status_transition": "CLOSE",
  "event.status": "RESOLVED",
  "event.trigger.type": "DT_PLATFORM",
  "event.trigger.user": "SYSTEM",
  "event.change_list": ["vulnerability.resolution.status"],

  "vulnerability.id": "10969751970532702025",
  "vulnerability.display_id": "S-7593",
  "vulnerability.external_id": "DTV-2021-JAVA-0000102",
  "vulnerability.title": "Infinite loop in Apache MINA",
  "vulnerability.references.cve": ["CVE-2021-41973"],
  "vulnerability.risk.level": "MEDIUM",
  "vulnerability.risk.score": 6.5,
  "vulnerability.resolution.status": "RESOLVED",
  "vulnerability.previous.resolution.status": "OPEN",
  "vulnerability.mute.status": "NOT_MUTED",
  "vulnerability.stack": "CODE_LIBRARY",
  "vulnerability.type": "Infinite Loop",
  "vulnerability.technology": "JAVA"
}

Vulnerability finding

A vulnerability finding links a vulnerability (typically a CVE) to an affected object—a container image, host, code artifact, or runtime process—and the component that introduces it. Vulnerability finding events carry scan results from both Dynatrace Runtime Vulnerability Analytics (library, code-level, and runtime vulnerabilities) and ingested findings from third-party scanners (Snyk, Qualys, Amazon Inspector, and others). Unlike a detection finding, which reports suspicious activity, a vulnerability finding reports a known weakness in a scanned object. It does not imply that the weakness was exploited.

Query

Lists the most recent unique vulnerability findings.

fetch security.events
| filter event.type == "VULNERABILITY_FINDING"
| dedup {object.id, vulnerability.id, component.name, component.version}, sort: {timestamp desc}
| sort timestamp desc

Counts unique vulnerability findings by normalized risk level.

fetch security.events
| filter event.type == "VULNERABILITY_FINDING"
| dedup {object.id, vulnerability.id, component.name, component.version}, sort: {timestamp desc}
| summarize {findings = count()}, by: {dt.security.risk.level}
| sort findings desc

Lists the top 10 container image repositories by number of unique vulnerability findings.

fetch security.events
| filter event.type == "VULNERABILITY_FINDING"
| filter object.type == "CONTAINER_IMAGE"
| dedup {object.id, vulnerability.id, component.name, component.version}, sort: {timestamp desc}
| summarize {vulnerabilities = countDistinctExact(vulnerability.id)}, by: {container_image.registry, container_image.repository}
| sort vulnerabilities desc
| limit 10

Lists the most recent unique vulnerability findings on code artifacts (source repositories and compiled artifacts).

fetch security.events
| filter event.type == "VULNERABILITY_FINDING"
| filter object.type == "CODE_ARTIFACT"
| dedup {object.id, vulnerability.id, component.name, component.version}, sort: {timestamp desc}
| sort timestamp desc

Lists the top 10 code artifact repositories by number of unique vulnerability findings.

fetch security.events
| filter event.type == "VULNERABILITY_FINDING"
| filter object.type == "CODE_ARTIFACT"
| dedup {object.id, vulnerability.id, component.name, component.version}, sort: {timestamp desc}
| summarize {vulnerabilities = countDistinctExact(vulnerability.id)}, by: {artifact.repository}
| sort vulnerabilities desc
| limit 10

Metadata fields

Meta-information on the vulnerability-finding event.

Attribute	Type	Description	Examples
`event.description`	string	stable Display name: `Event description` Human-readable description of an event.	`Vulnerability CVE-2023-45871 of component linux:4.19.269-1 was detected in your container image unguard-frontend:latest@054e1d39`
`event.id`	string	stable Display name: `Event ID` Unique identifier string of an event; is stable across multiple refreshes and updates.	`5547782627070661074_1647601320000`
`event.kind`	string	stable Display name: `Event kind` Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: `permission`	`SECURITY_EVENT`
`event.name`	string	stable Display name: `Event name` The human readable display name of an event type.	`Vulnerability finding event`
`event.provider`	string	stable Display name: `Event provider` Source of the event, for example, the name of the component or system that generated the event. Tags: `permission`	`Amazon ECR`
`event.type`	string	stable Display name: `Event type` The unique type identifier of a given event. Tags: `permission`	`VULNERABILITY_FINDING`
`event.version`	string	experimental Display name: `Event version` Describes the version of the event.	`1.309`
`timestamp`	timestamp	stable Display name: `Timestamp` Time (UNIX Epoch time in nanoseconds) when the event originated, typically when the event was ingested into Dynatrace.	`1649822520123123123`

Vulnerability data fields

Information about the vulnerability that caused the vulnerability-finding event (vulnerability ID, description, risk level, and so on).

Attribute	Type	Description	Examples
`vulnerability.cvss.base_score`	double	stable Display name: `Vulnerability CVSS base score` Vulnerability's CVSS base score provided by NVD.	`8.1`
`vulnerability.cvss.vector`	string	experimental Display name: `Vulnerability CVSS vector` Vulnerability's CVSS vector defined by the provider.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.exploit.status`	string	experimental Display name: `Vulnerability exploit status` Whether there is a known exploit for the vulnerability.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.id`	string	stable Display name: `Vulnerability ID` Identifier of the vulnerability. For Dynatrace-detected vulnerabilities this is a Dynatrace Vulnerability Record (DTVR) identifier (`DTV-<YEAR>-<ECOSYSTEM>-<INDEX>`), which joins directly with `vulnerability.id` in the vulnerability lookup table. For findings from external providers this is the provider-native identifier (CVE, GHSA, Snyk, etc.), which matches entries in `vulnerability.aliases` in the lookup table.	`DTV-2024-JAVA-0002222`; `CVE-2023-26049`; `GHSA-p26g-97m4-6q7c`
`vulnerability.references.cve`	string[]	deprecated Use `vulnerability.cve_ids` instead. Display name: `Vulnerability CVE references` Contains a list of CVE IDs related to this vulnerabily.	`['CVE-2021-41079']`
`vulnerability.remediation.status`	string	experimental Display name: `Vulnerability remediation status` Indicates whether a fix is available for the vulnerability.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.risk.level`	string	stable Display name: `Vulnerability risk level` Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.risk.score`	double	stable Display name: `Vulnerability risk score` Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.title`	string	stable Display name: `Vulnerability title` Short, human-readable title of the vulnerability. Plain text, recommended to be no longer than 120 characters. Used for display in dashboards, notifications, and ITSM ticket subject lines.	`CVE-2019-19814`; `Improper input validation`
`vulnerability.type`	string	stable Display name: `Vulnerability type` Classification of the vulnerability based on commonly accepted enums, such as CWE.	`Improper Input Validation`

Product data fields

Information about the third-party product from where Dynatrace fetches data.

