Vulnerabilities

Latest Dynatrace
Reference

Vulnerability events cover finding ingestion, change events, and state reports. Vulnerability finding events are the primary model for third-party ingested scan results. State and change events (vulnerability.event, entity.event, vulnerability.state, entity.state) are produced by Dynatrace-generated vulnerability management only.

Entity change

Entity change events are change events at the entity level. An event is generated whenever a vulnerability's affected entity undergoes a status or assessment change.

Query

Query entity status change events.

fetch security.events
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATUS_CHANGE_EVENT"
| filter event.level == "ENTITY"

Event data

General event information.

Attribute	Type	Description	Examples
`event.category`	string	stableDisplay name: `Event category`Categorization based on the product and data generating this event.	`VULNERABILITY_MANAGEMENT`
`event.change_list`	array	resource stableList of attributes updated as part of the change event. Values in the list match a `previous` field.	`vulnerability.risk.score`; `affected_entities.count`; `related_entities.databases.count`
`event.description`	string	stableDisplay name: `Event description`Human-readable description of an event.	`Status of S-49 Remote Code Execution for prod_process_group_1 has changed to OPEN.`; `Assessment of S-49 Remote Code Execution for prod_process_group_1 has changed.`; `Environment impact of S-49 Remote Code Execution for prod_process_group_1 has changed.`
`event.group_label`	string	experimentalDisplay name: `Event group label`Group label of an event.	`CHANGE_EVENT`
`event.kind`	string	stableDisplay name: `Event kind`Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: `permission`	`SECURITY_EVENT`
`event.level`	string	resource stableMain reference point to which the event or data is related. Possible values are `Vulnerability` (shows the global aggregation across the entire environment and comprises all entities and management zones) and `Entity` (shows the assessment based on the entity itself).	`ENTITY`
`event.name`	string	stableDisplay name: `Event name`The human readable display name of an event type.	`Vulnerable entity status change event`; `Vulnerable entity assessment change event`
`event.provider`	string	stableDisplay name: `Event provider`Source of the event, for example, the name of the component or system that generated the event.Tags: `permission`	`Dynatrace`
`event.provider_product`	string	resource stableName of the product providing this event.	`Runtime Vulnerability Analytics`; `Snyk Container`
`event.status`	string	stableDisplay name: `Event status`Status of an event as being either Active or Closed.	`OPEN`; `RESOLVED`; `MUTED`
`event.status_transition`	string	experimentalDisplay name: `Status transition`An enum that shows the transition of the above event state.	`NEW_OPEN`; `REOPEN`; `CLOSE`; `MUTE`; `UNMUTE`
`event.trigger.type`	string	resource stableType of event trigger (for example, whether it was generated by the system, ingested via API, or triggered by the user).	`DT_PLATFORM`; `USER_ACTION`
`event.trigger.user`	string	resource stableID of the user who triggered the event. If generated by Dynatrace, the value is `SYSTEM`.	`SYSTEM`; `<user_id>`
`event.type`	string	stableDisplay name: `Event type`The unique type identifier of a given event.Tags: `permission`	`VULNERABILITY_STATUS_CHANGE_EVENT`; `VULNERABILITY_ASSESSMENT_CHANGE_EVENT`
`timestamp`	timestamp	stableDisplay name: `Timestamp`The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.	`1649822520123123123`

Vulnerability data

Information about the vulnerability at the entity level and its global parent, as well as its previous values.

Attribute	Type	Description	Examples
`entry_points.entry_point_jsons`	string[]	resource deprecatedUse `entry_points` instead.JSON representation of entry points of a vulnerability.	`['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs_json": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']`
`vulnerability.code_location.name`	string	stableDisplay name: `Vulnerability code location name`Name of the code location where the code-level vulnerability was detected.	`org.dynatrace.profileservice.BioController.markdownToHtml(String):80`
`vulnerability.cvss.base_score`	double	stableDisplay name: `Vulnerability CVSS base score`Vulnerability's CVSS base score provided by NVD.	`8.1`
`vulnerability.cvss.vector`	string	experimentalDisplay name: `Vulnerability CVSS vector`Vulnerability's CVSS vector defined by the provider.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.cvss.version`	string	stableDisplay name: `Vulnerability CVSS version`Vulnerability's CVSS score version.	`3.1`; `4.0`
`vulnerability.davis_assessment.assessment_mode`	string	stableDisplay name: `Vulnerability assessment mode`Availability of the information based on which the assessment of the vulnerability at the entity level has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.davis_assessment.assessment_mode_reasons`	string[]	experimentalDisplay name: `Vulnerability Davis assessment mode reasons`Reasons for the assessment mode at the entity level.	`['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']`
`vulnerability.davis_assessment.data_assets_status`	string	stableDisplay name: `Vulnerability data assets status`Affected entity's reachability by a database.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.davis_assessment.exploit_status`	string	stableDisplay name: `Vulnerability exploit status`Public exploits status of the vulnerability at the entity level.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.davis_assessment.exposure_status`	string	stableDisplay name: `Vulnerability exposure status`Internet exposure status of the vulnerability at the entity level.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.davis_assessment.level`	string	stableDisplay name: `Vulnerability Davis security level`Risk level, based on Davis Security Score, of the vulnerability at the entity level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.davis_assessment.score`	double	stableDisplay name: `Vulnerability Davis security score`Davis Security Score (1-10) calculated by Dynatrace for the vulnerability at the entity level.	`8.1`
`vulnerability.davis_assessment.vulnerable_function_status`	string	stableDisplay name: `Vulnerability vulnerable function status`Usage status of the vulnerable functions causing the vulnerability at the entity level.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.description`	string	stableDisplay name: `Vulnerability description`Description of the vulnerability.	`More detailed description about improper input validation vulnerability.`
`vulnerability.display_id`	string	stableDisplay name: `Vulnerability display ID`Dynatrace user-readable identifier for the vulnerability.	`S-1234`
`vulnerability.external_id`	string	stableDisplay name: `Vulnerability external ID`External provider's unique identifier for the vulnerability.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.external_url`	string	stableDisplay name: `Vulnerability external URL`External provider's URL to the details page of the vulnerability.	`https://example.com`
`vulnerability.first_seen`	timestamp	stableDisplay name: `Vulnerability first seen`Timestamp of when the vulnerability at the entity level was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.id`	string	stableDisplay name: `Vulnerability ID`Dynatrace unique identifier for the vulnerability.	`2039861408676243188`
`vulnerability.is_fix_available`	boolean	experimentalDisplay name: `Vulnerability is fix available`Indicates if a vulnerability fix is available.
`vulnerability.mute.change_date`	timestamp	stableDisplay name: `Vulnerability mute change date`Timestamp of the last muted or unmuted action of the vulnerability at the entity level.	`2023-03-22T13:19:36.945Z`
`vulnerability.mute.comment`	string	experimentalDisplay name: `Vulnerability mute comment`Comment for muting or unmuting the vulnerability at entity level.	`Muted because it's a false positive.`
`vulnerability.mute.reason`	string	stableDisplay name: `Vulnerability mute reason`Reason for muting or unmuting the vulnerability at the entity level.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.mute.status`	string	stableDisplay name: `Vulnerability mute status`Mute status of the vulnerability at the entity level.	`MUTED`; `NOT_MUTED`
`vulnerability.mute.user`	string	stableDisplay name: `Vulnerability mute user`User who last changed the mute status of the vulnerability at the entity level.	`user@example.com`
`vulnerability.parent.davis_assessment.assessment_mode`	string	stableDisplay name: `Vulnerability parent assessment mode`Availability of the information based on which the vulnerability assessment has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.parent.davis_assessment.data_assets_status`	string	stableDisplay name: `Vulnerability parent data assets status`Vulnerability's reachability of related data assets by affected entities.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.parent.davis_assessment.exposure_status`	string	stableDisplay name: `Vulnerability parent exposure status`Vulnerability's internet exposure status.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.parent.davis_assessment.level`	string	stableDisplay name: `Vulnerability parent Davis security level`Vulnerability's Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.parent.davis_assessment.score`	double	stableDisplay name: `Vulnerability parent Davis security score`Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.	`8.1`
`vulnerability.parent.davis_assessment.vulnerable_function_status`	string	stableDisplay name: `Vulnerability parent vulnerable function status`Usage status of vulnerable functions causing the vulnerability. Status is `IN_USE` when there's at least one vulnerable function in use by an application.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.parent.first_seen`	string	stableDisplay name: `Vulnerability parent first seen`Timestamp of when the vulnerability was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.parent.mute.change_date`	timestamp	stableDisplay name: `Vulnerability parent mute change date`Timestamp of the last mute or unmute action of the vulnerability.	`2023-03-22T13:19:36.945Z`
`vulnerability.parent.mute.reason`	string	stableDisplay name: `Vulnerability parent mute reason`Reason for muting or unmuting the vulnerability.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.parent.mute.status`	string	stableDisplay name: `Vulnerability parent mute status`Vulnerability's mute status.	`MUTED`; `NOT_MUTED`
`vulnerability.parent.mute.user`	string	stableDisplay name: `Vulnerability parent mute user`User who last changed the vulnerability's mute status.	`user@example.com`
`vulnerability.parent.resolution.change_date`	string	stableDisplay name: `Vulnerability parent resolution change date`Timestamp of the vulnerability's last resolution status change.	`2023-03-22T13:19:37.466Z`
`vulnerability.parent.resolution.status`	string	stableDisplay name: `Vulnerability parent resolution status`Current status of the vulnerability.	`OPEN`; `RESOLVED`
`vulnerability.parent.risk.level`	string	stableDisplay name: `Vulnerability parent risk level`Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.parent.risk.score`	double	stableDisplay name: `Vulnerability parent risk score`Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.previous.cvss.base_score`	double	stableDisplay name: `Vulnerability previous CVSS base score`Vulnerability's previous CVSS base score (in case the CVSS base score has changed).	`8.1`
`vulnerability.previous.davis_assessment.data_assets_status`	string	stableDisplay name: `Vulnerability previous data assets status`Vulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.previous.davis_assessment.exploit_status`	string	stableDisplay name: `Vulnerability previous exploit status`Vulnerability's previous public exploit status (in case the public exploit status has changed).	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.previous.davis_assessment.exposure_status`	string	stableDisplay name: `Vulnerability previous exposure status`Vulnerability's previous internet exposure status (in case the internet exposure status has changed).	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.previous.davis_assessment.level`	string	stableDisplay name: `Vulnerability previous Davis security level`Vulnerability's previous risk level (in case the risk level has changed).	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.previous.davis_assessment.score`	double	stableDisplay name: `Vulnerability previous Davis security score`Vulnerability's previous Davis Security Score (in case Davis Security Score has changed).	`8.1`
`vulnerability.previous.davis_assessment.vulnerable_function_status`	string	stableDisplay name: `Vulnerability previous vulnerable function status`Vulnerability's previous vulnerable function status (in case the vulnerable function status has changed).	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.previous.external_id`	string	experimentalDisplay name: `Vulnerability previous external ID`Vulnerability’s unique identifier from the previous external provider.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.previous.mute.change_date`	string	stableDisplay name: `Vulnerability previous mute change date`Timestamp of the vulnerability's previous mute status (in case the mute status has changed).	`2023-03-22T13:19:36.945Z`
`vulnerability.previous.mute.comment`	string	experimentalDisplay name: `Vulnerability previous mute comment`Comment of the vulnerability's previous mute status.	`Muted because it's a false positive.`
`vulnerability.previous.mute.reason`	string	stableDisplay name: `Vulnerability previous mute reason`Reason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).	`Muted: False positive`
`vulnerability.previous.mute.status`	string	stableDisplay name: `Vulnerability previous mute status`Vulnerability's previous mute status (in case the mute status has changed).	`MUTED`; `NOT_MUTED`
`vulnerability.previous.mute.user`	string	stableDisplay name: `Vulnerability previous mute user`User who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).	`user@example.com`
`vulnerability.previous.resolution.status`	string	stableDisplay name: `Vulnerability previous resolution status`Vulnerability's previous resolution status (in case the resolution status has changed).	`OPEN`; `RESOLVED`
`vulnerability.previous.risk.level`	string	stableDisplay name: `Vulnerability previous risk level`Vulnerability's previous risk score level (in case the risk score level has changed).	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`
`vulnerability.previous.risk.score`	double	stableDisplay name: `Vulnerability previous risk score`Vulnerability's previous risk score (in case the risk score has changed).	`8.1`
`vulnerability.previous.tracking_link.text`	string	experimentalDisplay name: `Vulnerability previous tracking link text`Display text of the previous tracking link that was set by the user.	`P-1000 Vulnerability CVE-2024-0001`
`vulnerability.previous.tracking_link.url`	string	experimentalDisplay name: `Vulnerability previous tracking link URL`URL of the previous tracking link that was set by the user.	`https://example.com/Project1/P-1000`
`vulnerability.references.cve`	string[]	stableDisplay name: `Vulnerability CVE references`List of the vulnerability's CVE IDs.	`['CVE-2021-41079']`
`vulnerability.references.cwe`	string[]	stableDisplay name: `Vulnerability CWE references`List of the vulnerability's CWE IDs.	`['CWE-20']`
`vulnerability.references.owasp`	string[]	stableDisplay name: `Vulnerability OWASP references`List of vulnerability's OWASP IDs.	`['2021:A3']`
`vulnerability.remediation.description`	string	experimentalDisplay name: `Vulnerability remediation description`Description of the vulnerability's remediation advice.	`Upgrade component to version 1.2.3 or higher`
`vulnerability.resolution.change_date`	timestamp	stableDisplay name: `Vulnerability resolution change date`Timestamp of the last resolution status change of the vulnerability at the entity level.	`2023-03-22T13:19:37.466Z`
`vulnerability.resolution.status`	string	stableDisplay name: `Vulnerability resolution status`Resolution status of the vulnerability at the entity level.	`OPEN`; `RESOLVED`
`vulnerability.risk.level`	string	stableDisplay name: `Vulnerability risk level`Vulnerability's risk score level defined by the provider at the entity level. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.risk.scale`	string	stableDisplay name: `Vulnerability risk scale`Scale by which the risk score and risk score level defined by the provider for the vulnerability at the entity level are measured.	`Davis Security Score`
`vulnerability.risk.score`	double	stableDisplay name: `Vulnerability risk score`Risk score defined by the provider for the vulnerability at the entity level. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.stack`	string	experimentalDisplay name: `Vulnerability stack`Level of the vulnerable component in the technological stack.	`CODE`; `CODE_LIBRARY`; `SOFTWARE`; `CONTAINER_ORCHESTRATION`
`vulnerability.technology`	string	stableDisplay name: `Vulnerability technology`Technology of the vulnerable component.	`JAVA`; `DOTNET`; `GO`; `PHP`; `NODE_JS`
`vulnerability.title`	string	stableDisplay name: `Vulnerability title`Title of the vulnerability.	`Improper Input Validation`
`vulnerability.tracking_link.text`	string	experimentalDisplay name: `Vulnerability tracking link text`Display text of the tracking link that was set by the user.	`P-1000 Vulnerability CVE-2024-0001`
`vulnerability.tracking_link.url`	string	experimentalDisplay name: `Vulnerability tracking link URL`URL of the tracking link that was set by the user.	`https://example.com/Project1/P-1000`
`vulnerability.type`	string	stableDisplay name: `Vulnerability type`Classification of the vulnerability based on commonly accepted enums, such as CWE.	`Improper Input Validation`
`vulnerability.url`	string	stableDisplay name: `Vulnerability URL`Dynatrace URL to the details page of the vulnerability. \|	`https://example.com`

