Security events

event.kind

string

stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission

SECURITY_EVENT

timestamp

timestamp

stableThe time (UNIX Epoch time in nanoseconds) when the event was ingested.

1649822520123123123

aws.account.id

string

resource stableThe 12-digit number, such as 123456789012, that uniquely identifies an AWS account.Tags: permission primary-field

123456789012

azure.tenant.id

string

resource experimentalUnique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

cloud.provider

string

resource stableName of the cloud provider.

alibaba_cloud

dt.entity.cloud_application_instance

string

resource stableAn entity ID of an entity of type CLOUD_APPLICATION_INSTANCE.Tags: entity-id

CLOUD_APPLICATION_INSTANCE-E0D8F94D9065F24F

dt.entity.kubernetes_cluster

string

resource stableAn entity ID of an entity of type KUBERNETES_CLUSTER.Tags: entity-id

KUBERNETES_CLUSTER-E0D8F94D9065F24F

finding.id

string

stableUnique identifier string of a finding.

F-2GJ3LSUM

gcp.organization.id

string

resource experimentalUnique, immutable identifier assigned to an organization resource.

123456789012

hypervisor.type

string

resource experimentalVirtualization hypervisor identified. For physical machines, this value is empty.

KVM; VMWARE

k8s.cluster.uid

string

resource stableA pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.

1c7a24c7-ff51-46e0-bcc9-c52637ceec57

k8s.namespace.uid

string

resource experimentalThe UID of the namespace.

bfb1ba44-3bcb-467d-a2dc-188fd74d1db5

k8s.pod.name

string

resource stableThe name of the pod.

checkoutservice-7895755b94-mzs5m

k8s.workload.name

string

resource stableThe name of the workload.

checkoutservice

vmware.vcenter.name

string

resource experimentalName of the VMware vCenter server managing the multi-hypervisor environment.

my-vcenter.lab.dynatrace.org

product.name

string

resource experimentalProduct name.

Tenable; Snyk

compliance.rule.id

string

experimentalUnique identifier of a compliance rule.

CIS-66577

compliance.rule.severity.level

string

experimentalOriginal severity of a compliance rule reported by the vendor.

CRITICAL; HIGH; MEDIUM; LOW

compliance.rule.title

string

experimentalShort description of a compliance rule.

The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination

compliance.standard.name

string

experimentalName of a compliance standard.

CIS Elastic Kubernetes Service (EKS) - v1.7.0; NIST SP 800-53 Revision 5.1.1 - Kubernetes

compliance.standard.url

string

experimentalLink to the official documentation source about the compliance standard.

DISA STIG; NIST

aws.resource.name

string

resource stableName of the resource for named resources, value of the "Name" tag in AWS for non-named resources (if unavailable, same as aws.resource.id).

my-ec2-instance

azure.resource.name

string

resource experimentalUser-provided name of the Azure cloud resource.

demo-aks

compliance.result.object.evidence_json

string

experimentalReasoning or evidence for the compliance status of this object.

[{\"type\":\"AUTOMATIC\",\"description\":\"Controller Manager version\",\"value\":\"1.28.0\"},{\"type\":\"AUTOMATIC\",\"description\":\"Property tls-min-version status\",\"value\":\"Not set\"}]

compliance.result.object.type

string

experimentalType of the object evaluated for compliance.

k8scluster; k8spod; k8sservice

compliance.result.status.score

double

experimentalNumber assigned to the respective result status. For example, 10 corresponds to 'FAILED', 7 to 'MANUAL', 4 to 'PASSED', and 1 to 'NOT_RELEVANT'.

10.0; 7.0; 4.0; 1.0

object.id

string

resource experimentalIdentifier of the affected object.

HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1

object.type

string

resource experimentalType of the affected object.

host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE

event.kind

string

stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission

SECURITY_EVENT

timestamp

timestamp

stableThe time (UNIX Epoch time in nanoseconds) when the event was ingested.

1649822520123123123

aws.account.id

string

resource stableThe 12-digit number, such as 123456789012, that uniquely identifies an AWS account.Tags: permission primary-field

123456789012

azure.tenant.id

string

resource experimentalUnique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

cloud.provider

string

resource stableName of the cloud provider.

alibaba_cloud

gcp.organization.id

string

resource experimentalUnique, immutable identifier assigned to an organization resource.