Attribute	Type	Description	Examples
`product.feature`	string	experimental Feature or sub-system of the product that emitted the data ¹	`kube-apiserver`; `kube-scheduler`; `Third-party Vulnerability Analytics`; `Code-level Vulnerability Analytics`; `cloud-controller-manager`
`product.name`	string	experimental Name of the product that emitted the data ²	`Defender for Cloud`; `Sentinel`; `EKS`; `AKS`; `GKE`; `OpenShift`; `GuardDuty`
`product.vendor`	string	experimental Organization that owns or distributes the source system that produced the data ³	`Microsoft`; `Amazon`; `Google`; `Red Hat`; `Dynatrace`; `Palo Alto Networks`

Optional. Omit when the product is monolithic or the feature is not meaningful. Identifies a specific capability or independently identifiable part of a product. This can be a technical sub-system (for example, kube-apiserver within Kubernetes) or a product feature (for example, "Third-party Vulnerability Analytics" within a security scanner).

Required when using product.* fields. Use the official product name as marketed by the vendor. Should be specific enough to identify the product uniquely within a vendor.

Required when using product.* fields. Identifies the top-level vendor regardless of how the data was ingested. For open-source projects, use the primary commercial distributor or sponsoring organization (for example, "Red Hat" for OpenShift, "Google" for GKE). For Dynatrace-produced data, use "Dynatrace".

Scan data fields

Information about the scan that detected this vulnerability.

Attribute	Type	Description	Examples
`scan.id`	string	resource experimental Unique identifier of the scan.	`00000000-0000-0000-0000-000000000000`
`scan.name`	string	resource experimental Name of the scan.	`US Cloud Scanner`
`scan.time.completed`	timestamp	resource experimental Time when the scan was completed.	`2024-06-24T04:47:21.154000000+02:00`
`scan.time.started`	timestamp	resource experimental Time when the scan was started.	`2024-06-24T04:47:21.154000000+02:00`

Dynatrace enriched fields

Risk assessment fields added by Dynatrace to normalize and rank the vulnerability across the environment.

Attribute	Type	Description	Examples
`dt.security.risk.level`	string	stable Display name: `Security risk level` Risk score level, mapped and normalized by Dynatrace.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`; `NOT_AVAILABLE`
`dt.security.risk.score`	double	stable Display name: `Security risk score` Risk score, mapped and normalized by Dynatrace.	`8.1`

Extensions

The following field sets are optional context that varies by finding source. Field definitions are shared across all security event types. See the field reference for artifact fields, container image fields, OS fields, Kubernetes fields, host fields, AWS resource fields, Azure resource fields, GCP fields, software component fields, and entry point fields.

Code artifact data fields

Code-artifact-specific data for findings on source code or compiled artifacts (when object.type is CODE_ARTIFACT).

Attribute	Type	Description	Examples
`artifact.id`	string	experimental Display name: `Artifact ID` The identifier of the software artifact, typically the name of the artifact.	`carts-service`
`artifact.name`	string	experimental Display name: `Artifact name` The human-readable name of the software artifact.	`Carts service`
`artifact.path`	string	experimental File path of the artifact within its repository or on the scanned host. This differs from `software_component.path`, which is the component referenced in a code artifact, as a third-party library, for example.	`/app/status-service`; `dist/lib/auth-module.jar`
`artifact.purl`	string	experimental Display name: `Artifact package URL` The Package URL of the package artifact. This value is used to identify and locate the artifact.	`pkg:npm/%40dynatrace/backstage@2.0.0`; `pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie`
`artifact.repository`	string	experimental Source code repository from which the artifact originates. For code artifacts, this is analogous to `container_image.repository` for container images.	`appsec-ai-initiative-dev/unguard`; `Dynatrace Remote Plugin Agent`
`artifact.version`	string	experimental Display name: `Artifact version` The version of the software artifact, typically in Semantic Versioning format.	`0.1.1`

Container image data fields

This section contains container-image-specific data.

Attribute	Type	Description	Examples
`container_image.digest`	string	resource experimental Display name: `Container image digest` Container image digest uniquely and immutably identifying the vulnerable container image.	`sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1`
`container_image.registry`	string	resource experimental Display name: `Container image registry` Container image registry from which the container image originates.	`1294385647.eu-central-1`
`container_image.repository`	string	resource experimental Display name: `Container image repository` Container image repository from which the container image originates.	`unguard-frontend`
`container_image.tags`	array	resource experimental Display name: `Container image tags` List of tags of the container image.	`[1.0.0]`; `[1.0.0, 1.0.0-nightly, latest]`

OS data fields

Information about the operating system on which the affected entity is running.

Attribute	Type	Description	Examples
`os.architecture`	string	resource experimental Display name: `OS architecture` Architecture of the CPU, discovered from the operating system.	`X86`
`os.name`	string	resource stable Display name: `OS name` The OS name in a short, human-readable format.	`iOS`
`os.type`	string	resource experimental Display name: `OS type` Type of discovered operating system.	`LINUX`; `WINDOWS`
`os.version`	string	resource stable Display name: `OS version` The complete OS version, including patch, build, and other information.	`15.3.1`; `Ubuntu 16.04.7 LTS (Xenial Xerus) (kernel 4.15.0-206-generic)`; `Windows Server 2022 Datacenter 21H2 2009, ver. 10.0.20348`

Host fields

The associated host (if any) on which the vulnerability was found.

