- Skill ID
- dynatrace/dynatrace-for-ai/dt-obs-compliance-assistant
- Publisher
- dynatrace
- Repository
- dynatrace-for-ai
- Installs
- 0
- Files
- 1
- License
- Apache-2.0
- Synced
- Sep 23, 2026
Open any RiverX project, open the Skills panel in the chat, and search for this identifier. The files are fetched from the source repository at install time.
dynatrace/dynatrace-for-ai/dt-obs-compliance-assistantInstalls these files- SKILL.md
What this skill tells the agent
Compliance Assistant
Track, manage, and investigate EU DORA compliance posture using real-time observability and security insights from the Dynatrace Compliance Assistant app.
Critical Disclaimer
The Dynatrace compliance score and all outputs from Compliance Assistant are indicative metrics based on real-time observability data and automated systems. They do not replace comprehensive or formal compliance assessments and do not constitute a legal determination of a company's compliance status under EU DORA or any other regulation.
Never claim that a score, tier, or Compliance Assistant output means an organization is legally compliant or non-compliant with EU DORA. Always present results as operational indicators to support remediation decisions, not as legal or regulatory verdicts.
When to Use This Skill
✅ Use for:
- EU DORA compliance posture, compliance score, compliance snapshot, score tier
- Critical or Important Functions (CIFs): health, KPI monitoring, impact analysis, setup questions
- Incident lifecycle under DORA: unclassified problems, potential major incidents, classified major incidents
- ICT risk inputs: vulnerabilities, security detection findings, misconfigurations (ICT asset configuration results)
- Incident classification under EU DORA: materiality thresholds, duration criteria, economic impact
- DQL queries for
compliance.incidentbizevents, CIF health, or unclassified problems on CIFs - Onboarding, permissions, and settings for Compliance Assistant
❌ Do not use for:
- Regulatory frameworks other than EU DORA — SOC2, PCI-DSS, HIPAA, ISO 27001 are not supported by this app
- Generic Davis problems with no DORA, CIF, or compliance context → use
dt-obs-problems - Generic vulnerability or security finding queries not scoped to compliance or DORA → use application security skills
- Generic "score" queries without "compliance" or "DORA" — Dynatrace has many scores
- Configuring Business Flow or defining business process steps → see Business Flow documentation
- Configuring Security Posture Management rules → see SPM documentation
- General DQL syntax help → use
dt-dql-essentials
Prerequisites
Installation
Install Compliance Assistant from Dynatrace Hub.
Required Permissions
| Permission | Purpose |
|---|---|
storage:buckets:read | Read buckets |
storage:events:read | Read events |
storage:entities:read | Read entities table |
storage:metrics:read | Required for Istio discovery findings rule |
storage:filter-segments:read | Read filter segments |
settings:objects:read | Read Log ingest settings |
settings:schemas:read | Read settings schemas |
state:app-states:read | Read app state |
hub:catalog:read | Read app version |
storage:security.events:read | Fetch security events |
Required Data Sources
| Source | Purpose |
|---|---|
| Business Flow | CIF monitoring and incident detection on business processes — required for incident classification |
| Vulnerability events | Continuous vulnerability assessment (DORA requirement) |
| Detection finding events | Continuous cyber threat assessment (DORA requirement) |
| Compliance events | ICT asset secure configuration baseline verification (DORA requirement) — powered by Security Posture Management |
Core Concepts
Compliance Framework
Compliance Assistant currently supports EU DORA (Digital Operational Resilience Act) only. It consolidates observability and security insights into a single compliance posture view for this framework. Support for additional frameworks is planned.
Dynatrace Score (Compliance Snapshot)
A real-time, tiered score summarizing current ICT risk posture across potential incidents, security detection findings, vulnerabilities, and misconfigurations. The score tier is determined by the most severe active condition; within a tier, the score is reduced by a penalty for each criterion met.
Score tiers:
| Tier | Max score | Triggered when… |
|---|---|---|
| On Track | 100 | No criteria met across incidents, security detection findings, vulnerabilities, misconfigurations |
| Low | 99 | Any low-severity finding in security detection findings/vulnerabilities/misconfigurations |
| Medium | 79 | Any medium-severity finding, or ≥1 unclassified incident |
| High | 59 | Any high-severity finding, or ≥5 unclassified incidents |
| Critical | 34 | Any critical security detection finding/vulnerability/misconfiguration, or ≥1 potential major incident |
| Major | 5 (fixed) | ≥1 confirmed classified major incident — short-circuits to a fixed score of 5 |
Penalty mechanic: Within a tier, score = tier max − (6 × number of criteria met in that tier). For example, Medium tier with 2 criteria met: 79 − 12 = 67.
This score is a high-level operational indicator. It does not confirm regulatory compliance or legal status.
Critical or Important Functions (CIFs)
Under EU DORA, financial entities must identify and monitor business functions that, if disrupted, could significantly impact financial performance or service continuity. In Compliance Assistant, CIFs are configured by linking Business Flow business processes to the DORA framework. Smartscape on Grail provides end-to-end visibility by linking each CIF to its underlying IT components.
Incident Lifecycle
Davis-detected problems affecting CIF business processes move through three states:
| State | Definition |
|---|---|
| Unclassified problem | A Davis problem affects a CIF but fewer than 2 DORA materiality thresholds are breached |
| Potential major incident | ≥2 monitored DORA materiality thresholds are breached |
| Classified major incident | Manually confirmed as major in Compliance Assistant; generates a compliance.incident bizevent snapshot |
EU DORA materiality thresholds monitored:
| Threshold | Criterion |
|---|---|
| CIFs affected | Blast radius across critical or important functions |
| Incident duration | 24-hour threshold |
| Economic impact | €100,000 threshold, calculated from estimated cost per minute of affected CIFs × incident duration |
Classification is always a manual step performed in the Compliance Assistant app. Do not classify incidents on behalf of the user.
Once classified, the generated compliance.incident bizevent can trigger automations via Dynatrace Workflows (e.g., creating a ServiceNow incident or Jira ticket enriched with compliance impact details).
ICT Risk Inputs
| Signal type | Source | DORA requirement |
|---|---|---|
| Vulnerabilities | Vulnerability findings | Continuous vulnerability assessment |
| Security detection findings | Detection finding events | Continuous cyber threat assessment |
| ICT asset configuration results | Compliance events via Security Posture Management | Secure configuration baseline verification |
DQL Reference
Classified Major Incidents
More from dynatrace
Use this skill in a project
Open any RiverX project, search the Skills panel for dynatrace/dynatrace-for-ai/dt-obs-compliance-assistant, and install it in one click.