123456789012

hypervisor.type

string

resource experimentalVirtualization hypervisor identified. For physical machines, this value is empty.

KVM; VMWARE

k8s.cluster.uid

string

resource stableA pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.

1c7a24c7-ff51-46e0-bcc9-c52637ceec57

object.name

string

resource experimentalName of the affected object.

kube-controller-manager-k8s-mst01-t12; daemonset-25qlv

product.name

string

resource experimentalProduct name.

Tenable; Snyk

product.version

string

resource experimentalVersion of the product that performed the scan.

6.9.2.0

scan.result.summary_json

string

resource experimentalSummary of the scan results.

{"standardResultSummaries":[{"profileCode":"CIS","compliancePercentage":85}]}

vmware.vcenter.name

string

resource experimentalName of the VMware vCenter server managing the multi-hypervisor environment.

my-vcenter.lab.dynatrace.org

dt.security.risk.level

string

stableRisk score level, mapped and normalized by Dynatrace.

LOW; MEDIUM; HIGH; CRITICAL; NONE; NOT_AVAILABLE

event.type

string

stableThe unique type identifier of a given event.Tags: permission

DETECTION_FINDING

finding.time.created

timestamp

stableTime when the finding was created.

2024-06-24T04:47:21.154000000+02:00

finding.type

string

stableOriginal type of the finding reported by the vendor.

SQL injection; Command injection; JNDI injection; SSRF; TTPs/Execution/Execution:Runtime-SuspiciousShellCreated

object.name

string

resource experimentalName of the affected object. Either this or object.id has to be set.

kube-controller-manager-k8s-mst01-t12; daemonset-25qlv

product.name

string

resource experimentalProduct name.

Runtime Application Protection; GuardDuty

event.end

string

stableTimestamp of latest activity associated with this finding in UTC (given in Grail preferred Linux timestamp nano precision format).

1757405399

threat.attack.subtechnique.ids

string[]

experimentalMITRE ATT&CK sub-technique identifiers for this detection, in T{parent}.{sub} dotted format. Independent of threat.attack.technique.ids—no positional alignment is assumed or required. The parent technique is encoded in the sub-technique ID itself, for example, T1059.003 belongs to technique T1059). Omit when no sub-technique information is available; don't use empty string placeholders. Sub-technique names are derivable from IDs via the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.subtechnique.ids, "T1059.003")

['T1059.003']; ['T1059.003', 'T1078.002']

threat.attack.tactic.ids

string[]

experimentalMITRE ATT&CK tactic identifiers for this detection, in TA-prefixed format. A detection may map to zero or more tactics. Omit or set to an empty array when tactic information is unavailable from the producing source. Tactic names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.tactic.ids, "TA0002")

['TA0002']; ['TA0002', 'TA0004']

threat.attack.technique.ids

string[]

experimentalMITRE ATT&CK technique identifiers for this detection, in T-prefixed format. A detection may map to zero or more techniques. The primary pivot field for ATT&CK heat maps and technique coverage dashboards. Technique names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.technique.ids, "T1059")

['T1059']; ['T1059', 'T1078']

threat.attack.version

string

experimentalVersion of the MITRE ATT&CK framework used to classify this detection. Useful for audit and reproducibility, since tactic and technique IDs can be added or renumbered across major ATT&CK versions. Some producers don't embed the framework version in their event payloads; omit when version provenance can't be reliably determined. Use bare version numbers without a "v" prefix.

14.1; 15.1; 16.0

event.id

string

stableIn combination with timestamp, this field uniquely identifies a specific event.

1669863368163_07755297913417681159

timestamp

timestamp

stableTime (UNIX Epoch time in nanoseconds) when the event was ingested.

1649822520123123123

event.category

string

stableCategorization based on the product and data generating this event.

VULNERABILITY_MANAGEMENT

event.description

string

stableHuman-readable description of an event.

Status of S-49 Remote Code Execution for prod_process_group_1 has changed to OPEN.; Assessment of S-49 Remote Code Execution for prod_process_group_1 has changed.; Environment impact of S-49 Remote Code Execution for prod_process_group_1 has changed.

event.kind

string

stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission

SECURITY_EVENT

event.name

string

stableThe human readable display name of an event type.