Attribute	Type	Description	Examples
`host.fqdn`	string[]	resource experimental Display name: `Host FQDN` A list of FQDNs of this host.	`['ec2-43-213-176-3.compute-1.amazonaws.com', 'localhost.example.com']`
`host.ip`	ipAddress[]	resource experimental Display name: `Host IP` A list of IP adresses (IPv4 or IPv6) of this host.	`[194.232.104.141, 2a01:468:1000:9::140]`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. Tags: `permission`	`ip-10-178-54-32.ec2.internal`

Kubernetes resource fields

The associated Kubernetes resource (if any)

Attribute	Type	Description	Examples
`k8s.cluster.name`	string	resource stable Display name: `Kubernetes cluster name` The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`
`k8s.namespace.name`	string	resource stable Display name: `Kubernetes namespace name` The name of the namespace that the pod is running in. Tags: `permission` `primary-field`	`default`; `kube-system`

Software component fields

Attribute	Type	Description	Examples
`software_component.path`	string	experimental Display name: `Software component path` File system path from which the software component was loaded (its load origin).	`/opt/tomcat/webapps/cart/WEB-INF/lib/log4j-core-2.14.1.jar`
`software_component.purl`	string	experimental Display name: `Software component purl` Location of the package providing unique identification.	`pkg:maven/org.apache.logging.log4j/log4j-core`
`software_component.supplier.name`	string	experimental Display name: `Software component supplier name` Supplier name of the software component.	`FasterXML`
`software_component.type`	string	experimental Display name: `Software component type` Type of the software component usually provided by the SBOM.	`library`
`software_component.version`	string	experimental Display name: `Software component version` Version of the software component.	`3.16.2-5+deb9u3`

Dynatrace entity enrichments

Entity ID and Smartscape reference fields added by Dynatrace during ingest when the affected entity is matched in Smartscape. These fields are not present in externally ingested findings.

Attribute	Type	Description	Examples
`dt.entity.host`	string	resource deprecated This field is deprecated and will be removed in the future. Use `dt.smartscape.host` instead. Display name: `Host` An entity ID of an entity of type HOST. Tags: `entity-id`	`HOST-E0D8F94D9065F24F`
`dt.entity.process_group`	string	resource deprecated This field is deprecated and will be removed in the future. Use `dt.process_group.id` or `dt.process_group.detected_name` instead. Note that there is no entity type PROCESS_GROUP in Smartscape, so `dt.process_group.id` exists only for compatibility. Preferably use `dt.process_group.detected_name` to identify process groups. Display name: `Process group` An entity ID of an entity of type PROCESS_GROUP. Tags: `entity-id`	`PROCESS_GROUP-E0D8F94D9065F24F`
`dt.entity.process_group_instance`	string	resource deprecated This field is deprecated and will be removed in the future. Use `dt.smartscape.process` instead. Display name: `Process group instance` An entity ID of an entity of type PROCESS_GROUP_INSTANCE. Tags: `entity-id`	`PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F`
`dt.entity.software_component`	string	resource deprecated This field is deprecated and will be removed in the future. Display name: `Software component` An entity ID of an entity of type SOFTWARE_COMPONENT. Tags: `entity-id`	`SOFTWARE_COMPONENT-4700CB75E19C8506`
`dt.smartscape_source.id`	smartscapeId	resource stable Display name: `Smartscape source ID` The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. ¹ Tags: `smartscape-id`	`K8S_CLUSTER-E0D8F94D9065F24F`; `AWS_LAMBDA_FUNCTION-E0D8F94D9065F24F`
`dt.smartscape_source.type`	string	stable Display name: `Smartscape source type` The entity type of the entity whose identifier is held in dt.smartscape_source.id.	`K8S_CLUSTER`; `AWS_LAMBDA_FUNCTION`
`dt.source_entity`	string	resource deprecated This field is deprecated and will be removed in the future. Use `dt.smartscape_source.id` instead. Display name: `Source entity` The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. ² Tags: `entity-id`	`HOST-E0D8F94D9065F24F`; `PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F`
`dt.source_entity.type`	string	resource deprecated This field is deprecated and will be removed in the future. Use `dt.smartscape_source.type` instead. Display name: `Source entity type` The entity type of the entity whose identifier is held in dt.source_entity. The value must be a valid entity type and consistent with `dt.source_entity`. Note, however, that the type identifiers are expected to be lowercased in alignment with suffixes of dt.entity.* keys.	`host`; `process_group_instance`; `cloud:azure:resource_group`

The value of this field will be based on the value of one of the dt.smartscape.<type> fields. This means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.

The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.

Entry points fields

Attribute	Type	Description	Examples
`entry_points`	record[]	resource experimental Entry points of a vulnerability.	`['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']`

Sink fields

Attribute	Type	Description	Examples
`sink.code.function`	string	resource experimental Name of the function that executes the command, query, or similar with tainted parameters.	`executeQuery`
`sink.code.namespace`	string	resource experimental Namespace of the sink code function.	`com.mysql.jdbc.Statement`
`sink.code.parameter_types`	array	resource experimental Parameter types as defined in the method signature of the sink code function, which help distinguish in case of method overloads. For example, for a method with the `executeQuery(String sql)` signature, the parameter types would be `["String"]`.	`[String]`

Examples

Runtime Vulnerability Analytics — Library vulnerability in a .NET process

A vulnerability finding generated by Dynatrace Runtime Vulnerability Analytics, reporting a critical XML External Entity (XXE) vulnerability in the log4net library detected in a running easyTravel .NET process. Dynatrace resolves the process to a Smartscape entity and adds dt.smartscape_source.* during ingest.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_FINDING",
  "product.vendor": "Dynatrace",
  "product.name": "Runtime Vulnerability Analytics",
  "product.feature": "Library Vulnerability Analytics",

  "finding.id": "9ac6b6a2-5af1-35e1-97d9-1bd275e3d9c7",
  "finding.title": "Vulnerability DTV-2021-DOTNET-0000002 of component log4net:1.2.10.0 was detected in IIS app pool dotNetFrontend_easyTravel_x64",
  "finding.severity": "CRITICAL",
  "finding.time.created": "2026-07-14T19:06:58.290441206Z",

  "vulnerability.id": "DTV-2021-DOTNET-0000002",
  "vulnerability.title": "XML External Entity attack in log4net",
  "vulnerability.references.cve": ["CVE-2018-1285"],
  "vulnerability.cvss.base_score": 9.8,
  "vulnerability.risk.level": "CRITICAL",
  "vulnerability.risk.score": 9.8,
  "vulnerability.remediation.status": "AVAILABLE",
  "dt.security.risk.level": "CRITICAL",
  "dt.security.risk.score": 9.8,

  "object.id": "PROCESS_GROUP_INSTANCE-8D4D208A40DAE589",
  "object.type": "process_group_instance",
  "object.name": "IIS app pool dotNetFrontend_easyTravel_x64",

  "component.name": "log4net",
  "component.version": "1.2.10.0",
  "software_component.purl": "pkg:nuget/log4net@1.2.10.0",
  "software_component.type": "library",
  "software_component.version": "1.2.10.0",

  "scan.id": "1e69f852-60bf-4b7c-a1bf-56c61d94fcdb",

  "dt.smartscape_source.id": "PROCESS-8D4D208A40DAE589",
  "dt.smartscape_source.type": "PROCESS"
}