Extensions

Affected entity

Information about the vulnerability's affected entity and related entities.

Attribute	Type	Description	Examples
`affected_entity.affected_processes.ids`	array	resource stableIDs of the processes that are currently affected by the vulnerability.	`PROCESS_GROUP_INSTANCE-1`
`affected_entity.affected_processes.names`	array	resource stableNames of the processes that are currently affected by the vulnerability.	`prod_process_group_instance_1`
`affected_entity.id`	string	resource stableID of the affected entity.	`PROCESS_GROUP-1`; `HOST-1`
`affected_entity.management_zones.ids`	array	resource stableIDs of the management zones to which the affected entity belongs.	`mzid1`
`affected_entity.management_zones.names`	array	resource stableNames of the management zones to which the affected entity belongs.	`mz1`
`affected_entity.name`	string	resource stableName of the affected entity.	`prod_process_group_1`; `prod_host`
`affected_entity.reachable_data_assets.count`	long	resource experimentalNumber of reachable data assets.	`1`
`affected_entity.reachable_data_assets.ids`	array	resource experimentalIDs of the data assets that can be reached by the affected entities of the vulnerability.	`DATABASE-1`
`affected_entity.reachable_data_assets.names`	array	resource experimentalNames of the data assets that can be reached by the affected entities of the vulnerability.	`prod_database_1`
`affected_entity.type`	string	resource stableType of affected entity.	`PROCESS_GROUP`; `HOST`; `KUBERNETES_NODE`
`affected_entity.vulnerable_component.id`	string	resource stableID of the vulnerable component causing the vulnerability.	`SOFTWARE_COMPONENT-D8FCFFB4FDF7A3FF`
`affected_entity.vulnerable_component.name`	string	resource stableName of the vulnerable component causing the vulnerability.	`log4j-core-2.6.2.jar`
`affected_entity.vulnerable_component.package_name`	string	resource experimentalPackage name of the vulnerable component causing the vulnerability.	`k8s.io/kubernetes`; `github.com/kubernetes/kubernetes/pkg/kubelet/kuberuntime`
`affected_entity.vulnerable_component.short_name`	string	resource stableShort name of the vulnerable component causing the vulnerability.	`log4j`
`affected_entity.vulnerable_functions`	array	resource stableVulnerable functions detected, containing or causing the vulnerability.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`
`affected_entity.vulnerable_functions_not_available`	array	resource experimentalVulnerable functions detected which Dynatrace can't tell if they're in use due to limited insights.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`
`affected_entity.vulnerable_functions_not_in_use`	array	resource experimentalVulnerable functions detected which are not actively used.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`

Attribute	Type	Description	Examples
`related_entities.applications.count`	long	resource stableNumber of related applications.	`1`
`related_entities.applications.ids`	array	resource stableIDs of the applications related to the vulnerability's affected entities.	`APPLICATION-1`
`related_entities.databases.count`	long	resource stableNumber of related databases.	`1`
`related_entities.databases.ids`	array	resource stableIDs of the databases related to the vulnerability's affected entities.	`DATABASE-1`
`related_entities.hosts.count`	long	resource stableNumber of related hosts.	`1`
`related_entities.hosts.ids`	array	resource stableIDs of the hosts related to the vulnerability's affected entities.	`HOST-1`
`related_entities.kubernetes_clusters.count`	long	resource stableNumber of related Kubernetes clusters.	`1`
`related_entities.kubernetes_clusters.ids`	array	resource stableIDs of the Kubernetes clusters related to the vulnerability's affected entities.	`KUBERNETES_CLUSTER-1`
`related_entities.kubernetes_workloads.count`	long	resource stableNumber of related Kubernetes workloads.	`1`
`related_entities.kubernetes_workloads.ids`	array	resource stableIDs of the Kubernetes workloads related to the vulnerability's affected entities.	`KUBERNETES_WORKLOAD-1`
`related_entities.services.count`	long	resource stableNumber of related services.	`1`
`related_entities.services.ids`	array	resource stableIDs of the services related to the vulnerability's affected entities.	`SERVICE-1`

Examples

Runtime Vulnerability Analytics — Entity-level vulnerability status changed to resolved

A vulnerability status change event at the entity level, generated when Dynatrace resolved the vulnerability for a specific process group after the library was updated.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_STATUS_CHANGE_EVENT",
  "event.level": "ENTITY",
  "event.group_label": "CHANGE_EVENT",
  "event.provider": "Dynatrace",
  "event.provider_product": "Runtime Vulnerability Analytics",

  "event.description": "Status of S-8418 Apache MINA vulnerable to Deserialization of Untrusted Data for BloatedJavaSoftwareGroup-IG-1 has changed to RESOLVED",
  "event.status_transition": "CLOSE",
  "event.status": "RESOLVED",
  "event.trigger.type": "DT_PLATFORM",
  "event.trigger.user": "SYSTEM",
  "event.change_list": ["vulnerability.resolution.status"],

  "vulnerability.id": "18269550188425474761",
  "vulnerability.display_id": "S-8418",
  "vulnerability.external_id": "DTV-2026-JAVA-0000321",
  "vulnerability.title": "Apache MINA vulnerable to Deserialization of Untrusted Data",
  "vulnerability.references.cve": ["CVE-2026-41635"],
  "vulnerability.risk.level": "CRITICAL",
  "vulnerability.risk.score": 9.8,
  "vulnerability.resolution.status": "RESOLVED",
  "vulnerability.previous.resolution.status": "OPEN",
  "vulnerability.mute.status": "NOT_MUTED",
  "vulnerability.stack": "CODE_LIBRARY",
  "vulnerability.type": "Deserialization of Untrusted Data",
  "vulnerability.technology": "JAVA",

  "affected_entity.id": "PROCESS_GROUP-A15E7F3CFFF5B15F",
  "affected_entity.name": "BloatedJavaSoftwareGroup-IG-1",
  "affected_entity.type": "PROCESS_GROUP"
}

Entity state

Entity state events are historical vulnerability states reported at the entity level. The current vulnerability state per entity is exported to Grail regularly.