Vulnerable entity status change event; Vulnerable entity assessment change event

event.provider_product

string

resource stableName of the product providing this event.

Runtime Vulnerability Analytics; Snyk Container

event.status_transition

string

experimentalAn enum that shows the transition of the above event state.

NEW_OPEN; REOPEN; CLOSE; MUTE; UNMUTE

event.trigger.user

string

resource stableID of the user who triggered the event. If generated by Dynatrace, the value is SYSTEM.

SYSTEM; <user_id>

timestamp

timestamp

stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.

1649822520123123123

entry_points.entry_point_jsons

string[]

resource **deprecatedUse entry_points instead.**JSON representation of entry points of a vulnerability.

['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs_json": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']

vulnerability.cvss.base_score

double

stableVulnerability's CVSS base score provided by NVD.

8.1

vulnerability.cvss.version

string

stableVulnerability's CVSS score version.

3.1; 4.0

vulnerability.davis_assessment.assessment_mode_reasons

string[]

experimentalReasons for the assessment mode at the entity level.

['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']

vulnerability.davis_assessment.exploit_status

string

stablePublic exploits status of the vulnerability at the entity level.

AVAILABLE; NOT_AVAILABLE

vulnerability.davis_assessment.level

string

stableRisk level, based on Davis Security Score, of the vulnerability at the entity level.

LOW; MEDIUM; HIGH; CRITICAL; NONE

vulnerability.davis_assessment.vulnerable_function_status

string

stableUsage status of the vulnerable functions causing the vulnerability at the entity level.

IN_USE; NOT_AVAILABLE; NOT_IN_USE

vulnerability.display_id

string

stableDynatrace user-readable identifier for the vulnerability.

S-1234

vulnerability.external_url

string

stableExternal provider's URL to the details page of the vulnerability.

https://example.com

vulnerability.id

string

stableDynatrace unique identifier for the vulnerability.

2039861408676243188

vulnerability.mute.change_date

timestamp

stableTimestamp of the last muted or unmuted action of the vulnerability at the entity level.

2023-03-22T13:19:36.945Z

vulnerability.mute.reason

string

stableReason for muting or unmuting the vulnerability at the entity level.

FALSE_POSITIVE; IGNORE; AFFECTED; CONFIGURATION_NOT_AFFECTED; OTHER

vulnerability.mute.user

string

stableUser who last changed the mute status of the vulnerability at the entity level.

user@example.com

vulnerability.parent.davis_assessment.data_assets_status

string

stableVulnerability's reachability of related data assets by affected entities.

NOT_AVAILABLE; NOT_DETECTED; REACHABLE

vulnerability.parent.davis_assessment.level

string

stableVulnerability's Davis Security Score level.

LOW; MEDIUM; HIGH; CRITICAL; NONE

vulnerability.parent.davis_assessment.vulnerable_function_status

string

stableUsage status of vulnerable functions causing the vulnerability. Status is IN_USE when there's at least one vulnerable function in use by an application.

IN_USE; NOT_AVAILABLE; NOT_IN_USE

vulnerability.parent.mute.change_date

timestamp

stableTimestamp of the last mute or unmute action of the vulnerability.

2023-03-22T13:19:36.945Z

vulnerability.parent.mute.status

string

stableVulnerability's mute status.

MUTED; NOT_MUTED

vulnerability.parent.resolution.change_date

string

stableTimestamp of the vulnerability's last resolution status change.

2023-03-22T13:19:37.466Z

vulnerability.parent.risk.level

string

stableVulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.

LOW; MEDIUM; HIGH; CRITICAL; NONE

vulnerability.previous.cvss.base_score

double

stableVulnerability's previous CVSS base score (in case the CVSS base score has changed).

8.1

vulnerability.previous.davis_assessment.exploit_status

string

stableVulnerability's previous public exploit status (in case the public exploit status has changed).

AVAILABLE; NOT_AVAILABLE

vulnerability.previous.davis_assessment.level

string

stableVulnerability's previous risk level (in case the risk level has changed).