Snyk Container—CVE in a container image

A vulnerability finding for a Debian curl package detected in a scanned container image, showing the affected object, the vulnerable component, container image coordinates, and the normalized Dynatrace risk level.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_FINDING",
  "event.provider": "Snyk",
  "product.vendor": "Snyk",
  "product.name": "Snyk Container",

  "finding.id": "c70138a6-7a32-426b-b074-a7c80dfb575e/curl/libcurl3-gnutls7.64.0-4+deb10u5",
  "finding.title": "CVE-2023-38546",
  "finding.severity": "LOW",
  "finding.time.created": "2026-01-16T00:29:30.399000000Z",

  "vulnerability.id": "SNYK-DEBIAN10-CURL-5955039",
  "vulnerability.references.cve": ["CVE-2023-38546"],
  "vulnerability.cvss.base_score": 3.7,
  "dt.security.risk.level": "LOW",

  "object.id": "ecr/unguard-frontend/sha256:dae2332cbc9c9e27d60d745085246ad23ec82e28ae9a1d19a80d38fb3ef94595",
  "object.type": "CONTAINER_IMAGE",
  "object.name": "unguard-frontend",

  "component.name": "curl/libcurl3-gnutls",
  "component.version": "7.64.0-4+deb10u5",

  "container_image.registry": "ecr",
  "container_image.repository": "unguard-frontend",
  "container_image.tags": ["v0.8.0"],
  "container_image.digest": "sha256:794382e1c15d43a1ae7dc3e0f3bd47270c130f7371a440ebf64b602969f64a35",

  "scan.id": "85e58e04-c80e-4a81-a2fc-9e0b36deec94"
}

Snyk Open Source—Vulnerable PHP dependency in a source repository

A vulnerability finding from Snyk Open Source, reporting a high-severity vulnerability in the guzzlehttp/guzzle HTTP client library detected in a composer.lock manifest inside a source code repository. The artifact.repository field identifies the GitHub org/repo and artifact.path pinpoints the manifest file within it.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_FINDING",
  "event.provider": "Snyk",
  "product.vendor": "Snyk",
  "product.name": "Snyk Open Source",

  "vulnerability.id": "SNYK-PHP-GUZZLEHTTPGUZZLE-17400370",
  "vulnerability.references.cve": ["CVE-2023-29197"],
  "vulnerability.cvss.base_score": 7.5,
  "dt.security.risk.level": "HIGH",

  "object.id": "ebcab339-2a28-4009-b56c-274f890afb9e",
  "object.type": "CODE_ARTIFACT",

  "artifact.id": "ebcab339-2a28-4009-b56c-274f890afb9e",
  "artifact.name": "composer.lock",
  "artifact.repository": "my-org/unguard",
  "artifact.path": "src/like-service/composer.lock",

  "component.name": "guzzlehttp/guzzle",
  "component.version": "7.4.3",

  "scan.id": "4da20b30-9a6a-4ee1-90b4-005a8e15aa68"
}

Vulnerability scan events

A vulnerability scan event records that a specific object—such as a running process group, container image, or code artifact—was scanned for vulnerabilities by a particular tool, together with scan coverage metadata. It lets you distinguish an object that was scanned and found clean from one that was never scanned. Vulnerability scan events are produced both by Dynatrace Runtime Vulnerability Analytics (process scans) and by ingested third-party scanners such as Black Duck.

Query

Lists the most recent vulnerability scan events provided by Dynatrace Runtime Vulnerability Analytics.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| sort timestamp desc
| filter product.vendor == "Dynatrace"

Counts unique scanned objects by object type.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| dedup {object.id}, sort: {timestamp desc}
| summarize {scanned_objects = countDistinctExact(object.id)}, by: {object.type}
| sort scanned_objects desc

Counts vulnerability scan events by provider and product.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| summarize {scans = count()}, by: {event.provider, product.name}
| sort scans desc

Show vulnerability scans over time by different vendors and their products.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| summarize count = count(), by: {bin(timestamp, 1h), product.vendor, product.name}

Lists the most recent unique vulnerability scans performed on code artifacts.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| filter object.type == "CODE_ARTIFACT"
| dedup {object.id}, sort: {timestamp desc}
| sort timestamp desc

Counts unique code artifact repositories scanned by each provider.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| filter object.type == "CODE_ARTIFACT"
| dedup {object.id}, sort: {timestamp desc}
| summarize {scanned_repositories = countDistinctExact(artifact.repository)}, by: {event.provider, product.name}
| sort scanned_repositories desc

Vulnerability scan events metadata fields

Meta-information on the vulnerability scan event.

Attribute	Type	Description	Examples
`event.id`	string	stable Display name: `Event ID` Unique identifier string of an event; is stable across multiple refreshes and updates.	`73d32f1e-2a6e-4b47-a79a-c865885c4821`
`event.kind`	string	stable Display name: `Event kind` Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: `permission`	`SECURITY_EVENT`
`event.name`	string	stable Display name: `Event name` The human readable display name of an event type.	`Vulnerability scan event`
`event.provider`	string	stable Display name: `Event provider` Specifies the source of the event. In the case of integration with a specific product, such as Amazon ECR or AWS Security Hub, the product's full name is included. Tags: `permission`	`Amazon ECR`
`event.type`	string	stable Display name: `Event type` The unique type identifier of a given event. Tags: `permission`	`VULNERABILITY_SCAN`
`event.version`	string	experimental Display name: `Event version` Describes the version of the event.	`1.309`
`timestamp`	timestamp	stable Display name: `Timestamp` Time (UNIX Epoch time in nanoseconds) when the event originated, typically when the scan was completed. If scan completion time isn't available, it's set to the event creation time.	`1649822520123123123`

Vulnerability scan events affected object data fields

Information about the affected object to which the scan belongs.

Attribute	Type	Description	Examples
`object.id`	string	resource experimental Identifier of the affected object.	`HOST-E0D8F94D9065F24F`; `i-06becf87d5326157a`; `arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1`
`object.mapping.resource.type`	string	resource experimental This layer represents the impacted runtime object.	`CLOUD_CLUSTER`; `CLOUD_NODE`; `CONTAINER`; `HOST`
`object.type`	string	resource experimental Type of the affected object.	`host`; `ec2_instance`; `container_image`; `process`; `HOST`; `EC2_INSTANCE`; `CONTAINER_IMAGE`

Vulnerability scan events scanner metadata fields

Information about the scan and the product that performed it.