Query

Query entity state events.

fetch security.events
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATE_REPORT_EVENT"
| filter event.level == "ENTITY"

Event data

General event information.

Attribute	Type	Description	Examples
`event.category`	string	stableDisplay name: `Event category`Categorization based on the product and data generating this event.	`VULNERABILITY_MANAGEMENT`
`event.description`	string	stableDisplay name: `Event description`Human-readable description of an event.	`S-49 Remote Code Execution state event reported`
`event.group_label`	string	experimentalDisplay name: `Event group label`Group label of an event.	`STATE_REPORT`
`event.kind`	string	stableDisplay name: `Event kind`Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: `permission`	`SECURITY_EVENT`
`event.level`	string	resource stableMain reference point to which the event or data is related. Possible values are `Vulnerability` (shows the global aggregation across the entire environment and comprises all entities and management zones) and `Entity` (shows the assessment based on the entity itself).	`ENTITY`
`event.name`	string	stableDisplay name: `Event name`The human readable display name of an event type.	`Vulnerability historical state report event`
`event.provider`	string	stableDisplay name: `Event provider`Source of the event, for example, the name of the component or system that generated the event.Tags: `permission`	`OneAgent`; `K8S`; `Davis`; `VMWare`; `GCP`; `AWS`; `LIMA_USAGE_STREAM`
`event.provider_product`	string	resource stableName of the product providing this event.	`Runtime Vulnerability Analytics`; `Snyk Container`
`event.status`	string	stableDisplay name: `Event status`Status of an event as being either Active or Closed.	`OPEN`; `RESOLVED`; `MUTED`
`event.type`	string	stableDisplay name: `Event type`The unique type identifier of a given event.Tags: `permission`	`VULNERABILITY_STATE_REPORT_EVENT`
`timestamp`	timestamp	stableDisplay name: `Timestamp`The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.	`1649822520123123123`

Vulnerability data

Information about the vulnerability at the entity level and its global vulnerability, with a focus on the affected entities

Attribute	Type	Description	Examples
`entry_points.entry_point_jsons`	string[]	resource deprecatedUse `entry_points` instead.JSON representation of entry points of a vulnerability.	`['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs_json": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']`
`vulnerability.code_location.name`	string	stableDisplay name: `Vulnerability code location name`Name of the code location where the code-level vulnerability was detected.	`org.dynatrace.profileservice.BioController.markdownToHtml(String):80`
`vulnerability.cvss.base_score`	double	stableDisplay name: `Vulnerability CVSS base score`Vulnerability's CVSS base score provided by NVD.	`8.1`
`vulnerability.cvss.vector`	string	experimentalDisplay name: `Vulnerability CVSS vector`Vulnerability's CVSS vector defined by the provider.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.cvss.version`	string	stableDisplay name: `Vulnerability CVSS version`Vulnerability's CVSS score version.	`3.1`; `4.0`
`vulnerability.davis_assessment.assessment_mode`	string	stableDisplay name: `Vulnerability assessment mode`Availability of the information based on which the assessment of the vulnerability at the entity level has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.davis_assessment.assessment_mode_reasons`	string[]	experimentalDisplay name: `Vulnerability Davis assessment mode reasons`Reasons for the assessment mode at the entity level.	`['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']`
`vulnerability.davis_assessment.data_assets_status`	string	stableDisplay name: `Vulnerability data assets status`Affected entity's reachability by a database.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.davis_assessment.exploit_status`	string	stableDisplay name: `Vulnerability exploit status`Public exploits status of the vulnerability at the entity level.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.davis_assessment.exposure_status`	string	stableDisplay name: `Vulnerability exposure status`Internet exposure status of the vulnerability at the entity level.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.davis_assessment.level`	string	stableDisplay name: `Vulnerability Davis security level`Risk level, based on Davis Security Score, of the vulnerability at the entity level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.davis_assessment.score`	double	stableDisplay name: `Vulnerability Davis security score`Davis Security Score (1-10) calculated by Dynatrace for the vulnerability at the entity level.	`8.1`
`vulnerability.davis_assessment.vector`	string	experimentalDisplay name: `Vulnerability Davis assessment vector`Vulnerability's CVSS vector, adjusted with observability data; this vector is calculated by Dynatrace.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.davis_assessment.vulnerable_function_status`	string	stableDisplay name: `Vulnerability vulnerable function status`Usage status of the vulnerable functions causing the vulnerability at the entity level.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.description`	string	stableDisplay name: `Vulnerability description`Description of the vulnerability.	`More detailed description about improper input validation vulnerability.`
`vulnerability.display_id`	string	stableDisplay name: `Vulnerability display ID`Dynatrace user-readable identifier for the vulnerability.	`S-1234`
`vulnerability.external_id`	string	stableDisplay name: `Vulnerability external ID`External provider's unique identifier for the vulnerability.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.external_url`	string	stableDisplay name: `Vulnerability external URL`External provider's URL to the details page of the vulnerability.	`https://example.com`
`vulnerability.id`	string	stableDisplay name: `Vulnerability ID`Dynatrace unique identifier for the vulnerability.	`2039861408676243188`
`vulnerability.is_fix_available`	boolean	experimentalDisplay name: `Vulnerability is fix available`Indicates if a vulnerability fix is available.
`vulnerability.mute.change_date`	timestamp	stableDisplay name: `Vulnerability mute change date`Timestamp of the last muted or unmuted action of the vulnerability at the entity level.	`2023-03-22T13:19:36.945Z`
`vulnerability.mute.comment`	string	experimentalDisplay name: `Vulnerability mute comment`Comment for muting or unmuting the vulnerability at entity level.	`Muted because it's a false positive.`
`vulnerability.mute.reason`	string	stableDisplay name: `Vulnerability mute reason`Reason for muting or unmuting the vulnerability at the entity level.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.mute.status`	string	stableDisplay name: `Vulnerability mute status`Mute status of the vulnerability at the entity level.	`MUTED`; `NOT_MUTED`
`vulnerability.mute.user`	string	stableDisplay name: `Vulnerability mute user`User who last changed the mute status of the vulnerability at the entity level.	`user@example.com`
`vulnerability.parent.davis_assessment.assessment_mode`	string	stableDisplay name: `Vulnerability parent assessment mode`Availability of the information based on which the vulnerability assessment has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.parent.davis_assessment.data_assets_status`	string	stableDisplay name: `Vulnerability parent data assets status`Vulnerability's reachability of related data assets by affected entities.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.parent.davis_assessment.exposure_status`	string	stableDisplay name: `Vulnerability parent exposure status`Vulnerability's internet exposure status.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.parent.davis_assessment.level`	string	stableDisplay name: `Vulnerability parent Davis security level`Vulnerability's Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.parent.davis_assessment.score`	double	stableDisplay name: `Vulnerability parent Davis security score`Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.	`8.1`
`vulnerability.parent.davis_assessment.vulnerable_function_status`	string	stableDisplay name: `Vulnerability parent vulnerable function status`Usage status of vulnerable functions causing the vulnerability. Status is `IN_USE` when there's at least one vulnerable function in use by an application.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.parent.first_seen`	string	stableDisplay name: `Vulnerability parent first seen`Timestamp of when the vulnerability was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.parent.mute.change_date`	timestamp	stableDisplay name: `Vulnerability parent mute change date`Timestamp of the last mute or unmute action of the vulnerability.	`2023-03-22T13:19:36.945Z`
`vulnerability.parent.mute.reason`	string	stableDisplay name: `Vulnerability parent mute reason`Reason for muting or unmuting the vulnerability.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.parent.mute.status`	string	stableDisplay name: `Vulnerability parent mute status`Vulnerability's mute status.	`MUTED`; `NOT_MUTED`
`vulnerability.parent.mute.user`	string	stableDisplay name: `Vulnerability parent mute user`User who last changed the vulnerability's mute status.	`user@example.com`
`vulnerability.parent.resolution.change_date`	string	stableDisplay name: `Vulnerability parent resolution change date`Timestamp of the vulnerability's last resolution status change.	`2023-03-22T13:19:37.466Z`
`vulnerability.parent.resolution.status`	string	stableDisplay name: `Vulnerability parent resolution status`Current status of the vulnerability.	`OPEN`; `RESOLVED`
`vulnerability.parent.risk.level`	string	stableDisplay name: `Vulnerability parent risk level`Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.parent.risk.score`	double	stableDisplay name: `Vulnerability parent risk score`Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.references.cve`	string[]	stableDisplay name: `Vulnerability CVE references`List of the vulnerability's CVE IDs.	`['CVE-2021-41079']`
`vulnerability.references.cwe`	string[]	stableDisplay name: `Vulnerability CWE references`List of the vulnerability's CWE IDs.	`['CWE-20']`
`vulnerability.references.owasp`	string[]	stableDisplay name: `Vulnerability OWASP references`List of vulnerability's OWASP IDs.	`['2021:A3']`
`vulnerability.remediation.description`	string	experimentalDisplay name: `Vulnerability remediation description`Description of the vulnerability's remediation advice.	`Upgrade component to version 1.2.3 or higher`
`vulnerability.resolution.change_date`	timestamp	stableDisplay name: `Vulnerability resolution change date`Timestamp of the last status change of the vulnerability at the entity level.	`2023-03-22T13:19:37.466Z`
`vulnerability.resolution.status`	string	stableDisplay name: `Vulnerability resolution status`Resolution status of the vulnerability at the entity level.	`OPEN`; `RESOLVED`
`vulnerability.risk.level`	string	stableDisplay name: `Vulnerability risk level`Vulnerability's risk score level defined by the provider at the entity level. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.risk.scale`	string	stableDisplay name: `Vulnerability risk scale`Scale by which the risk score and risk score level defined by the provider for the vulnerability at the entity level are measured.	`Davis Security Score`
`vulnerability.risk.score`	double	stableDisplay name: `Vulnerability risk score`Risk score defined by the provider for the vulnerability at the entity level. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.stack`	string	experimentalDisplay name: `Vulnerability stack`Level of the vulnerable component in the technological stack.	`CODE`; `CODE_LIBRARY`; `SOFTWARE`; `CONTAINER_ORCHESTRATION`
`vulnerability.technology`	string	stableDisplay name: `Vulnerability technology`Technology of the vulnerable component.	`JAVA`; `DOTNET`; `GO`; `PHP`; `NODE_JS`
`vulnerability.title`	string	stableDisplay name: `Vulnerability title`Title of the vulnerability.	`Improper Input Validation`
`vulnerability.tracking_link.text`	string	experimentalDisplay name: `Vulnerability tracking link text`Display text of the tracking link that was set by the user.	`P-1000 Vulnerability CVE-2024-0001`
`vulnerability.tracking_link.url`	string	experimentalDisplay name: `Vulnerability tracking link URL`URL of the tracking link that was set by the user.	`https://example.com/Project1/P-1000`
`vulnerability.type`	string	stableDisplay name: `Vulnerability type`Classification of the vulnerability based on commonly accepted enums, such as CWE.	`Improper Input Validation`
`vulnerability.url`	string	stableDisplay name: `Vulnerability URL`Dynatrace URL to the details page of the vulnerability. \|	`https://example.com`