LOW; MEDIUM; HIGH; CRITICAL; NONE

vulnerability.previous.davis_assessment.vulnerable_function_status

string

stableVulnerability's previous vulnerable function status (in case the vulnerable function status has changed).

IN_USE; NOT_AVAILABLE; NOT_IN_USE

vulnerability.previous.mute.change_date

string

stableTimestamp of the vulnerability's previous mute status (in case the mute status has changed).

2023-03-22T13:19:36.945Z

vulnerability.previous.mute.reason

string

stableReason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).

Muted: False positive

vulnerability.previous.mute.user

string

stableUser who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).

user@example.com

vulnerability.previous.risk.level

string

stableVulnerability's previous risk score level (in case the risk score level has changed).

LOW; MEDIUM; HIGH; CRITICAL

vulnerability.previous.tracking_link.text

string

experimentalDisplay text of the previous tracking link that was set by the user.

P-1000 Vulnerability CVE-2024-0001

vulnerability.references.cve

string[]

stableList of the vulnerability's CVE IDs.

['CVE-2021-41079']

vulnerability.references.owasp

string[]

stableList of vulnerability's OWASP IDs.

['2021:A3']

vulnerability.resolution.change_date

timestamp

stableTimestamp of the last resolution status change of the vulnerability at the entity level.

2023-03-22T13:19:37.466Z

vulnerability.risk.level

string

stableVulnerability's risk score level defined by the provider at the entity level. For Dynatrace, the Davis Security Score level.

LOW; MEDIUM; HIGH; CRITICAL; NONE

vulnerability.risk.score

double

stableRisk score defined by the provider for the vulnerability at the entity level. For Dynatrace, Davis Security Score.

8.1

vulnerability.technology

string

stableTechnology of the vulnerable component.

JAVA; DOTNET; GO; PHP; NODE_JS

vulnerability.tracking_link.text

string

experimentalDisplay text of the tracking link that was set by the user.

P-1000 Vulnerability CVE-2024-0001

vulnerability.type

string

stableClassification of the vulnerability based on commonly accepted enums, such as CWE.

Improper Input Validation

affected_entity.affected_processes.ids

array

resource stableIDs of the processes that are currently affected by the vulnerability.

PROCESS_GROUP_INSTANCE-1

affected_entity.id

string

resource stableID of the affected entity.

PROCESS_GROUP-1; HOST-1

affected_entity.management_zones.names

array

resource stableNames of the management zones to which the affected entity belongs.

mz1

affected_entity.reachable_data_assets.count

long

resource experimentalNumber of reachable data assets.

1

affected_entity.reachable_data_assets.names

array

resource experimentalNames of the data assets that can be reached by the affected entities of the vulnerability.

prod_database_1

affected_entity.vulnerable_component.id

string

resource stableID of the vulnerable component causing the vulnerability.

SOFTWARE_COMPONENT-D8FCFFB4FDF7A3FF

affected_entity.vulnerable_component.package_name

string

resource experimentalPackage name of the vulnerable component causing the vulnerability.

k8s.io/kubernetes; github.com/kubernetes/kubernetes/pkg/kubelet/kuberuntime

affected_entity.vulnerable_functions

array

resource stableVulnerable functions detected, containing or causing the vulnerability.

org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)

affected_entity.vulnerable_functions_not_in_use

array

resource experimentalVulnerable functions detected which are not actively used.

org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)

related_entities.applications.count

long

resource stableNumber of related applications.

1

related_entities.databases.count

long

resource stableNumber of related databases.

1

related_entities.hosts.count

long

resource stableNumber of related hosts.

1

related_entities.kubernetes_clusters.count

long

resource stableNumber of related Kubernetes clusters.

1

related_entities.kubernetes_workloads.count

long

resource stableNumber of related Kubernetes workloads.

1

related_entities.services.count

long

resource stableNumber of related services.

1

event.category

string

stableCategorization based on the product and data generating this event.

VULNERABILITY_MANAGEMENT

event.group_label

string

experimentalGroup label of an event.

STATE_REPORT

event.level

string

resource stableMain reference point to which the event or data is related. Possible values are Vulnerability (shows the global aggregation across the entire environment and comprises all entities and management zones) and Entity (shows the assessment based on the entity itself).