Attribute	Type	Description	Examples
`scan.id`	string	resource experimental Unique identifier of the scan.	`00000000-0000-0000-0000-000000000000`
`scan.name`	string	resource experimental Name of the scan.	`US Cloud Scanner`
`scan.product.name`	string	resource experimental Name of the product that performed the scan.	`ECR`; `Inspector`
`scan.time.completed`	timestamp	resource experimental Time when the scan was completed.	`2024-06-24T04:47:21.154000000+02:00`
`scan.time.started`	timestamp	resource experimental Time when the scan was started.	`2024-06-24T04:47:21.154000000+02:00`
`scan.vendor`	string	resource experimental Name of the scanner vendor that performed the scan.	`AWS`

Vulnerability scan events product data fields

Information about the third-party product from where Dynatrace fetches data.

Attribute	Type	Description	Examples
`product.feature`	string	experimental Feature or sub-system of the product that emitted the data ¹	`kube-apiserver`; `kube-scheduler`; `Third-party Vulnerability Analytics`; `Code-level Vulnerability Analytics`; `cloud-controller-manager`
`product.name`	string	experimental Name of the product that emitted the data ²	`Defender for Cloud`; `Sentinel`; `EKS`; `AKS`; `GKE`; `OpenShift`; `GuardDuty`
`product.vendor`	string	experimental Organization that owns or distributes the source system that produced the data ³	`Microsoft`; `Amazon`; `Google`; `Red Hat`; `Dynatrace`; `Palo Alto Networks`

Required when using product.* fields. Use the official product name as marketed by the vendor. Should be specific enough to identify the product uniquely within a vendor.

Extensions

Vulnerability scan events code artifact data fields

Code-artifact-specific data for scans performed on source code or compiled artifacts (when object.type is CODE_ARTIFACT).

Attribute	Type	Description	Examples
`artifact.id`	string	experimental Display name: `Artifact ID` The identifier of the software artifact, typically the name of the artifact.	`carts-service`
`artifact.name`	string	experimental Display name: `Artifact name` The human-readable name of the software artifact.	`Carts service`
`artifact.path`	string	experimental File path of the artifact within its repository or on the scanned host. This differs from `software_component.path`, which is the component referenced in a code artifact, as a third-party library, for example.	`/app/status-service`; `dist/lib/auth-module.jar`
`artifact.purl`	string	experimental Display name: `Artifact package URL` The Package URL of the package artifact. This value is used to identify and locate the artifact.	`pkg:npm/%40dynatrace/backstage@2.0.0`; `pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie`
`artifact.repository`	string	experimental Source code repository from which the artifact originates. For code artifacts, this is analogous to `container_image.repository` for container images.	`appsec-ai-initiative-dev/unguard`; `Dynatrace Remote Plugin Agent`
`artifact.version`	string	experimental Display name: `Artifact version` The version of the software artifact, typically in Semantic Versioning format.	`0.1.1`

Vulnerability scan events container image data fields

Container-image-specific data for scans performed on container image registries.

Attribute	Type	Description	Examples
`container_image.digest`	string	resource experimental Display name: `Container image digest` Container image digest uniquely and immutably identifying the vulnerable container image.	`sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1`
`container_image.registry`	string	resource experimental Display name: `Container image registry` Container image registry from which the container image originates.	`1294385647.eu-central-1`
`container_image.repository`	string	resource experimental Display name: `Container image repository` Container image repository from which the container image originates.	`unguard-frontend`
`container_image.tags`	array	resource experimental Display name: `Container image tags` List of tags of the container image.	`[1.0.0]`; `[1.0.0, 1.0.0-nightly, latest]`

Vulnerability scan events OS data fields

Information about the operating system on which the scan is performed.

Attribute	Type	Description	Examples
`os.architecture`	string	resource experimental Display name: `OS architecture` Architecture of the CPU, discovered from the operating system.	`X86`
`os.name`	string	resource stable Display name: `OS name` The OS name in a short, human-readable format.	`iOS`
`os.type`	string	resource experimental Display name: `OS type` Type of discovered operating system.	`LINUX`; `WINDOWS`
`os.version`	string	resource stable Display name: `OS version` The complete OS version, including patch, build, and other information.	`15.3.1`; `Ubuntu 16.04.7 LTS (Xenial Xerus) (kernel 4.15.0-206-generic)`; `Windows Server 2022 Datacenter 21H2 2009, ver. 10.0.20348`

Vulnerability scan events entity fields

Information about the entity being scanned.

Attribute	Type	Description	Examples
`dt.entity.host`	string	resource deprecated This field is deprecated and will be removed in the future. Use `dt.smartscape.host` instead. Display name: `Host` An entity ID of an entity of type HOST. Tags: `entity-id`	`HOST-E0D8F94D9065F24F`
`dt.entity.process_group`	string	resource deprecated This field is deprecated and will be removed in the future. Use `dt.process_group.id` or `dt.process_group.detected_name` instead. Note that there is no entity type PROCESS_GROUP in Smartscape, so `dt.process_group.id` exists only for compatibility. Preferably use `dt.process_group.detected_name` to identify process groups. Display name: `Process group` An entity ID of an entity of type PROCESS_GROUP. Tags: `entity-id`	`PROCESS_GROUP-E0D8F94D9065F24F`
`dt.entity.process_group_instance`	string	resource deprecated This field is deprecated and will be removed in the future. Use `dt.smartscape.process` instead. Display name: `Process group instance` An entity ID of an entity of type PROCESS_GROUP_INSTANCE. Tags: `entity-id`	`PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F`
`dt.smartscape_source.id`	smartscapeId	resource stable Display name: `Smartscape source ID` The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. ¹ Tags: `smartscape-id`	`K8S_CLUSTER-E0D8F94D9065F24F`; `AWS_LAMBDA_FUNCTION-E0D8F94D9065F24F`
`dt.smartscape_source.type`	string	stable Display name: `Smartscape source type` The entity type of the entity whose identifier is held in dt.smartscape_source.id.	`K8S_CLUSTER`; `AWS_LAMBDA_FUNCTION`
`dt.source_entity`	string	resource deprecated This field is deprecated and will be removed in the future. Use `dt.smartscape_source.id` instead. Display name: `Source entity` The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. ² Tags: `entity-id`	`HOST-E0D8F94D9065F24F`; `PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F`
`dt.source_entity.type`	string	resource deprecated This field is deprecated and will be removed in the future. Use `dt.smartscape_source.type` instead. Display name: `Source entity type` The entity type of the entity whose identifier is held in dt.source_entity. The value must be a valid entity type and consistent with `dt.source_entity`. Note, however, that the type identifiers are expected to be lowercased in alignment with suffixes of dt.entity.* keys.	`host`; `process_group_instance`; `cloud:azure:resource_group`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. Tags: `permission`	`ip-10-178-54-32.ec2.internal`

The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.

