Ingest GitHub Advanced Security security events and audit logs

• Latest Dynatrace
• Extension
• Updated on Apr 10, 2026

Prioritize GitHub security findings by enriching them with runtime context.

Get started

Overview

Dynatrace integration with GitHub Advanced Security (GHAS) enables users to unify and contextualize vulnerability findings across DevSecOps tools and products, facilitating centralized prioritization, visualization, and automation of security findings.

GitHub Advanced Security includes Code Security and Secret Protection which generate vulnerability findings for development artifacts, such as code and containers. Dynatrace observes the runtime entities associated with those artifacts. Ingesting and enriching vulnerability findings helps users focus on high-impact risks affecting production applications.

In addition, GitHub users can use Dynatrace runtime context to prioritize GitHub Advanced Security alerts based on deployed artifacts and runtime risk in your Kubernetes environment. When you connect Dynatrace to GitHub, you’ll see deployment visibility for container images that Dynatrace maps to your repositories, along with runtime risk signals. You can use this context to focus remediation on alerts that affect deployed artifacts, especially when Dynatrace detects higher-risk runtime conditions.

Use cases

With the ingested data, you can accomplish various use cases, such as

Requirements

See below for the GitHub and Dynatrace requirements.

GitHub requirements

For the extension to collect security data, authentication credentials with proper permissions are required. You have two options, described below.

Dynatrace requirements

Activation and setup

Details

How it works

How ingest of GitHub Advanced Security works

Licensing and cost

For billing information, see Events powered by Grail.

Feature sets

When activating your extension using monitoring configuration, you can limit monitoring to one of the feature sets. To work properly, the extension has to collect at least one metric after the activation.

In highly segmented networks, feature sets can reflect the segments of your environment. Then, when you create a monitoring configuration, you can select a feature set and a corresponding ActiveGate group that can connect to this particular segment.

All metrics that aren't categorized into any feature set are considered to be the default and are always reported.

FAQ

Which data model is used for the security logs and events coming from GHAS integration?

Which GHAS security findings are imported into Dynatrace?

Which extension fields are added to the core fields of the events ingested from GHAS?

The github namespace is added for extracting several GHAS-specific attributes for user convenience on top of the original issue JSON, which is stored in the event.original_content field.

Examples:

What GHAS asset types are supported by Dynatrace for runtime contextualization?

CODE_ARTIFACT: All the findings from GitHub Advanced Security products coming from the assessment of code artifacts are mapped set with CODE_ARTIFACT value in the object.type field, and the artifact and component namespaces are added with the corresponding fields:

What runtime context from Dynatrace is shared with GitHub?

Dynatrace sends deployment records to GitHub for all container images identified in the monitored containers that match the artifact attestations of images accessible by the configured user in GitHub. If Runtime Vulnerability Analytics (RVA) is enabled for the monitored containers, the deployment records include internet exposure and sensitive data assets assessments.

Example query:

smartscapeNodes CONTAINER, from: -2h
| filter exists(k8s.namespace.name) // will update to filter to configured namespaces
| expand k8s.workload.id=coalesce(references[is_part_of.k8s_deployment],
                        coalesce(references[is_part_of.k8s_daemonset],
                            coalesce(references[is_part_of.k8s_cronjob],
                            coalesce(references[is_part_of.k8s_statefulset],
                                coalesce(references[is_part_of.k8s_job],
                                references[is_part_of.k8s_replicaset])))))
| lookup [
smartscapeNodes {{K8S_DEPLOYMENT, K8S_CRONJOB, K8S_DAEMONSET, K8S_JOB, K8S_STATEFULSET, K8S_REPLICASET}}, from:now()-2h
], sourceField:k8s.workload.id, lookupField:id, fields:{{k8s.workload.id_classic=id_classic}}
| join [
// query vulnerabilities
fetch security.events
| filter event.type=="VULNERABILITY_STATE_REPORT_EVENT"
AND event.level=="ENTITY"
// for all the affected workloads
| expand k8s.workload.id_classic=related_entities.kubernetes_workloads.ids
| summarize {{
    exposure_status=collectDistinct(vulnerability.davis_assessment.exposure_status),
    data_assets_status=collectDistinct(vulnerability.davis_assessment.data_assets_status)
}}, by:{{k8s.workload.id_classic}}
| fieldsAdd exposure_status=if(in("PUBLIC_NETWORK",exposure_status),"PUBLIC_NETWORK", else:
                            if(in("ADJACENT_NETWORK",exposure_status),"ADJACENT_NETWORK", else:
                            if(in("NOT_DETECTED",exposure_status),"NOT_DETECTED", else:"NOT_AVAILABLE")))
| fieldsAdd data_assets_status=if(in("REACHABLE",data_assets_status),"REACHABLE", else:
                            if(in("NOT_DETECTED",data_assets_status),"NOT_DETECTED", else:"NOT_AVAILABLE"))
], kind:leftOuter, on:{{k8s.workload.id_classic}}, fields:{{exposure_status, data_assets_status}}
| fieldsAdd exposure_status=coalesce(exposure_status,"NOT_AVAILABLE"),
            data_assets_status=coalesce(data_assets_status,"NOT_AVAILABLE")
| fields container.image.digest, container.image.name, k8s.namespace.name, exposure_status, data_assets_status
| dedup container.image.digest, container.image.name, k8s.namespace.name, exposure_status, data_assets_status

How can I use runtime context in GitHub?

You can use deployment visibility and runtime risk signals to filter and prioritize GitHub code scanning and Dependabot alerts, including in security campaigns.

For example, to find vulnerabilities that affect deployed artifacts that are internet exposed, use:

has:deployment AND runtime-risk:internet-exposed

Runtime risk signals include:

How is the risk score for GHAS findings normalized?

The Dynatrace risk levels and scores are mapped from the original GHAS severity and score.

Explore in Dynatrace Hub

Ingest GitHub Advanced Security (GHAS) security events and audit logs.