ENTITY

event.provider

string

stableSource of the event, for example, the name of the component or system that generated the event.Tags: permission

OneAgent; K8S; Davis; VMWare; GCP; AWS; LIMA_USAGE_STREAM

event.status

string

stableStatus of an event as being either Active or Closed.

OPEN; RESOLVED; MUTED

timestamp

timestamp

stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.

1649822520123123123

entry_points.entry_point_jsons

string[]

resource **deprecatedUse entry_points instead.**JSON representation of entry points of a vulnerability.

['{ "entry_point.url.path": "/user/2/bio", "entry_point.payload": "UPDATE bio SET bio_text = \'\' WHERE 1 = 0; TRUNCATE TABLE bio; --\' WHERE user_id = 2", "entry_point.user_controlled_inputs_json": [{ "user_controlled_input.type": "HTTP_PARAMETER_VALUE", "user_controlled_input.key": "username", "user_controlled_input.value": "\' OR 100=100 -- 0\'", "user_controlled_input.payload.start": "56", "user_controlled_input.payload.end": "73", "user_controlled_input.is_malicious": true}]}']

vulnerability.cvss.base_score

double

stableVulnerability's CVSS base score provided by NVD.

8.1

vulnerability.cvss.version

string

stableVulnerability's CVSS score version.

3.1; 4.0

vulnerability.davis_assessment.assessment_mode_reasons

string[]

experimentalReasons for the assessment mode at the entity level.

['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']

vulnerability.davis_assessment.exploit_status

string

stablePublic exploits status of the vulnerability at the entity level.

AVAILABLE; NOT_AVAILABLE

vulnerability.davis_assessment.level

string

stableRisk level, based on Davis Security Score, of the vulnerability at the entity level.

LOW; MEDIUM; HIGH; CRITICAL; NONE

vulnerability.davis_assessment.vector

string

experimentalVulnerability's CVSS vector, adjusted with observability data; this vector is calculated by Dynatrace.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L; CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H

vulnerability.description

string

stableDescription of the vulnerability.

More detailed description about improper input validation vulnerability.

vulnerability.external_id

string

stableExternal provider's unique identifier for the vulnerability.

SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646

vulnerability.id

string

stableDynatrace unique identifier for the vulnerability.

2039861408676243188

vulnerability.mute.change_date

timestamp

stableTimestamp of the last muted or unmuted action of the vulnerability at the entity level.

2023-03-22T13:19:36.945Z

vulnerability.mute.reason

string

stableReason for muting or unmuting the vulnerability at the entity level.

FALSE_POSITIVE; IGNORE; AFFECTED; CONFIGURATION_NOT_AFFECTED; OTHER

vulnerability.mute.user

string

stableUser who last changed the mute status of the vulnerability at the entity level.

user@example.com

vulnerability.parent.davis_assessment.data_assets_status

string

stableVulnerability's reachability of related data assets by affected entities.

NOT_AVAILABLE; NOT_DETECTED; REACHABLE

vulnerability.parent.davis_assessment.level

string

stableVulnerability's Davis Security Score level.

LOW; MEDIUM; HIGH; CRITICAL; NONE

vulnerability.parent.davis_assessment.vulnerable_function_status

string

stableUsage status of vulnerable functions causing the vulnerability. Status is IN_USE when there's at least one vulnerable function in use by an application.

IN_USE; NOT_AVAILABLE; NOT_IN_USE

vulnerability.parent.mute.change_date

timestamp

stableTimestamp of the last mute or unmute action of the vulnerability.

2023-03-22T13:19:36.945Z

vulnerability.parent.mute.status

string

stableVulnerability's mute status.

MUTED; NOT_MUTED

vulnerability.parent.resolution.change_date

string

stableTimestamp of the vulnerability's last resolution status change.

2023-03-22T13:19:37.466Z

vulnerability.parent.risk.level

string

stableVulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.

LOW; MEDIUM; HIGH; CRITICAL; NONE

vulnerability.references.cve

string[]

stableList of the vulnerability's CVE IDs.

['CVE-2021-41079']

vulnerability.references.owasp

string[]

stableList of vulnerability's OWASP IDs.

['2021:A3']

vulnerability.resolution.change_date

timestamp

stableTimestamp of the last status change of the vulnerability at the entity level.