Vulnerability scan events Kubernetes resource fields

The associated Kubernetes resource (if any)

Attribute	Type	Description	Examples
`k8s.cluster.name`	string	resource stable Display name: `Kubernetes cluster name` The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`
`k8s.namespace.name`	string	resource stable Display name: `Kubernetes namespace name` The name of the namespace that the pod is running in. Tags: `permission` `primary-field`	`default`; `kube-system`

Examples

Runtime Vulnerability Analytics — Process scan completed

A vulnerability scan event generated by Dynatrace Runtime Vulnerability Analytics after scanning a running process group instance for library vulnerabilities.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_SCAN",
  "product.vendor": "Dynatrace",
  "product.name": "Runtime Vulnerability Analytics",

  "scan.id": "cd52329f-21fc-4c65-8226-671ea1dd51a8",
  "scan.time.started": "2026-07-14T18:04:20.430000000Z",
  "scan.time.completed": "2026-07-14T18:04:20.435000000Z",

  "object.id": "PROCESS_GROUP_INSTANCE-DE81F14CCBFBBF21",
  "object.type": "process_group_instance"
}

Black Duck SCA — Code artifact scan completed

A vulnerability scan event ingested from Black Duck Software Composition Analysis, reporting the completion of a scan of a Dynatrace code artifact.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_SCAN",
  "event.provider": "Black Duck",
  "product.vendor": "Black Duck",
  "product.name": "Black Duck SCA",

  "scan.id": "62e1330e-0dc3-4e39-99ff-6387704da48b",
  "scan.name": "Black Duck SCA scan: Dynatrace Remote Plugin Agent/latest",
  "scan.time.started": "2026-07-14T16:23:31.983000000Z",
  "scan.time.completed": "2026-07-14T16:23:31.983000000Z",

  "object.type": "CODE_ARTIFACT",
  "object.id": "https://dynatrace.app.blackduck.com/api/projects/c94310bd-3e90-4b6d-9a73-8967bc7cdecd/versions/f56fec5d-b7b2-4d6c-bfb3-19f33c066e7b/sbom",

  "artifact.id": "https://dynatrace.app.blackduck.com/api/projects/c94310bd-3e90-4b6d-9a73-8967bc7cdecd/versions/f56fec5d-b7b2-4d6c-bfb3-19f33c066e7b/sbom",
  "artifact.name": "Dynatrace Remote Plugin Agent/latest",
  "artifact.repository": "Dynatrace Remote Plugin Agent"
}

Snyk Open Source—Source repository scan completed

A vulnerability scan event from Snyk Open Source after scanning a composer.lock manifest. Both artifact.repository (the GitHub org/repo) and artifact.path (the path to the manifest inside the repo) are populated.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_SCAN",
  "event.provider": "Snyk",
  "product.vendor": "Snyk",
  "product.name": "Snyk Open Source",

  "scan.id": "4da20b30-9a6a-4ee1-90b4-005a8e15aa68",
  "scan.time.started": "2026-09-01T09:12:00.000Z",
  "scan.time.completed": "2026-09-01T09:12:43.000Z",

  "object.id": "ebcab339-2a28-4009-b56c-274f890afb9e",
  "object.type": "CODE_ARTIFACT",

  "artifact.id": "ebcab339-2a28-4009-b56c-274f890afb9e",
  "artifact.name": "composer.lock",
  "artifact.repository": "my-org/unguard",
  "artifact.path": "src/like-service/composer.lock"
}

Vulnerability state

A vulnerability state event is a periodic snapshot, emitted by Dynatrace Runtime Vulnerability Analytics (RVA), of a vulnerability's current status and risk aggregated across every entity it affects. Like entity state events, the current state is exported to Grail regularly, so a deduplicated latest snapshot per vulnerability reflects present exposure. Vulnerability state events are exclusive to Dynatrace-generated findings.

Query

Lists the most recent vulnerability-level state report events.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATE_REPORT_EVENT"
| filter event.level == "VULNERABILITY"
| sort timestamp desc

Counts current vulnerabilities by Dynatrace risk level.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATE_REPORT_EVENT"
| filter event.level == "VULNERABILITY"
| dedup {vulnerability.display_id}, sort: {timestamp desc}
| summarize {vulnerabilities = count()}, by: {vulnerability.risk.level}
| sort vulnerabilities desc

Counts open, non-muted vulnerabilities with a publicly available exploit by risk level.

fetch security.events
| filter event.provider == "Dynatrace"
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATE_REPORT_EVENT"
| filter event.level == "VULNERABILITY"
| dedup {vulnerability.display_id}, sort: {timestamp desc}
| filter vulnerability.resolution.status == "OPEN"
| filter vulnerability.mute.status == "NOT_MUTED"
| filter vulnerability.davis_assessment.exploit_status == "AVAILABLE"
| summarize {vulnerabilities = countDistinctExact(vulnerability.display_id)}, by: {vulnerability.risk.level}
| sort vulnerabilities desc

Event data fields

General event information.

Attribute	Type	Description	Examples
`event.category`	string	stable Display name: `Event category` Categorization based on the product and data generating this event.	`VULNERABILITY_MANAGEMENT`
`event.description`	string	stable Display name: `Event description` Human-readable description of an event.	`S-49 Remote Code Execution state event reported`
`event.group_label`	string	experimental Display name: `Event group label` Group label of an event.	`STATE_REPORT`
`event.kind`	string	stable Display name: `Event kind` Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: `permission`	`SECURITY_EVENT`
`event.level`	string	resource stable Main reference point to which the event or data is related. Possible values are `Vulnerability` (shows the global aggregation across the entire environment and comprises all entities and management zones) and `Entity` (shows the assessment based on the entity itself).	`VULNERABILITY`
`event.name`	string	stable Display name: `Event name` The human readable display name of an event type.	`Vulnerability historical state report event`
`event.provider`	string	stable Display name: `Event provider` Source of the event, for example, the name of the component or system that generated the event. Tags: `permission`	`Dynatrace`; `Snyk`
`event.provider_product`	string	resource stable Name of the product providing this event.	`Runtime Vulnerability Analytics`; `Snyk Container`
`event.status`	string	stable Display name: `Event status` Status of an event as being either Active or Closed.	`OPEN`; `RESOLVED`; `MUTED`
`event.type`	string	stable Display name: `Event type` The unique type identifier of a given event. Tags: `permission`	`VULNERABILITY_STATE_REPORT_EVENT`
`timestamp`	timestamp	stable Display name: `Timestamp` The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.	`1649822520123123123`

Vulnerability data fields

Information about the vulnerability.