Extensions

This section contains information about the vulnerability's affected and related entities.

Affected entity fields

Attribute	Type	Description	Examples
`affected_entity.affected_processes.ids`	array	resource stableIDs of the processes that are currently affected by the vulnerability.	`PROCESS_GROUP_INSTANCE-1`
`affected_entity.affected_processes.names`	array	resource stableNames of the processes that are currently affected by the vulnerability.	`prod_process_group_instance_1`
`affected_entity.id`	string	resource stableID of the affected entity.	`PROCESS_GROUP-1`; `HOST-1`
`affected_entity.management_zones.ids`	array	resource stableIDs of the management zones to which the affected entity belongs.	`mzid1`
`affected_entity.management_zones.names`	array	resource stableNames of the management zones to which the affected entity belongs.	`mz1`
`affected_entity.name`	string	resource stableName of the affected entity.	`prod_process_group_1`; `prod_host`
`affected_entity.reachable_data_assets.count`	long	resource experimentalNumber of reachable data assets.	`1`
`affected_entity.reachable_data_assets.ids`	array	resource experimentalIDs of the data assets that can be reached by the affected entities of the vulnerability.	`DATABASE-1`
`affected_entity.reachable_data_assets.names`	array	resource experimentalNames of the data assets that can be reached by the affected entities of the vulnerability.	`prod_database_1`
`affected_entity.type`	string	resource stableType of affected entity.	`PROCESS_GROUP`; `HOST`; `KUBERNETES_NODE`
`affected_entity.vulnerable_component.id`	string	resource stableID of the vulnerable component causing the vulnerability.	`SOFTWARE_COMPONENT-D8FCFFB4FDF7A3FF`
`affected_entity.vulnerable_component.name`	string	resource stableName of the vulnerable component causing the vulnerability.	`log4j-core-2.6.2.jar`
`affected_entity.vulnerable_component.package_name`	string	resource experimentalPackage name of the vulnerable component causing the vulnerability.	`k8s.io/kubernetes`; `github.com/kubernetes/kubernetes/pkg/kubelet/kuberuntime`
`affected_entity.vulnerable_component.short_name`	string	resource stableShort name of the vulnerable component causing the vulnerability.	`log4j`
`affected_entity.vulnerable_functions`	array	resource stableVulnerable functions detected, containing or causing the vulnerability.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`
`affected_entity.vulnerable_functions_not_available`	array	resource experimentalVulnerable functions detected which Dynatrace can't tell if they're in use due to limited insights.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`
`affected_entity.vulnerable_functions_not_in_use`	array	resource experimentalVulnerable functions detected which are not actively used.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`

Attribute	Type	Description	Examples
`related_entities.applications.count`	long	resource stableNumber of related applications.	`1`
`related_entities.applications.ids`	array	resource stableIDs of the applications related to the vulnerability's affected entities.	`APPLICATION-1`
`related_entities.applications.names`	array	resource stableNames of the applications related to the vulnerability's affected entities.	`prod_application_1`
`related_entities.databases.count`	long	resource stableNumber of related databases.	`1`
`related_entities.databases.ids`	array	resource stableIDs of the databases related to the vulnerability's affected entities.	`DATABASE-1`
`related_entities.databases.names`	array	resource stableNames of the databases related to the vulnerability's affected entities.	`prod_database_1`
`related_entities.hosts.count`	long	resource stableNumber of related hosts.	`1`
`related_entities.hosts.ids`	array	resource stableIDs of the hosts related to the vulnerability's affected entities.	`HOST-1`
`related_entities.hosts.names`	array	resource stableNames of the hosts related to the vulnerability's affected entities.	`prod_host_1`
`related_entities.kubernetes_clusters.count`	long	resource stableNumber of related Kubernetes clusters.	`1`
`related_entities.kubernetes_clusters.ids`	array	resource stableIDs of the Kubernetes clusters related to the vulnerability's affected entities.	`KUBERNETES_CLUSTER-1`
`related_entities.kubernetes_clusters.names`	array	resource stableNames of the Kubernetes clusters related to the vulnerability's affected entities.	`prod_kubernetes_cluster_1`
`related_entities.kubernetes_workloads.count`	long	resource stableNumber of related Kubernetes workloads.	`1`
`related_entities.kubernetes_workloads.ids`	array	resource stableIDs of the Kubernetes workloads related to the vulnerability's affected entities.	`KUBERNETES_WORKLOAD-1`
`related_entities.kubernetes_workloads.names`	array	resource stableNames of the Kubernetes workloads related to the vulnerability's affected entities.	`prod_kubernetes_workload_1`
`related_entities.services.count`	long	resource stableNumber of related services.	`1`
`related_entities.services.ids`	array	resource stableIDs of the services related to the vulnerability's affected entities.	`SERVICE-1`
`related_entities.services.names`	array	resource stableNames of the services related to the vulnerability's affected entities.	`prod_service_1`

Examples

Runtime Vulnerability Analytics — Entity-level vulnerability state snapshot

A vulnerability state report event at the entity level, showing the current state of an open vulnerability for a specific process group and the vulnerable component it contains.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_STATE_REPORT_EVENT",
  "event.level": "ENTITY",
  "event.group_label": "STATE_REPORT",
  "event.provider": "Dynatrace",
  "event.provider_product": "Runtime Vulnerability Analytics",

  "event.description": "S-5774 Potential to access user credentials from the log files when debug logging enabled state event reported",
  "event.status": "OPEN",

  "vulnerability.id": "10985110393469819658",
  "vulnerability.display_id": "S-5774",
  "vulnerability.external_id": "DTV-2019-JAVA-0000054",
  "vulnerability.title": "Potential to access user credentials from the log files when debug logging enabled",
  "vulnerability.references.cve": ["CVE-2019-10212"],
  "vulnerability.risk.level": "CRITICAL",
  "vulnerability.risk.score": 9.8,
  "vulnerability.resolution.status": "OPEN",
  "vulnerability.mute.status": "NOT_MUTED",
  "vulnerability.stack": "CODE_LIBRARY",
  "vulnerability.type": "Insertion of Sensitive Information into Log File",
  "vulnerability.technology": "JAVA",

  "affected_entity.id": "PROCESS_GROUP-A15E7F3CFFF5B15F",
  "affected_entity.name": "BloatedJavaSoftwareGroup-IG-1",
  "affected_entity.type": "PROCESS_GROUP",
  "affected_entity.vulnerable_component.name": "io.undertow:undertow-core:1.4.18.Final",
  "affected_entity.vulnerable_component.short_name": "undertow-core"
}

Vulnerability change

Vulnerability change events are change events at the vulnerability level. An event is generated whenever a vulnerability undergoes a status or assessment change.

Query

Query vulnerability status change events.

fetch security.events
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATUS_CHANGE_EVENT"

Query vulnerability assessment change events.

fetch security.events
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_ASSESSMENT_CHANGE_EVENT"

Event data fields

General event information.