2023-03-22T13:19:37.466Z

vulnerability.risk.level

string

stableVulnerability's risk score level defined by the provider at the entity level. For Dynatrace, the Davis Security Score level.

LOW; MEDIUM; HIGH; CRITICAL; NONE

vulnerability.risk.score

double

stableRisk score defined by the provider for the vulnerability at the entity level. For Dynatrace, Davis Security Score.

8.1

vulnerability.technology

string

stableTechnology of the vulnerable component.

JAVA; DOTNET; GO; PHP; NODE_JS

vulnerability.tracking_link.text

string

experimentalDisplay text of the tracking link that was set by the user.

P-1000 Vulnerability CVE-2024-0001

vulnerability.type

string

stableClassification of the vulnerability based on commonly accepted enums, such as CWE.

Improper Input Validation

affected_entity.affected_processes.ids

array

resource stableIDs of the processes that are currently affected by the vulnerability.

PROCESS_GROUP_INSTANCE-1

affected_entity.id

string

resource stableID of the affected entity.

PROCESS_GROUP-1; HOST-1

affected_entity.management_zones.names

array

resource stableNames of the management zones to which the affected entity belongs.

mz1

affected_entity.reachable_data_assets.count

long

resource experimentalNumber of reachable data assets.

1

affected_entity.reachable_data_assets.names

array

resource experimentalNames of the data assets that can be reached by the affected entities of the vulnerability.

prod_database_1

affected_entity.vulnerable_component.id

string

resource stableID of the vulnerable component causing the vulnerability.

SOFTWARE_COMPONENT-D8FCFFB4FDF7A3FF

affected_entity.vulnerable_component.package_name

string

resource experimentalPackage name of the vulnerable component causing the vulnerability.

k8s.io/kubernetes; github.com/kubernetes/kubernetes/pkg/kubelet/kuberuntime

affected_entity.vulnerable_functions

array

resource stableVulnerable functions detected, containing or causing the vulnerability.

org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)

affected_entity.vulnerable_functions_not_in_use

array

resource experimentalVulnerable functions detected which are not actively used.

org.springframework.beans.CachedIntrospectionResults:init; java.lang.ProcessBuilder.<init>(String[]); (*DB).queryDC() (/usr/local/go/src/database/sql/sql.go)

related_entities.applications.count

long

resource stableNumber of related applications.

1

related_entities.applications.names

array

resource stableNames of the applications related to the vulnerability's affected entities.

prod_application_1

related_entities.databases.ids

array

resource stableIDs of the databases related to the vulnerability's affected entities.

DATABASE-1

related_entities.hosts.count

long

resource stableNumber of related hosts.

1

related_entities.hosts.names

array

resource stableNames of the hosts related to the vulnerability's affected entities.

prod_host_1

related_entities.kubernetes_clusters.ids

array

resource stableIDs of the Kubernetes clusters related to the vulnerability's affected entities.

KUBERNETES_CLUSTER-1

related_entities.kubernetes_workloads.count

long

resource stableNumber of related Kubernetes workloads.

1

related_entities.kubernetes_workloads.names

array

resource stableNames of the Kubernetes workloads related to the vulnerability's affected entities.

prod_kubernetes_workload_1

related_entities.services.ids

array

resource stableIDs of the services related to the vulnerability's affected entities.

SERVICE-1

event.category

string

stableStandard categorization based on the significance of an event according to the ITIL event management standard (previously known as severity level).

VULNERABILITY_MANAGEMENT

event.description

string

stableHuman-readable description of an event.

S-49 Remote Code Execution status has changed to OPEN.; S-49 Remote Code Execution assessment has changed.

event.kind

string

stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission

SECURITY_EVENT

event.name

string

stableThe human readable display name of an event type.

Vulnerability status change event; Vulnerability assessment change event; Vulnerability external ID change event

event.provider_product

string

resource stableName of the product providing this event.

Runtime Vulnerability Analytics; Snyk Container

event.status_transition

string

experimentalAn enum that shows the transition of the above event state.

NEW_OPEN; REOPEN; CLOSE; MUTE; UNMUTE

event.trigger.user

string

resource stableID of the user who triggered the event. If generated by Dynatrace, the value is SYSTEM.