Attribute	Type	Description	Examples
`vulnerability.code_location.name`	string	stable Display name: `Vulnerability code location name` Name of the code location where the code-level vulnerability was detected.	`org.dynatrace.profileservice.BioController.markdownToHtml(String):80`
`vulnerability.cvss.base_score`	double	stable Display name: `Vulnerability CVSS base score` Vulnerability's CVSS base score provided by NVD.	`8.1`
`vulnerability.cvss.vector`	string	experimental Display name: `Vulnerability CVSS vector` Vulnerability's CVSS vector defined by the provider.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.cvss.version`	string	stable Display name: `Vulnerability CVSS version` Vulnerability's CVSS score version.	`3.1`; `4.0`
`vulnerability.davis_assessment.assessment_mode`	string	stable Display name: `Vulnerability assessment mode` Availability of the information based on which the vulnerability assessment has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.davis_assessment.assessment_mode_reasons`	string[]	experimental Display name: `Vulnerability Davis assessment mode reasons` Reasons for the assessment mode.	`['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']`
`vulnerability.davis_assessment.data_assets_status`	string	stable Display name: `Vulnerability data assets status` Vulnerability's reachability of related data assets by affected entities.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.davis_assessment.exploit_status`	string	stable Display name: `Vulnerability exploit status` Vulnerability's public exploits status.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.davis_assessment.exposure_status`	string	stable Display name: `Vulnerability exposure status` Vulnerability's internet exposure status.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.davis_assessment.level`	string	stable Display name: `Vulnerability Davis security level` Vulnerability's risk level based on Davis Security Score.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.davis_assessment.score`	double	stable Display name: `Vulnerability Davis security score` Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.	`8.1`
`vulnerability.davis_assessment.vector`	string	experimental Display name: `Vulnerability Davis assessment vector` Vulnerability's CVSS vector, adjusted with observability data; this vector is calculated by Dynatrace.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.davis_assessment.vulnerable_function_status`	string	stable Display name: `Vulnerability vulnerable function status` Usage status of the vulnerable functions causing the vulnerability.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.description`	string	stable Display name: `Vulnerability description` Detailed description of the vulnerability in CommonMark markdown. Covers the technical nature of the issue, the conditions under which it can be exploited, and its potential impact. Used for display in vulnerability detail views and as context in ITSM ticket bodies.	`Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies.`
`vulnerability.display_id`	string	stable Display name: `Vulnerability display ID` Dynatrace user-readable identifier for the vulnerability.	`S-1234`
`vulnerability.external_id`	string	deprecated Use `vulnerability.id` instead, it carries the vulnerability identifier directly, so this field is no longer needed. Display name: `Vulnerability external ID` Carries the actual vulnerability identifier (CVE, Snyk ID, etc.) when `vulnerability.id` holds a security problem ID.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.external_url`	string	deprecated Use `vulnerability.references` on the vulnerability lookup table instead, which contains typed external links (advisories, source-code fixes, package homepages, etc.) including the original advisory pages this field used to point at. Display name: `Vulnerability external URL` Contains a link to an external resource describing the vulnerability in more detail.	`https://example.com`
`vulnerability.first_seen`	timestamp	stable Display name: `Vulnerability first seen` Timestamp of when the vulnerability was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.id`	string	stable Display name: `Vulnerability ID` Dynatrace Security Problem identifier for the vulnerability. ¹	`SECURITY_PROBLEM-123456789`
`vulnerability.is_fix_available`	boolean	experimental Display name: `Vulnerability is fix available` Indicates if a vulnerability fix is available.
`vulnerability.mute.change_date`	timestamp	stable Display name: `Vulnerability mute change date` Timestamp of the vulnerability's last muted or unmuted action.	`2023-03-22T13:19:36.945Z`
`vulnerability.mute.reason`	string	stable Display name: `Vulnerability mute reason` Reason for muting or unmuting the vulnerability.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.mute.status`	string	stable Display name: `Vulnerability mute status` Vulnerability's mute status.	`MUTED`; `NOT_MUTED`
`vulnerability.mute.user`	string	stable Display name: `Vulnerability mute user` User who last changed the vulnerability's mute status.	`user@example.com`
`vulnerability.references.cve`	string[]	deprecated Use `vulnerability.cve_ids` instead. Display name: `Vulnerability CVE references` Contains a list of CVE IDs related to this vulnerabily.	`['CVE-2021-41079']`
`vulnerability.references.cwe`	string[]	deprecated Use `vulnerability.cwe_ids` instead. Display name: `Vulnerability CWE references` Contains a list of CVE IDs related to this vulnerabily.	`['CWE-20']`
`vulnerability.references.owasp`	string[]	deprecated Use `vulnerability.owasp_ids` instead. Display name: `Vulnerability OWASP references` Contains a list of OWASP IDs related to this vulnerability.	`['2021:A3']`
`vulnerability.remediation.description`	string	experimental Display name: `Vulnerability remediation description` Human-readable upgrade or mitigation instructions for the vulnerability. Describes what action to take to address the issue — typically which version to upgrade to or which configuration to change. Plain text or CommonMark markdown. Intended for display in dashboards and ITSM ticket bodies; not machine-parseable.	`Upgrade component to version 1.2.3 or higher`
`vulnerability.resolution.change_date`	timestamp	stable Display name: `Vulnerability resolution change date` Timestamp of the vulnerability's last resolution status change.	`2023-03-22T13:19:37.466Z`
`vulnerability.resolution.status`	string	stable Display name: `Vulnerability resolution status` Vulnerability's resolution status.	`OPEN`; `RESOLVED`
`vulnerability.risk.level`	string	stable Display name: `Vulnerability risk level` Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.risk.scale`	string	stable Display name: `Vulnerability risk scale` Scale by which the vulnerability's risk score and risk score level defined by the provider are measured.	`Davis Security Score`
`vulnerability.risk.score`	double	stable Display name: `Vulnerability risk score` Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.stack`	string	experimental Display name: `Vulnerability stack` Level of the vulnerable component in the technological stack.	`CODE`; `CODE_LIBRARY`; `SOFTWARE`; `CONTAINER_ORCHESTRATION`
`vulnerability.technology`	string	stable Display name: `Vulnerability technology` Technology of the vulnerable component.	`JAVA`; `DOTNET`; `GO`; `PHP`; `NODE_JS`
`vulnerability.title`	string	stable Display name: `Vulnerability title` Short, human-readable title of the vulnerability. Plain text, recommended to be no longer than 120 characters. Used for display in dashboards, notifications, and ITSM ticket subject lines.	`Eclipse Jetty cookie parsing vulnerability`; `Log4Shell: Remote code injection in Log4j`
`vulnerability.type`	string	stable Display name: `Vulnerability type` Classification of the vulnerability based on commonly accepted enums, such as CWE.	`Improper Input Validation`
`vulnerability.url`	string	stable Display name: `Vulnerability URL` Dynatrace URL to the details page of the vulnerability. \|	`https://example.com`