Attribute	Type	Description	Examples
`event.category`	string	stableDisplay name: `Event category`Standard categorization based on the significance of an event according to the ITIL event management standard (previously known as `severity level`).	`VULNERABILITY_MANAGEMENT`
`event.change_list`	array	resource stableList of attributes updated as part of the change event. Values in the list match a `previous` field.	`vulnerability.risk.score`; `affected_entities.count`; `related_entities.databases.count`
`event.description`	string	stableDisplay name: `Event description`Human-readable description of an event.	`S-49 Remote Code Execution status has changed to OPEN.`; `S-49 Remote Code Execution assessment has changed.`
`event.group_label`	string	experimentalDisplay name: `Event group label`Group label of an event.	`CHANGE_EVENT`
`event.kind`	string	stableDisplay name: `Event kind`Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: `permission`	`SECURITY_EVENT`
`event.level`	string	resource stableMain reference point to which the event or data is related. Possible values are `Vulnerability` (shows the global aggregation across the entire environment and comprises all entities and management zones) and `Entity` (shows the assessment based on the entity itself).	`VULNERABILITY`
`event.name`	string	stableDisplay name: `Event name`The human readable display name of an event type.	`Vulnerability status change event`; `Vulnerability assessment change event`; `Vulnerability external ID change event`
`event.provider`	string	stableDisplay name: `Event provider`Source of the event, for example, the name of the component or system that generated the event.Tags: `permission`	`Dynatrace`
`event.provider_product`	string	resource stableName of the product providing this event.	`Runtime Vulnerability Analytics`; `Snyk Container`
`event.status`	string	stableDisplay name: `Event status`Status of an event as being either Active or Closed.	`OPEN`; `RESOLVED`; `MUTED`
`event.status_transition`	string	experimentalDisplay name: `Status transition`An enum that shows the transition of the above event state.	`NEW_OPEN`; `REOPEN`; `CLOSE`; `MUTE`; `UNMUTE`
`event.trigger.type`	string	resource stableType of event trigger (for example, whether it was generated by the system, ingested via API, or triggered by the user).	`DT_PLATFORM`; `USER_ACTION`
`event.trigger.user`	string	resource stableID of the user who triggered the event. If generated by Dynatrace, the value is `SYSTEM`.	`SYSTEM`; `<user_id>`
`event.type`	string	stableDisplay name: `Event type`The unique type identifier of a given event.Tags: `permission`	`VULNERABILITY_STATUS_CHANGE_EVENT`; `VULNERABILITY_ASSESSMENT_CHANGE_EVENT`; `VULNERABILITY_EXTERNAL_ID_CHANGE_EVENT`
`timestamp`	timestamp	stableDisplay name: `Timestamp`The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.	`1649822520123123123`

Vulnerability data fields

Information about the vulnerability and its status and assessment changes.

Attribute	Type	Description	Examples
`vulnerability.cvss.base_score`	double	stableDisplay name: `Vulnerability CVSS base score`Vulnerability's CVSS base score provided by NVD.	`8.1`
`vulnerability.cvss.vector`	string	experimentalDisplay name: `Vulnerability CVSS vector`Vulnerability's CVSS vector defined by the provider.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.cvss.version`	string	stableDisplay name: `Vulnerability CVSS version`Vulnerability's CVSS score version.	`3.1`; `4.0`
`vulnerability.davis_assessment.assessment_mode`	string	stableDisplay name: `Vulnerability assessment mode`Availability of the information based on which the vulnerability assessment has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.davis_assessment.assessment_mode_reasons`	string[]	experimentalDisplay name: `Vulnerability Davis assessment mode reasons`Reasons for the assessment mode.	`['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']`
`vulnerability.davis_assessment.data_assets_status`	string	stableDisplay name: `Vulnerability data assets status`Vulnerability's reachability of related data assets by affected entities.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.davis_assessment.exploit_status`	string	stableDisplay name: `Vulnerability exploit status`Vulnerability's public exploits status.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.davis_assessment.exposure_status`	string	stableDisplay name: `Vulnerability exposure status`Vulnerability's internet exposure status.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.davis_assessment.level`	string	stableDisplay name: `Vulnerability Davis security level`Vulnerability's risk level based on Davis Security Score.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.davis_assessment.score`	double	stableDisplay name: `Vulnerability Davis security score`Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.	`8.1`
`vulnerability.davis_assessment.vulnerable_function_status`	string	stableDisplay name: `Vulnerability vulnerable function status`Usage status of the vulnerable functions causing the vulnerability.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.description`	string	stableDisplay name: `Vulnerability description`Description of the vulnerability.	`More detailed description about improper input validation vulnerability.`
`vulnerability.display_id`	string	stableDisplay name: `Vulnerability display ID`Dynatrace user-readable identifier for the vulnerability.	`S-1234`
`vulnerability.external_id`	string	stableDisplay name: `Vulnerability external ID`External provider's unique identifier for the vulnerability.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.external_url`	string	stableDisplay name: `Vulnerability external URL`External provider's URL to the details page of the vulnerability.	`https://example.com`
`vulnerability.first_seen`	timestamp	stableDisplay name: `Vulnerability first seen`Timestamp of when the vulnerability was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.id`	string	stableDisplay name: `Vulnerability ID`Dynatrace unique identifier for the vulnerability.	`2039861408676243188`
`vulnerability.is_fix_available`	boolean	experimentalDisplay name: `Vulnerability is fix available`Indicates if a vulnerability fix is available.
`vulnerability.mute.change_date`	timestamp	stableDisplay name: `Vulnerability mute change date`Timestamp of the vulnerability's last muted or unmuted action.	`2023-03-22T13:19:36.945Z`
`vulnerability.mute.reason`	string	stableDisplay name: `Vulnerability mute reason`Reason for muting or unmuting the vulnerability.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.mute.status`	string	stableDisplay name: `Vulnerability mute status`Vulnerability's mute status.	`MUTED`; `NOT_MUTED`
`vulnerability.mute.user`	string	stableDisplay name: `Vulnerability mute user`User who last changed the vulnerability's mute status.	`user@example.com`
`vulnerability.previous.cvss.base_score`	double	stableDisplay name: `Vulnerability previous CVSS base score`Vulnerability's previous CVSS base score (in case the CVSS base score has changed).	`8.1`
`vulnerability.previous.cvss.vector`	string	experimentalDisplay name: `Vulnerability previous CVSS vector`Vulnerability's previous CVSS vector defined by the provider (in case the CVSS vector has changed).	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.previous.davis_assessment.data_assets_status`	string	stableDisplay name: `Vulnerability previous data assets status`Vulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.previous.davis_assessment.exploit_status`	string	stableDisplay name: `Vulnerability previous exploit status`Vulnerability's previous public exploit status (in case the public exploit status has changed).	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.previous.davis_assessment.exposure_status`	string	stableDisplay name: `Vulnerability previous exposure status`Vulnerability's previous internet exposure status (in case the internet exposure status has changed).	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.previous.davis_assessment.level`	string	stableDisplay name: `Vulnerability previous Davis security level`Vulnerability's previous risk level (in case the risk level has changed).	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.previous.davis_assessment.score`	double	stableDisplay name: `Vulnerability previous Davis security score`Vulnerability's previous Davis Security Score (in case Davis Security Score has changed).	`8.1`
`vulnerability.previous.davis_assessment.vulnerable_function_status`	string	stableDisplay name: `Vulnerability previous vulnerable function status`Vulnerability's previous vulnerable function status (in case the vulnerable function status has changed).	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.previous.mute.change_date`	string	stableDisplay name: `Vulnerability previous mute change date`Timestamp of the vulnerability's previous mute status (in case the mute status has changed).	`2023-03-22T13:19:36.945Z`
`vulnerability.previous.mute.reason`	string	stableDisplay name: `Vulnerability previous mute reason`Reason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).	`Muted: False positive`
`vulnerability.previous.mute.status`	string	stableDisplay name: `Vulnerability previous mute status`Vulnerability's previous mute status (in case the mute status has changed).	`MUTED`; `NOT_MUTED`
`vulnerability.previous.mute.user`	string	stableDisplay name: `Vulnerability previous mute user`User who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).	`user@example.com`
`vulnerability.previous.resolution.status`	string	stableDisplay name: `Vulnerability previous resolution status`Vulnerability's previous resolution status (in case the resolution status has changed).	`OPEN`; `RESOLVED`
`vulnerability.previous.risk.level`	string	stableDisplay name: `Vulnerability previous risk level`Vulnerability's previous risk score level (in case the risk score level has changed).	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`
`vulnerability.previous.risk.score`	double	stableDisplay name: `Vulnerability previous risk score`Vulnerability's previous risk score (in case the risk score has changed).	`8.1`
`vulnerability.references.cve`	string[]	stableDisplay name: `Vulnerability CVE references`List of the vulnerability's CVE IDs.	`['CVE-2021-41079']`
`vulnerability.references.cwe`	string[]	stableDisplay name: `Vulnerability CWE references`List of the vulnerability's CWE IDs.	`['CWE-20']`
`vulnerability.references.owasp`	string[]	stableDisplay name: `Vulnerability OWASP references`List of vulnerability's OWASP IDs.	`['2021:A3']`
`vulnerability.remediation.description`	string	experimentalDisplay name: `Vulnerability remediation description`Description of the vulnerability's remediation advice.	`Upgrade component to version 1.2.3 or higher`
`vulnerability.resolution.change_date`	timestamp	stableDisplay name: `Vulnerability resolution change date`Timestamp of the vulnerability's last resolution status change.	`2023-03-22T13:19:37.466Z`
`vulnerability.resolution.status`	string	stableDisplay name: `Vulnerability resolution status`Vulnerability's resolution status.	`OPEN`; `RESOLVED`
`vulnerability.risk.level`	string	stableDisplay name: `Vulnerability risk level`Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.risk.scale`	string	stableDisplay name: `Vulnerability risk scale`Scale by which the vulnerability's risk score and risk score level defined by the provider are measured.	`Davis Security Score`
`vulnerability.risk.score`	double	stableDisplay name: `Vulnerability risk score`Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.stack`	string	experimentalDisplay name: `Vulnerability stack`Level of the vulnerable component in the technological stack.	`CODE`; `CODE_LIBRARY`; `SOFTWARE`; `CONTAINER_ORCHESTRATION`
`vulnerability.technology`	string	stableDisplay name: `Vulnerability technology`Technology of the vulnerable component.	`JAVA`; `DOTNET`; `GO`; `PHP`; `NODE_JS`
`vulnerability.title`	string	stableDisplay name: `Vulnerability title`Title of the vulnerability.	`Improper Input Validation`
`vulnerability.type`	string	stableDisplay name: `Vulnerability type`Classification of the vulnerability based on commonly accepted enums, such as CWE.	`Improper Input Validation`
`vulnerability.url`	string	stableDisplay name: `Vulnerability URL`Dynatrace URL to the details page of the vulnerability. \|	`https://example.com`

Extensions

Affected entity fields

Information on changes regarding vulnerability's affected entities.