SYSTEM; <user_id>

timestamp

timestamp

stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.

1649822520123123123

vulnerability.cvss.base_score

double

stableVulnerability's CVSS base score provided by NVD.

8.1

vulnerability.cvss.version

string

stableVulnerability's CVSS score version.

3.1; 4.0

vulnerability.davis_assessment.assessment_mode_reasons

string[]

experimentalReasons for the assessment mode.

['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']

vulnerability.davis_assessment.exploit_status

string

stableVulnerability's public exploits status.

AVAILABLE; NOT_AVAILABLE

vulnerability.davis_assessment.level

string

stableVulnerability's risk level based on Davis Security Score.

LOW; MEDIUM; HIGH; CRITICAL; NONE

vulnerability.davis_assessment.vulnerable_function_status

string

stableUsage status of the vulnerable functions causing the vulnerability.

IN_USE; NOT_AVAILABLE; NOT_IN_USE

vulnerability.display_id

string

stableDynatrace user-readable identifier for the vulnerability.

S-1234

vulnerability.external_url

string

stableExternal provider's URL to the details page of the vulnerability.

https://example.com

vulnerability.id

string

stableDynatrace unique identifier for the vulnerability.

2039861408676243188

vulnerability.mute.change_date

timestamp

stableTimestamp of the vulnerability's last muted or unmuted action.

2023-03-22T13:19:36.945Z

vulnerability.mute.status

string

stableVulnerability's mute status.

MUTED; NOT_MUTED

vulnerability.previous.cvss.base_score

double

stableVulnerability's previous CVSS base score (in case the CVSS base score has changed).

8.1

vulnerability.previous.davis_assessment.data_assets_status

string

stableVulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).

NOT_AVAILABLE; NOT_DETECTED; REACHABLE

vulnerability.previous.davis_assessment.exposure_status

string

stableVulnerability's previous internet exposure status (in case the internet exposure status has changed).

NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORK

vulnerability.previous.davis_assessment.score

double

stableVulnerability's previous Davis Security Score (in case Davis Security Score has changed).

8.1

vulnerability.previous.mute.change_date

string

stableTimestamp of the vulnerability's previous mute status (in case the mute status has changed).

2023-03-22T13:19:36.945Z

vulnerability.previous.mute.status

string

stableVulnerability's previous mute status (in case the mute status has changed).

MUTED; NOT_MUTED

vulnerability.previous.resolution.status

string

stableVulnerability's previous resolution status (in case the resolution status has changed).

OPEN; RESOLVED

vulnerability.previous.risk.score

double

stableVulnerability's previous risk score (in case the risk score has changed).

8.1

vulnerability.references.cwe

string[]

stableList of the vulnerability's CWE IDs.

['CWE-20']

vulnerability.remediation.description

string

experimentalDescription of the vulnerability's remediation advice.

Upgrade component to version 1.2.3 or higher

vulnerability.resolution.status

string

stableVulnerability's resolution status.

OPEN; RESOLVED

vulnerability.risk.scale

string

stableScale by which the vulnerability's risk score and risk score level defined by the provider are measured.

Davis Security Score

vulnerability.stack

string

experimentalLevel of the vulnerable component in the technological stack.

CODE; CODE_LIBRARY; SOFTWARE; CONTAINER_ORCHESTRATION

vulnerability.title

string

stableTitle of the vulnerability.

Improper Input Validation

vulnerability.url

string

stableDynatrace URL to the details page of the vulnerability. |

https://example.com

affected_entities.count

long

resource stableNumber of affected entities.

1

affected_entities.kubernetes_nodes.count

long

resource stableNumber of affected nodes.

2

affected_entities.previous.hosts.count

long

resource deprecatedNumber of affected hosts before the last change event.

5

affected_entities.previous.process_groups.count

long

resource deprecatedNumber of affected process groups before the last change event.

2

affected_entities.types

array

resource stableTypes of affected entities.

PROCESS_GROUP; HOST; KUBERNETES_NODE

related_entities.applications.count

long

resource stableNumber of related applications.

1

related_entities.hosts.count

long

resource stableNumber of related hosts.

1

related_entities.kubernetes_workloads.count

long

resource stableNumber of related Kubernetes workloads.