These events use the Security Problem ID, not the vulnerability's own identifier.

Extensions

This section contains information on the vulnerability's affected and related entities.

Affected entity fields

Attribute	Type	Description	Examples
`affected_entities.affected_processes.count`	long	resource stable Number of affected processes.	`50`
`affected_entities.count`	long	resource stable Number of affected entities.	`1`
`affected_entities.hosts.count`	long	resource stable Number of affected hosts.	`2`
`affected_entities.kubernetes_nodes.count`	long	resource stable Number of affected nodes.	`2`
`affected_entities.management_zones.ids`	array	resource stable IDs of the management zones to which the affected entities belong.	`mzid1`
`affected_entities.management_zones.names`	array	resource stable Names of the management zones to which the affected entities belong.	`mz1`
`affected_entities.monitored_processes.count`	long	resource stable Number of processes of the process group.	`100`
`affected_entities.process_groups.count`	long	resource stable Number of affected process groups.	`2`
`affected_entities.types`	array	resource stable Types of affected entities.	`PROCESS_GROUP`; `HOST`; `KUBERNETES_NODE`
`affected_entities.vulnerable_components.ids`	array	resource stable Dynatrace IDs of the vulnerable components causing the vulnerability.	`SOFTWARE_COMPONENT-0000000000000001`; `SOFTWARE_COMPONENT-0000000000000002`; `SOFTWARE_COMPONENT-0000000000000003`
`affected_entities.vulnerable_components.names`	array	resource stable Names of the vulnerable components causing the vulnerability. \|	`com.fasterxml.jackson.core:jackson-databind:2.10.0`; `node-sass:4.14.1`
`affected_entities.vulnerable_functions`	array	resource stable Vulnerable functions detected, containing or causing the vulnerability.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`

Attribute	Type	Description	Examples
`related_entities.applications.count`	long	resource stable Number of related applications.	`1`
`related_entities.databases.count`	long	resource stable Number of related databases.	`1`
`related_entities.hosts.count`	long	resource stable Number of related hosts.	`1`
`related_entities.kubernetes_clusters.count`	long	resource stable Number of related Kubernetes clusters.	`1`
`related_entities.kubernetes_workloads.count`	long	resource stable Number of related Kubernetes workloads.	`1`
`related_entities.services.count`	long	resource stable Number of related services.	`1`

Examples

Runtime Vulnerability Analytics — Vulnerability state snapshot

A vulnerability state report event at the vulnerability level, showing the current state of an open Node.js vulnerability across affected process groups.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_STATE_REPORT_EVENT",
  "event.level": "VULNERABILITY",
  "event.group_label": "STATE_REPORT",
  "event.provider": "Dynatrace",
  "event.provider_product": "Runtime Vulnerability Analytics",

  "event.description": "S-7538 Improper Restriction of Operations within the Bounds of a Memory Buffer state event reported",
  "event.status": "OPEN",

  "vulnerability.id": "7331221926697449085",
  "vulnerability.display_id": "S-7538",
  "vulnerability.external_id": "CVE-2015-5380",
  "vulnerability.title": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
  "vulnerability.references.cve": ["CVE-2015-5380"],
  "vulnerability.risk.level": "HIGH",
  "vulnerability.risk.score": 7.5,
  "vulnerability.resolution.status": "OPEN",
  "vulnerability.mute.status": "NOT_MUTED",
  "vulnerability.stack": "SOFTWARE",
  "vulnerability.type": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
  "vulnerability.technology": "NODE_JS",

  "affected_entities.count": 1,
  "affected_entities.process_groups.count": 1,
  "affected_entities.vulnerable_components.names": ["Node.js 0.3.2"]
}

Vulnerability

Query

Entity change

Query

Event data

Vulnerability data

Extensions

Affected entity

Related entities fields

Examples

Runtime Vulnerability Analytics — Entity-level vulnerability status changed to resolved

Entity state

Query

Event data

Vulnerability data

Extensions

Affected entity fields

Related entity fields

Examples

Runtime Vulnerability Analytics — Entity-level vulnerability state snapshot

Vulnerability change

Query

Event data fields

Vulnerability data fields

Extensions

Affected entity fields

Related entity fields

Examples

Runtime Vulnerability Analytics — Vulnerability status changed to resolved

Vulnerability finding

Query

Metadata fields

Vulnerability data fields

Product data fields

Scan data fields

Dynatrace enriched fields

Extensions

Code artifact data fields

Container image data fields

OS data fields

Host fields

Kubernetes resource fields

Software component fields

Dynatrace entity enrichments

Entry points fields

Sink fields

Examples

Runtime Vulnerability Analytics — Library vulnerability in a .NET process

Snyk Container—CVE in a container image

Snyk Open Source—Vulnerable PHP dependency in a source repository

Vulnerability scan events

Query

Vulnerability scan events metadata fields

Vulnerability scan events affected object data fields

Vulnerability scan events scanner metadata fields

Vulnerability scan events product data fields

Extensions

Vulnerability scan events code artifact data fields

Vulnerability scan events container image data fields

Vulnerability scan events OS data fields

Vulnerability scan events entity fields

Vulnerability scan events Kubernetes resource fields

Examples

Runtime Vulnerability Analytics — Process scan completed

Black Duck SCA — Code artifact scan completed

Snyk Open Source—Source repository scan completed

Vulnerability state

Query

Event data fields

Vulnerability data fields

Extensions

Affected entity fields

Related entity fields

Examples

Runtime Vulnerability Analytics — Vulnerability state snapshot