Attribute	Type	Description	Examples
`affected_entities.count`	long	resource stableNumber of affected entities.	`1`
`affected_entities.hosts.count`	long	resource stableNumber of affected hosts.	`2`
`affected_entities.kubernetes_nodes.count`	long	resource stableNumber of affected nodes.	`2`
`affected_entities.previous.count`	long	resource deprecatedNumber of affected entities before the last change event.	`1`
`affected_entities.previous.hosts.count`	long	resource deprecatedNumber of affected hosts before the last change event.	`5`
`affected_entities.previous.kubernetes_nodes.count`	long	resource deprecatedNumber of affected Kubernetes nodes before the last change event.	`5`
`affected_entities.previous.process_groups.count`	long	resource deprecatedNumber of affected process groups before the last change event.	`2`
`affected_entities.process_groups.count`	long	resource stableNumber of affected process groups.	`2`
`affected_entities.types`	array	resource stableTypes of affected entities.	`PROCESS_GROUP`; `HOST`; `KUBERNETES_NODE`

Information on changes regarding vulnerability's related entities.

Attribute	Type	Description	Examples
`related_entities.applications.count`	long	resource stableNumber of related applications.	`1`
`related_entities.databases.count`	long	resource stableNumber of related databases.	`1`
`related_entities.hosts.count`	long	resource stableNumber of related hosts.	`1`
`related_entities.kubernetes_clusters.count`	long	resource stableNumber of related Kubernetes clusters.	`1`
`related_entities.kubernetes_workloads.count`	long	resource stableNumber of related Kubernetes workloads.	`1`
`related_entities.previous.databases.count`	long	resource deprecatedNumber of related databases before the last change event.	`1`
`related_entities.services.count`	long	resource stableNumber of related services.	`1`

Examples

Runtime Vulnerability Analytics — Vulnerability status changed to resolved

A vulnerability status change event at the vulnerability level, generated when Dynatrace automatically resolved a vulnerability after the affected library was removed from all process groups.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_STATUS_CHANGE_EVENT",
  "event.level": "VULNERABILITY",
  "event.group_label": "CHANGE_EVENT",
  "event.provider": "Dynatrace",
  "event.provider_product": "Runtime Vulnerability Analytics",

  "event.description": "S-7593 Infinite loop in Apache MINA status has changed to RESOLVED",
  "event.status_transition": "CLOSE",
  "event.status": "RESOLVED",
  "event.trigger.type": "DT_PLATFORM",
  "event.trigger.user": "SYSTEM",
  "event.change_list": ["vulnerability.resolution.status"],

  "vulnerability.id": "10969751970532702025",
  "vulnerability.display_id": "S-7593",
  "vulnerability.external_id": "DTV-2021-JAVA-0000102",
  "vulnerability.title": "Infinite loop in Apache MINA",
  "vulnerability.references.cve": ["CVE-2021-41973"],
  "vulnerability.risk.level": "MEDIUM",
  "vulnerability.risk.score": 6.5,
  "vulnerability.resolution.status": "RESOLVED",
  "vulnerability.previous.resolution.status": "OPEN",
  "vulnerability.mute.status": "NOT_MUTED",
  "vulnerability.stack": "CODE_LIBRARY",
  "vulnerability.type": "Infinite Loop",
  "vulnerability.technology": "JAVA"
}

Vulnerability finding

Vulnerability-finding events contain generic sections and fields like metadata, affected entity data and vulnerability data.

Metadata fields

Meta-information on the vulnerability-finding event.

Attribute	Type	Description	Examples
`event.description`	string	stableDisplay name: `Event description`Human-readable description of an event.	`Vulnerability CVE-2023-45871 of component linux:4.19.269-1 was detected in your container image unguard-frontend:latest@054e1d39`
`event.id`	string	stableDisplay name: `Event ID`Unique identifier string of an event; is stable across multiple refreshes and updates.	`5547782627070661074_1647601320000`
`event.kind`	string	stableDisplay name: `Event kind`Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: `permission`	`SECURITY_EVENT`
`event.name`	string	stableDisplay name: `Event name`The human readable display name of an event type.	`Vulnerability finding event`
`event.provider`	string	stableDisplay name: `Event provider`Source of the event, for example, the name of the component or system that generated the event.Tags: `permission`	`Amazon ECR`
`event.type`	string	stableDisplay name: `Event type`The unique type identifier of a given event.Tags: `permission`	`VULNERABILITY_FINDING`
`event.version`	string	experimentalDisplay name: `Event version`Describes the version of the event.	`1.309`
`timestamp`	timestamp	stableDisplay name: `Timestamp`Time (UNIX Epoch time in nanoseconds) when the event originated, typically when the event was ingested into Dynatrace.	`1649822520123123123`

Vulnerability data fields

Information about the vulnerability that caused the vulnerability-finding event (vulnerability ID, description, risk level, and so on).

Attribute	Type	Description	Examples
`vulnerability.cvss.base_score`	double	stableDisplay name: `Vulnerability CVSS base score`Vulnerability's CVSS base score provided by NVD.	`8.1`
`vulnerability.cvss.vector`	string	experimentalDisplay name: `Vulnerability CVSS vector`Vulnerability's CVSS vector defined by the provider.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.exploit.status`	string	experimentalDisplay name: `Vulnerability exploit status`Whether there is a known exploit for the vulnerability.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.id`	string	stableDisplay name: `Vulnerability ID`Dynatrace unique identifier for the vulnerability.	`CVE-2019-19814`
`vulnerability.references.cve`	string[]	stableDisplay name: `Vulnerability CVE references`List of the vulnerability's CVE IDs.	`['CVE-2021-41079']`
`vulnerability.remediation.status`	string	experimentalDisplay name: `Vulnerability remediation status`Indicates whether a fix for the vulnerability is available.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.risk.level`	string	stableDisplay name: `Vulnerability risk level`Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.risk.score`	double	stableDisplay name: `Vulnerability risk score`Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.title`	string	stableDisplay name: `Vulnerability title`Title of the vulnerability.	`CVE-2019-19814`; `Improper input validation`
`vulnerability.type`	string	stableDisplay name: `Vulnerability type`Classification of the vulnerability based on commonly accepted enums, such as CWE.	`Improper Input Validation`

Product data fields

Information about the third-party product from where Dynatrace fetches data.

Attribute	Type	Description	Examples
`product.feature`	string	resource experimentalThe feature of the product that performed the scan.	`Third-party Vulnerability Analytics`; `Code-level Vulnerability Analytics`
`product.name`	string	resource experimentalProduct name.	`Tenable`; `Snyk`
`product.vendor`	string	resource experimentalProduct vendor.	`Tenable`; `Snyk`

Scan data fields

Information about the scan that detected this vulnerability.

Attribute	Type	Description	Examples
`scan.id`	string	resource experimentalUnique identifier of the scan.	`00000000-0000-0000-0000-000000000000`
`scan.name`	string	resource experimentalName of the scan.	`US Cloud Scanner`
`scan.time.completed`	timestamp	resource experimentalTime when the scan was completed.	`2024-06-24T04:47:21.154000000+02:00`
`scan.time.started`	timestamp	resource experimentalTime when the scan was started.	`2024-06-24T04:47:21.154000000+02:00`

Dynatrace enriched fields

Risk assessment fields added by Dynatrace to normalize and rank the vulnerability across the environment.

Attribute	Type	Description	Examples
`dt.security.risk.level`	string	stableDisplay name: `Security risk level`Risk score level, mapped and normalized by Dynatrace.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`; `NOT_AVAILABLE`
`dt.security.risk.score`	double	stableDisplay name: `Security risk score`Risk score, mapped and normalized by Dynatrace.	`8.1`

Extensions

The following field sets are optional context that varies by finding source. Field definitions are shared across all security event types. See the field reference for container image fields, OS fields, Kubernetes fields, host fields, AWS resource fields, Azure resource fields, GCP fields, software component fields, and entry point fields.

Container image data fields

This section contains container-image-specific data.

Attribute	Type	Description	Examples
`container_image.digest`	string	resource experimentalDisplay name: `Container image digest`Container image digest uniquely and immutably identifying the vulnerable container image.	`sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1`
`container_image.registry`	string	resource experimentalDisplay name: `Container image registry`Container image registry from which the container image originates.	`1294385647.eu-central-1`
`container_image.repository`	string	resource experimentalDisplay name: `Container image repository`Container image repository from which the container image originates.	`unguard-frontend`
`container_image.tags`	array	resource experimentalDisplay name: `Container image tags`List of tags of the container image.	`[1.0.0]`; `[1.0.0, 1.0.0-nightly, latest]`

OS data fields

Information about the operating system on which the affected entity is running.

Attribute	Type	Description	Examples
`os.architecture`	string	resource experimentalDisplay name: `OS architecture`Architecture of the CPU, discovered from the operating system.	`X86`
`os.name`	string	resource stableDisplay name: `OS name`The OS name in a short, human-readable format.	`iOS`
`os.type`	string	resource experimentalDisplay name: `OS type`Type of discovered operating system.	`LINUX`; `WINDOWS`
`os.version`	string	resource stableDisplay name: `OS version`The complete OS version, including patch, build, and other information.	`15.3.1`; `Ubuntu 16.04.7 LTS (Xenial Xerus) (kernel 4.15.0-206-generic)`; `Windows Server 2022 Datacenter 21H2 2009, ver. 10.0.20348`

Host fields

The associated host (if any) on which the vulnerability was found.

Attribute	Type	Description	Examples
`host.fqdn`	string[]	resource experimentalDisplay name: `Host FQDN`A list of FQDNs of this host.	`['ec2-43-213-176-3.compute-1.amazonaws.com', 'localhost.example.com']`
`host.ip`	ipAddress[]	resource experimentalDisplay name: `Host IP`A list of IP adresses (IPv4 or IPv6) of this host.	`[194.232.104.141, 2a01:468:1000:9::140]`
`host.name`	string	resource experimentalDisplay name: `Host name`The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry).Important: This is not the name of the host entity, which can be modified based on naming rules.Tags: `permission`	`ip-10-178-54-32.ec2.internal`

Software component fields

Attribute	Type	Description	Examples
`software_component.purl`	string	experimentalDisplay name: `Software component purl`Location of the package providing unique identification.	`pkg:maven/org.apache.logging.log4j/log4j-core`
`software_component.supplier.name`	string	experimentalDisplay name: `Software component supplier name`Supplier name of the software component.	`FasterXML`
`software_component.type`	string	experimentalDisplay name: `Software component type`Type of the software component usually provided by the SBOM.	`library`
`software_component.version`	string	experimentalDisplay name: `Software component version`Version of the software component.	`3.16.2-5+deb9u3`

Dynatrace entity enrichments

Entity ID and Smartscape reference fields added by Dynatrace during ingest when the affected entity is matched in Smartscape. These fields are not present in externally ingested findings.

