System event models

• Published Aug 26, 2025

System events are used to store details about executed queries, auditing events, billing events and more. In order to query system events, you need the storage:system:read permission.

Query

Query system events.

fetch dt.system.events

Anomaly Detector Status Event

The anomaly detector status events are used for Davis anomaly detection. They track errors and warnings during the execution of an anomaly detector. Examples:

Query

Analyze anomaly detectors status events.

fetch dt.system.events
| filter event.kind == "ANOMALY_DETECTOR_STATUS_EVENT"

AppEngine Functions - Small billing usage

Model describing a billing usage event of function invocations. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AppEngine Functions - Small"

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

function.type MUST be one of the following:

Audit Event

For every API access, Dynatrace stores an audit event in the dt.system.events table.

Additionally the Audit Event allows to attach an arbitrary key/value map with string keys and string values to the event. Keys are prefixed with "details." during serialization.

Query

Analyze audit events.

fetch dt.system.events
| filter event.kind == "AUDIT_EVENT"

Automation Workflow billing usage

Model describing a billing usage event of automation workflows. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events for AutomationEngine workflows.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Automation Workflow"

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

AutomationEngine action execution event

Model describing an AutomationEngine action execution event. Action execution events are stored in the dt.system.events table.

Query

AutomationEngine action execution state change.

fetch dt.system.events
| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="ACTION_EXECUTION"

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.automation_engine.state MUST be one of the following:

AutomationEngine task execution event

Model describing an AutomationEngine task execution event. Task execution events are stored in the dt.system.events table.

Query

AutomationEngine task execution state change.

fetch dt.system.events
| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="TASK_EXECUTION"

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.automation_engine.state MUST be one of the following:

AutomationEngine workflow execution event

Model describing an AutomationEngine workflow execution event. Workflow execution events are stored in the dt.system.events table.

Query

AutomationEngine workflow execution state change.

fetch dt.system.events
| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="WORKFLOW_EXECUTION"

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.automation_engine.state MUST be one of the following:

AutomationEngine workflow lifecycle event

Model describing an AutomationEngine workflow lifecycle event. Workflow lifecycle events are stored in the dt.system.events table.

Query

AutomationEngine workflow lifecycle events.

fetch dt.system.events
| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and in(event.type, array("WORKFLOW_CREATED", "WORKFLOW_UPDATED", "WORKFLOW_DELETED"))

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

AutomationEngine workflow throttle event

Model describing an AutomationEngine workflow throttle event. Workflow throttle events are stored in the dt.system.events table.

Query

AutomationEngine workflow throttle events.

fetch dt.system.events
| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="WORKFLOW_THROTTLE"

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

Data Deletion Events

Dynatrace stores a data deletion event for each segment that got rewritten in the dt.system.events table.

Query

Analyze data deletion events.

fetch dt.system.events
| filter event.kind == "DATA_DELETION_EVENT"

Dynatrace Self-monitoring Event

Events that are generated by Dynatrace components with self-monitoring information (health, status, unexpected situations)

Fields

Enrichment execution events

Dynatrace stores an enrichment execution event for the enrichment of threat observables in the dt.system.events table.

Query

Analyze enrichment execution events.

fetch dt.system.events
| filter event.kind == "ENRICHMENT_EXECUTION_EVENT"

The number of successful enrichments.

fetch dt.system.events
| filter event.kind == "ENRICHMENT_EXECUTION_EVENT"
| filter event.outcome == "success"
| summarize count()

The number of failed enrichments.

fetch dt.system.events
| filter event.kind == "ENRICHMENT_EXECUTION_EVENT"
| filter event.outcome == "failure"
| summarize count()

The number of enrichments by integration app.

fetch dt.system.events
| filter event.kind == "ENRICHMENT_EXECUTION_EVENT"
| summarize count(), by: {dt.enrichment.integration.id}

Events - Ingest & Process billing usage

Model describing a billing usage event of ingest for events. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events for the "Events - Ingest & Process" capability.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Ingest & Process"
| dedup event.id

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Events - Query billing usage

Model describing a billing usage event of a events query execution. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Query"

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Events - Retain billing usage

Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Retain"

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Foundation & Discovery billing usage

Model describing a billing usage event for the Foundation & Discovery DPS capability. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage for Foundation & Discovery on 15-minute billing intervals.

Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Foundation & Discovery"
| dedup event.id

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Full-Stack Monitoring billing usage

Model describing a billing usage event for the Full-Stack Monitoring DPS capability. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage for Full-Stack Monitoring on 15-minute billing intervals.

Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Full-Stack Monitoring"
| dedup event.id

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

GenAI Event

GenAI events are emitted when a GenAI skill is invoked or feedback is provided. They provide tracking data for skill usage and user feedback. Examples:

Query

Retrieve all GenAI events.

fetch dt.system.events
| filter event.kind == "GENAI_EVENT"

Count of GenAI skill invocations.

fetch dt.system.events
| filter event.kind == "GENAI_EVENT"
| filter event.type == "GenAi Skill Invocation"
| summarize count()

Count the GenAI invocations per skill.

fetch dt.system.events
| filter event.kind == "GENAI_EVENT"
| filter event.type == "GenAi Skill Invocation"
| summarize invocations=count(), by: skill

Count of the GenAI feedback type per skill.

fetch dt.system.events
| filter event.kind == "GENAI_EVENT"
| filter event.type == "GenAi Feedback"
| summarize count(), by: {feedback.type, skill}

Time series of the GenAI execution duration per skill.

fetch dt.system.events
| filter event.kind == "GENAI_EVENT"
| filter event.type == "GenAi Skill Invocation"
| makeTimeseries  avg(execution_duration_ms), by: {skill}

Values

event.type MUST be one of the following:

skill MAY be one of the following:

status MUST be one of the following:

failure_reason MAY be one of the following:

feedback.type MUST be one of the following:

feedback.category MAY be one of the following:

Infrastructure Monitoring billing usage

Model describing a billing usage event for the Infrastructure Monitoring DPS capability. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage for Infrastructure Monitoring on 15-minute billing intervals.

Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Infrastructure Monitoring"
| dedup event.id

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Log Management & Analytics - Query billing usage

Model describing a billing usage event of a logs query execution. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Log Management & Analytics - Query"

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Log Management & Analytics - Retain billing usage

Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events table.

Query

Fetch Log Management & Analytics - Retain billing usage events.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Log Management & Analytics - Retain"

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Log Management & Analytics - Retain with Included Queries billing usage

Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events table.

Query

Fetch Log Management & Analytics - Retain with Included Queries usage events.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Log Management & Analytics - Retain with Included Queries"

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Metrics - Ingest & Process billing usage

Model describing a billing usage event of ingest & process for metrics. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Metrics - Ingest & Process"