1

related_entities.services.count

long

resource stableNumber of related services.

1

event.category

string

stableCategorization based on the product and data generating this event.

VULNERABILITY_MANAGEMENT

event.group_label

string

experimentalGroup label of an event.

STATE_REPORT

event.level

string

resource stableMain reference point to which the event or data is related. Possible values are Vulnerability (shows the global aggregation across the entire environment and comprises all entities and management zones) and Entity (shows the assessment based on the entity itself).

VULNERABILITY

event.provider

string

stableSource of the event, for example, the name of the component or system that generated the event.Tags: permission

Dynatrace; Snyk

event.status

string

stableStatus of an event as being either Active or Closed.

OPEN; RESOLVED; MUTED

timestamp

timestamp

stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source.

1649822520123123123

vulnerability.code_location.name

string

stableName of the code location where the code-level vulnerability was detected.

org.dynatrace.profileservice.BioController.markdownToHtml(String):80

vulnerability.cvss.vector

string

experimentalVulnerability's CVSS vector defined by the provider.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L; CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H/E:P/RL:T/RC:U/CR:L/IR:M/AR:H

vulnerability.davis_assessment.assessment_mode

string

stableAvailability of the information based on which the vulnerability assessment has been done.

FULL; NOT_AVAILABLE; REDUCED

vulnerability.davis_assessment.data_assets_status

string

stableVulnerability's reachability of related data assets by affected entities.

NOT_AVAILABLE; NOT_DETECTED; REACHABLE

vulnerability.davis_assessment.exposure_status

string

stableVulnerability's internet exposure status.

NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORK

vulnerability.davis_assessment.score

double

stableVulnerability's Davis Security Score (1-10) calculated by Dynatrace.

8.1

vulnerability.davis_assessment.vulnerable_function_status

string

stableUsage status of the vulnerable functions causing the vulnerability.

IN_USE; NOT_AVAILABLE; NOT_IN_USE

vulnerability.display_id

string

stableDynatrace user-readable identifier for the vulnerability.

S-1234

vulnerability.external_url

string

stableExternal provider's URL to the details page of the vulnerability.

https://example.com

vulnerability.id

string

stableDynatrace unique identifier for the vulnerability.

2039861408676243188

vulnerability.mute.change_date

timestamp

stableTimestamp of the vulnerability's last muted or unmuted action.

2023-03-22T13:19:36.945Z

vulnerability.mute.status

string

stableVulnerability's mute status.

MUTED; NOT_MUTED

vulnerability.references.cve

string[]

stableList of the vulnerability's CVE IDs.

['CVE-2021-41079']

vulnerability.references.owasp

string[]

stableList of vulnerability's OWASP IDs.

['2021:A3']

vulnerability.resolution.change_date

timestamp

stableTimestamp of the vulnerability's last resolution status change.

2023-03-22T13:19:37.466Z

vulnerability.risk.level

string

stableVulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.

LOW; MEDIUM; HIGH; CRITICAL; NONE

vulnerability.risk.score

double

stableVulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.

8.1

vulnerability.technology

string

stableTechnology of the vulnerable component.

JAVA; DOTNET; GO; PHP; NODE_JS

vulnerability.type

string

stableClassification of the vulnerability based on commonly accepted enums, such as CWE.

Improper Input Validation

affected_entities.affected_processes.count

long

resource stableNumber of affected processes.

50

affected_entities.hosts.count

long

resource stableNumber of affected hosts.

2

affected_entities.management_zones.ids

array

resource stableIDs of the management zones to which the affected entities belong.

mzid1

affected_entities.monitored_processes.count

long

resource stableNumber of processes of the process group.

100

affected_entities.types

array

resource stableTypes of affected entities.

PROCESS_GROUP; HOST; KUBERNETES_NODE

affected_entities.vulnerable_components.names

array

resource stableNames of the vulnerable components causing the vulnerability. |

com.fasterxml.jackson.core:jackson-databind:2.10.0; node-sass:4.14.1

related_entities.applications.count

long

resource stableNumber of related applications.

1

related_entities.hosts.count

long

resource stableNumber of related hosts.

1

related_entities.kubernetes_workloads.count

long

resource stableNumber of related Kubernetes workloads.

1