Attribute	Type	Description	Examples
`dt.entity.host`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.host` instead.Display name: `Host`An entity ID of an entity of type HOST.Tags: `entity-id`	`HOST-E0D8F94D9065F24F`
`dt.entity.process_group`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.process_group.id` or `dt.process_group.detected_name` instead. Note that there is no entity type PROCESS_GROUP in Smartscape, so `dt.process_group.id` exists only for compatibility. Preferably use `dt.process_group.detected_name` to identify process groups.Display name: `Process group`An entity ID of an entity of type PROCESS_GROUP.Tags: `entity-id`	`PROCESS_GROUP-E0D8F94D9065F24F`
`dt.entity.process_group_instance`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.process` instead.Display name: `Process group instance`An entity ID of an entity of type PROCESS_GROUP_INSTANCE.Tags: `entity-id`	`PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F`
`dt.entity.software_component`	string	resource deprecatedThis field is deprecated and will be removed in the future.Display name: `Software component`An entity ID of an entity of type SOFTWARE_COMPONENT.Tags: `entity-id`	`SOFTWARE_COMPONENT-4700CB75E19C8506`
`dt.smartscape_source.id`	smartscapeId	resource stableDisplay name: `Smartscape source ID`The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. ¹Tags: `smartscape-id`	`K8S_CLUSTER-E0D8F94D9065F24F`; `AWS_LAMBDA_FUNCTION-E0D8F94D9065F24F`
`dt.smartscape_source.type`	string	stableDisplay name: `Smartscape source type`The entity type of the entity whose identifier is held in dt.smartscape_source.id.	`K8S_CLUSTER`; `AWS_LAMBDA_FUNCTION`
`dt.source_entity`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape_source.id` instead.Display name: `Source entity`The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. ²Tags: `entity-id`	`HOST-E0D8F94D9065F24F`; `PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F`
`dt.source_entity.type`	string	resource *deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape_source.type` instead.Display name: `Source entity type`The entity type of the entity whose identifier is held in dt.source_entity. The value must be a valid entity type and consistent with `dt.source_entity`. Note, however, that the type identifiers are expected to be lowercased in alignment with suffixes of dt.entity. keys.	`host`; `process_group_instance`; `cloud:azure:resource_group`

The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.

The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.

Entry points fields

Attribute	Type	Description	Examples
`entry_points`	record[]	resource experimentalEntry points of a vulnerability.	`['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']`

Sink fields

Attribute	Type	Description	Examples
`sink.code.function`	string	resource experimentalName of the function that executes the command, query, or similar with tainted parameters.	`executeQuery`
`sink.code.namespace`	string	resource experimentalNamespace of the sink code function.	`com.mysql.jdbc.Statement`
`sink.code.parameter_types`	array	resource experimentalParameter types as defined in the method signature of the sink code function, which help distinguish in case of method overloads. For example, for a method with the `executeQuery(String sql)` signature, the parameter types would be `["String"]`.	`[String]`

Concept

A vulnerability finding links a vulnerability (typically a CVE) to an affected object—a container image, host, code artifact, or runtime process—and the component that introduces it. Vulnerability finding events carry scan results from both Dynatrace Runtime Vulnerability Analytics (library, code-level, and runtime vulnerabilities) and ingested findings from third-party scanners (Snyk, Qualys, Amazon Inspector, and others).

Unlike a detection finding, which reports suspicious activity, a vulnerability finding reports a known weakness in a scanned object. It does not imply that the weakness was exploited.

Examples

Runtime Vulnerability Analytics — Library vulnerability in a .NET process

A vulnerability finding generated by Dynatrace Runtime Vulnerability Analytics, reporting a critical XML External Entity (XXE) vulnerability in the log4net library detected in a running easyTravel .NET process. Dynatrace resolves the process to a Smartscape entity and adds dt.smartscape_source.* during ingest.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_FINDING",
  "product.vendor": "Dynatrace",
  "product.name": "Runtime Vulnerability Analytics",
  "product.feature": "Library Vulnerability Analytics",

  "finding.id": "9ac6b6a2-5af1-35e1-97d9-1bd275e3d9c7",
  "finding.title": "Vulnerability DTV-2021-DOTNET-0000002 of component log4net:1.2.10.0 was detected in IIS app pool dotNetFrontend_easyTravel_x64",
  "finding.severity": "CRITICAL",
  "finding.time.created": "2026-07-14T19:06:58.290441206Z",

  "vulnerability.id": "DTV-2021-DOTNET-0000002",
  "vulnerability.title": "XML External Entity attack in log4net",
  "vulnerability.references.cve": ["CVE-2018-1285"],
  "vulnerability.cvss.base_score": 9.8,
  "vulnerability.risk.level": "CRITICAL",
  "vulnerability.risk.score": 9.8,
  "vulnerability.remediation.status": "AVAILABLE",
  "dt.security.risk.level": "CRITICAL",
  "dt.security.risk.score": 9.8,

  "object.id": "PROCESS_GROUP_INSTANCE-8D4D208A40DAE589",
  "object.type": "process_group_instance",
  "object.name": "IIS app pool dotNetFrontend_easyTravel_x64",

  "component.name": "log4net",
  "component.version": "1.2.10.0",
  "software_component.purl": "pkg:nuget/log4net@1.2.10.0",
  "software_component.type": "library",
  "software_component.version": "1.2.10.0",

  "scan.id": "1e69f852-60bf-4b7c-a1bf-56c61d94fcdb",

  "dt.smartscape_source.id": "PROCESS-8D4D208A40DAE589",
  "dt.smartscape_source.type": "PROCESS"
}

Snyk Container—CVE in a container image

A vulnerability finding for a Debian curl package detected in a scanned container image, showing the affected object, the vulnerable component, container image coordinates, and the normalized Dynatrace risk level.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_FINDING",
  "event.provider": "Snyk",
  "product.vendor": "Snyk",
  "product.name": "Snyk Container",

  "finding.id": "c70138a6-7a32-426b-b074-a7c80dfb575e/curl/libcurl3-gnutls7.64.0-4+deb10u5",
  "finding.title": "CVE-2023-38546",
  "finding.severity": "LOW",
  "finding.time.created": "2026-01-16T00:29:30.399000000Z",

  "vulnerability.id": "SNYK-DEBIAN10-CURL-5955039",
  "vulnerability.references.cve": ["CVE-2023-38546"],
  "vulnerability.cvss.base_score": 3.7,
  "dt.security.risk.level": "LOW",

  "object.id": "ecr/unguard-frontend/sha256:dae2332cbc9c9e27d60d745085246ad23ec82e28ae9a1d19a80d38fb3ef94595",
  "object.type": "CONTAINER_IMAGE",
  "object.name": "unguard-frontend",

  "component.name": "curl/libcurl3-gnutls",
  "component.version": "7.64.0-4+deb10u5",

  "container_image.registry": "ecr",
  "container_image.repository": "unguard-frontend",
  "container_image.tags": ["v0.8.0"],
  "container_image.digest": "sha256:794382e1c15d43a1ae7dc3e0f3bd47270c130f7371a440ebf64b602969f64a35",

  "scan.id": "85e58e04-c80e-4a81-a2fc-9e0b36deec94"
}

Vulnerability state

Vulnerability state events are historical states at the vulnerability level. The current vulnerability state is exported to Grail regularly.

Query

Query vulnerability state events.

fetch security.events
| filter event.category == "VULNERABILITY_MANAGEMENT"
| filter event.type == "VULNERABILITY_STATE_REPORT_EVENT"
| filter event.level == "VULNERABILITY"

Event data fields

General event information.

Attribute	Type	Description	Examples
`event.category`	string	stableDisplay name: `Event category`Categorization based on the product and data generating this event.	`VULNERABILITY_MANAGEMENT`
`event.description`	string	stableDisplay name: `Event description`Human-readable description of an event.	`S-49 Remote Code Execution state event reported`
`event.group_label`	string	experimentalDisplay name: `Event group label`Group label of an event.	`STATE_REPORT`
`event.kind`	string	stableDisplay name: `Event kind`Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: `permission`	`SECURITY_EVENT`
`event.level`	string	resource stableMain reference point to which the event or data is related. Possible values are `Vulnerability` (shows the global aggregation across the entire environment and comprises all entities and management zones) and `Entity` (shows the assessment based on the entity itself).	`VULNERABILITY`
`event.name`	string	stableDisplay name: `Event name`The human readable display name of an event type.	`Vulnerability historical state report event`
`event.provider`	string	stableDisplay name: `Event provider`Source of the event, for example, the name of the component or system that generated the event.Tags: `permission`	`Dynatrace`; `Snyk`
`event.provider_product`	string	resource stableName of the product providing this event.	`Runtime Vulnerability Analytics`; `Snyk Container`
`event.status`	string	stableDisplay name: `Event status`Status of an event as being either Active or Closed.	`OPEN`; `RESOLVED`; `MUTED`
`event.type`	string	stableDisplay name: `Event type`The unique type identifier of a given event.Tags: `permission`	`VULNERABILITY_STATE_REPORT_EVENT`
`timestamp`	timestamp	stableDisplay name: `Timestamp`The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.	`1649822520123123123`

Vulnerability data fields

Information about the vulnerability.

Attribute	Type	Description	Examples
`vulnerability.code_location.name`	string	stableDisplay name: `Vulnerability code location name`Name of the code location where the code-level vulnerability was detected.	`org.dynatrace.profileservice.BioController.markdownToHtml(String):80`
`vulnerability.cvss.base_score`	double	stableDisplay name: `Vulnerability CVSS base score`Vulnerability's CVSS base score provided by NVD.	`8.1`
`vulnerability.cvss.vector`	string	experimentalDisplay name: `Vulnerability CVSS vector`Vulnerability's CVSS vector defined by the provider.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.cvss.version`	string	stableDisplay name: `Vulnerability CVSS version`Vulnerability's CVSS score version.	`3.1`; `4.0`
`vulnerability.davis_assessment.assessment_mode`	string	stableDisplay name: `Vulnerability assessment mode`Availability of the information based on which the vulnerability assessment has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.davis_assessment.assessment_mode_reasons`	string[]	experimentalDisplay name: `Vulnerability Davis assessment mode reasons`Reasons for the assessment mode.	`['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']`
`vulnerability.davis_assessment.data_assets_status`	string	stableDisplay name: `Vulnerability data assets status`Vulnerability's reachability of related data assets by affected entities.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.davis_assessment.exploit_status`	string	stableDisplay name: `Vulnerability exploit status`Vulnerability's public exploits status.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.davis_assessment.exposure_status`	string	stableDisplay name: `Vulnerability exposure status`Vulnerability's internet exposure status.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.davis_assessment.level`	string	stableDisplay name: `Vulnerability Davis security level`Vulnerability's risk level based on Davis Security Score.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.davis_assessment.score`	double	stableDisplay name: `Vulnerability Davis security score`Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.	`8.1`
`vulnerability.davis_assessment.vector`	string	experimentalDisplay name: `Vulnerability Davis assessment vector`Vulnerability's CVSS vector, adjusted with observability data; this vector is calculated by Dynatrace.	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L`; `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H`
`vulnerability.davis_assessment.vulnerable_function_status`	string	stableDisplay name: `Vulnerability vulnerable function status`Usage status of the vulnerable functions causing the vulnerability.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.description`	string	stableDisplay name: `Vulnerability description`Description of the vulnerability.	`More detailed description about improper input validation vulnerability.`
`vulnerability.display_id`	string	stableDisplay name: `Vulnerability display ID`Dynatrace user-readable identifier for the vulnerability.	`S-1234`
`vulnerability.external_id`	string	stableDisplay name: `Vulnerability external ID`External provider's unique identifier for the vulnerability.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.external_url`	string	stableDisplay name: `Vulnerability external URL`External provider's URL to the details page of the vulnerability.	`https://example.com`
`vulnerability.first_seen`	timestamp	stableDisplay name: `Vulnerability first seen`Timestamp of when the vulnerability was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.id`	string	stableDisplay name: `Vulnerability ID`Dynatrace unique identifier for the vulnerability.	`2039861408676243188`
`vulnerability.is_fix_available`	boolean	experimentalDisplay name: `Vulnerability is fix available`Indicates if a vulnerability fix is available.
`vulnerability.mute.change_date`	timestamp	stableDisplay name: `Vulnerability mute change date`Timestamp of the vulnerability's last muted or unmuted action.	`2023-03-22T13:19:36.945Z`
`vulnerability.mute.reason`	string	stableDisplay name: `Vulnerability mute reason`Reason for muting or unmuting the vulnerability.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.mute.status`	string	stableDisplay name: `Vulnerability mute status`Vulnerability's mute status.	`MUTED`; `NOT_MUTED`
`vulnerability.mute.user`	string	stableDisplay name: `Vulnerability mute user`User who last changed the vulnerability's mute status.	`user@example.com`
`vulnerability.references.cve`	string[]	stableDisplay name: `Vulnerability CVE references`List of the vulnerability's CVE IDs.	`['CVE-2021-41079']`
`vulnerability.references.cwe`	string[]	stableDisplay name: `Vulnerability CWE references`List of the vulnerability's CWE IDs.	`['CWE-20']`
`vulnerability.references.owasp`	string[]	stableDisplay name: `Vulnerability OWASP references`List of vulnerability's OWASP IDs.	`['2021:A3']`
`vulnerability.remediation.description`	string	experimentalDisplay name: `Vulnerability remediation description`Description of the vulnerability's remediation advice.	`Upgrade component to version 1.2.3 or higher`
`vulnerability.resolution.change_date`	timestamp	stableDisplay name: `Vulnerability resolution change date`Timestamp of the vulnerability's last resolution status change.	`2023-03-22T13:19:37.466Z`
`vulnerability.resolution.status`	string	stableDisplay name: `Vulnerability resolution status`Vulnerability's resolution status.	`OPEN`; `RESOLVED`
`vulnerability.risk.level`	string	stableDisplay name: `Vulnerability risk level`Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.risk.scale`	string	stableDisplay name: `Vulnerability risk scale`Scale by which the vulnerability's risk score and risk score level defined by the provider are measured.	`Davis Security Score`
`vulnerability.risk.score`	double	stableDisplay name: `Vulnerability risk score`Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.stack`	string	experimentalDisplay name: `Vulnerability stack`Level of the vulnerable component in the technological stack.	`CODE`; `CODE_LIBRARY`; `SOFTWARE`; `CONTAINER_ORCHESTRATION`
`vulnerability.technology`	string	stableDisplay name: `Vulnerability technology`Technology of the vulnerable component.	`JAVA`; `DOTNET`; `GO`; `PHP`; `NODE_JS`
`vulnerability.title`	string	stableDisplay name: `Vulnerability title`Title of the vulnerability.	`Improper Input Validation`
`vulnerability.type`	string	stableDisplay name: `Vulnerability type`Classification of the vulnerability based on commonly accepted enums, such as CWE.	`Improper Input Validation`
`vulnerability.url`	string	stableDisplay name: `Vulnerability URL`Dynatrace URL to the details page of the vulnerability. \|	`https://example.com`

Extensions

This section contains information on the vulnerability's affected and related entities.

Affected entity fields

Attribute	Type	Description	Examples
`affected_entities.affected_processes.count`	long	resource stableNumber of affected processes.	`50`
`affected_entities.count`	long	resource stableNumber of affected entities.	`1`
`affected_entities.hosts.count`	long	resource stableNumber of affected hosts.	`2`
`affected_entities.kubernetes_nodes.count`	long	resource stableNumber of affected nodes.	`2`
`affected_entities.management_zones.ids`	array	resource stableIDs of the management zones to which the affected entities belong.	`mzid1`
`affected_entities.management_zones.names`	array	resource stableNames of the management zones to which the affected entities belong.	`mz1`
`affected_entities.monitored_processes.count`	long	resource stableNumber of processes of the process group.	`100`
`affected_entities.process_groups.count`	long	resource stableNumber of affected process groups.	`2`
`affected_entities.types`	array	resource stableTypes of affected entities.	`PROCESS_GROUP`; `HOST`; `KUBERNETES_NODE`
`affected_entities.vulnerable_components.ids`	array	resource stableDynatrace IDs of the vulnerable components causing the vulnerability.	`SOFTWARE_COMPONENT-0000000000000001`; `SOFTWARE_COMPONENT-0000000000000002`; `SOFTWARE_COMPONENT-0000000000000003`
`affected_entities.vulnerable_components.names`	array	resource stableNames of the vulnerable components causing the vulnerability. \|	`com.fasterxml.jackson.core:jackson-databind:2.10.0`; `node-sass:4.14.1`
`affected_entities.vulnerable_functions`	array	resource stableVulnerable functions detected, containing or causing the vulnerability.	`org.springframework.beans.CachedIntrospectionResults:init`; `java.lang.ProcessBuilder.<init>(String[])`; `(*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)`

Attribute	Type	Description	Examples
`related_entities.applications.count`	long	resource stableNumber of related applications.	`1`
`related_entities.databases.count`	long	resource stableNumber of related databases.	`1`
`related_entities.hosts.count`	long	resource stableNumber of related hosts.	`1`
`related_entities.kubernetes_clusters.count`	long	resource stableNumber of related Kubernetes clusters.	`1`
`related_entities.kubernetes_workloads.count`	long	resource stableNumber of related Kubernetes workloads.	`1`
`related_entities.services.count`	long	resource stableNumber of related services.	`1`

Examples

Runtime Vulnerability Analytics — Vulnerability state snapshot

A vulnerability state report event at the vulnerability level, showing the current state of an open Node.js vulnerability across affected process groups.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "VULNERABILITY_STATE_REPORT_EVENT",
  "event.level": "VULNERABILITY",
  "event.group_label": "STATE_REPORT",
  "event.provider": "Dynatrace",
  "event.provider_product": "Runtime Vulnerability Analytics",

  "event.description": "S-7538 Improper Restriction of Operations within the Bounds of a Memory Buffer state event reported",
  "event.status": "OPEN",

  "vulnerability.id": "7331221926697449085",
  "vulnerability.display_id": "S-7538",
  "vulnerability.external_id": "CVE-2015-5380",
  "vulnerability.title": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
  "vulnerability.references.cve": ["CVE-2015-5380"],
  "vulnerability.risk.level": "HIGH",
  "vulnerability.risk.score": 7.5,
  "vulnerability.resolution.status": "OPEN",
  "vulnerability.mute.status": "NOT_MUTED",
  "vulnerability.stack": "SOFTWARE",
  "vulnerability.type": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
  "vulnerability.technology": "NODE_JS",

  "affected_entities.count": 1,
  "affected_entities.process_groups.count": 1,
  "affected_entities.vulnerable_components.names": ["Node.js 0.3.2"]
}

Vulnerabilities

Entity change

Query

Event data

Vulnerability data

Extensions

Affected entity

Related entities fields

Examples

Runtime Vulnerability Analytics — Entity-level vulnerability status changed to resolved

Entity state

Query

Event data

Vulnerability data

Extensions

Affected entity fields

Related entity fields

Examples

Runtime Vulnerability Analytics — Entity-level vulnerability state snapshot

Vulnerability change

Query

Event data fields

Vulnerability data fields

Extensions

Affected entity fields

Related entity fields

Examples

Runtime Vulnerability Analytics — Vulnerability status changed to resolved

Vulnerability finding

Metadata fields

Vulnerability data fields

Product data fields

Scan data fields

Dynatrace enriched fields

Extensions

Container image data fields

OS data fields

Host fields

Software component fields

Dynatrace entity enrichments

Entry points fields

Sink fields

Concept

Examples

Runtime Vulnerability Analytics — Library vulnerability in a .NET process

Snyk Container—CVE in a container image

Vulnerability state

Query

Event data fields

Vulnerability data fields

Extensions

Affected entity fields

Related entity fields

Examples

Runtime Vulnerability Analytics — Vulnerability state snapshot