Specification
- Skill ID
- dynatrace/dynatrace-for-ai/dt-sec-insights
- Publisher
- dynatrace
- Repository
- dynatrace-for-ai
- Installs
- 0
- Files
- 16
- License
- Apache-2.0
- Synced
- Sep 23, 2026
How to use it
Open any RiverX project, open the Skills panel in the chat, and search for this identifier. The files are fetched from the source repository at install time.
dynatrace/dynatrace-for-ai/dt-sec-insightsInstalls these files- SKILL.md
- references/all-security-events.md
- references/common-patterns.md
- references/compliance.md
- references/coverage-and-dashboards.md
- references/coverage.md
- references/dashboard-patterns.md
- references/data-model.md
- references/detections.md
- references/entity-enrichment.md
- references/mistakes-and-troubleshooting.md
- references/threat-intelligence.md
- references/vulnerabilities-dynatrace-advanced.md
- references/vulnerabilities-dynatrace.md
- references/vulnerabilities-entities.md
- references/vulnerabilities-external.md
What this skill tells the agent
Security Insights Skill
Query and analyze Dynatrace security data in security.events using DQL. Events come from Dynatrace-native sources (RVA, RAP, Automated Detections, SPM) or external products ingested via integrations (AWS Security Hub, Amazon GuardDuty, GitHub Advanced Security, Snyk, Qualys, Tenable, and more).
What This Skill Covers
- Vulnerability management — open CVEs on running code from DT-native RVA (risk-ranked with Dynatrace Security Score and the four-dimension runtime assessment: vulnerable-function-in-use, public network exposure, reachable data assets, public exploit available) plus external SCA / SAST / image scanners.
- Compliance posture — DT-native KSPM (Kubernetes-only: CIS, DORA, NIST, STIG) plus CSPM/VSPM and external compliance/posture providers.
- Runtime attacks and threats — DT-native detections (RAP runtime attacks, Automated Detections rules) plus external detection providers.
- Threat intelligence — external threat-intelligence reports (AlienVault OTX pulses, CrowdStrike Falcon Intelligence) with actor / campaign / targeting context and indicators of compromise (IOCs); correlate reported IOCs / CVEs / techniques against your monitored environment. These are threat intel about the wild — not findings on your entities — and are queried separately.
- Scan coverage analysis — covered vs. not-covered k8s workloads/hosts/processes, by Dynatrace scanning feature (
Library Vulnerability Analytics,Operating System Vulnerability Analytics,Code-level Vulnerability Analytics) or by external product. - Entity enrichment — map external findings to Dynatrace runtime entities (hosts, K8s workloads, cloud resources) via Smartscape.
- Dashboards / KPIs — tiles, top-N tables, trend charts, coverage donuts.
When to Use This Skill
✅ Must-first routing rule: identify user intent first, then load the matching primary reference from Quick Start: Find Your Use Case before generating DQL.
Identify the intent, then load the matching reference before writing DQL.
Cross-cutting (any / all finding types)
| Intent / example | Reference | Pattern | |
|---|---|---|---|
| Security posture / overview across all products (incl. DT-native) | all-security-events.md § Broad-Question Query Decomposition | 3-stream decomposition (external+detections 24h / RVA 30m / KSPM 1h), merged; lead the count summary with KSPM compliance — CIS first (other standards + RVA + detections beneath) → compliance.md § CIS-Primary Standard Summary | |
| Findings on a specific entity — direct or related (blast radius) | dt-sec-contextualization entity-enrichment.md · all-security-events.md | Broad entity-security questions must decompose: external *_FINDING by dt.smartscape_source.id / dt.entity.* / k8s.* (24h) + DT RVA entity scope (30m) + DT SPM entity scope (1h) | |
| Findings from a specific provider | all-security-events.md § Scoping to a Specific Provider | `contains(lower(event.provider \ | product.vendor), "<p>")` |
| Which third-party / external tools are sending data (DT-native excluded) | all-security-events.md § Which external integrations are active | external-only enumeration (single query) | |
| Which security products are integrated? / what security data do we have? (default: include DT-native RVA + KSPM) | all-security-events.md § Broad-Question Query Decomposition | 3-stream decomposition; never a single wide security.events scan | |
| Which products cover a specific entity | dt-sec-contextualization correlation-and-coverage.md · all-security-events.md | summarize by product.*; findings-vs-scans split |
Routing tie-breaker: an unqualified "which security products are integrated? / are we covered? / what do we have?" defaults to the DT-inclusive 3-stream decomposition (it must query DT vulnerabilities and compliance). Take the external-only single query only when the user explicitly scopes to external / third-party tools ("which external tools are sending us data?").
Vulnerabilities (CVE management)
| Intent / example | Reference | Pattern |
|---|---|---|
| Counts / severity ("how many critical?", by risk + mute status) | vulnerabilities-dynatrace.md | RVA snapshot Steps 1–3 |
| Most vulnerable components / hosts / workloads (rankings) | vulnerabilities-entities.md | Steps 1–3 + expand typed related_entities.<group>.ids → smartscapeNodes lookup on id_classic — ⚠ k8s.*/dt.entity.* are null on RVA events |
| CVE / library lookup; "am I vulnerable to log4shell?" | vulnerabilities-dynatrace.md § Entity Scoping | Step 2 CVE/component filter; scope RVA to a known entity |
| Blast radius — which entities are affected by CVE X | vulnerabilities-entities.md | related_entities.* indirect-relation expand |
| Lifecycle — new / resolved / open-duration / MTTR | vulnerabilities-dynatrace.md | post-derive resolution.change_date; MTTR via change-events-only snippet (§ Resolution time) |
| Runtime advanced — function-in-use, exposure, exploit, data-assets | vulnerabilities-dynatrace.md | Davis-assessment fieldsAdd (Step 3) |
| External scanner vulns — containers / artifacts / components | vulnerabilities-external.md | VULNERABILITY_FINDING + external routing |
| Verify external vulnerability findings with RVA | vulnerabilities-external.md § Verify external vulnerability findings with RVA · dt-sec-contextualization entity-enrichment.md | First match the same vulnerability by vulnerability.references.cve; then prove runtime relatedness via direct dt.smartscape* IDs, container-image digest → running CONTAINER, or host host.ip → Smartscape HOST |
| "Newly reported this period and not in the previous period" (external) | vulnerabilities-external.md · common-patterns.md § 18 | prior-period anti-join (isNull(right.*)) — a finding.time.created filter is NOT equivalent |
| AI/LLM/GenAI workload vulnerabilities; "which AI services have vulnerabilities?" | vulnerabilities-dynatrace-advanced.md § AI-workload vulnerabilities | Probe `smartscapeNodes "GENAI_SERVICE"` first — zero rows → report cannot be determined (no GenAI-monitored services); non-zero → DT findings + GENAI scope (30m, dedup finding.id). ⚠ Zero rows = hard stop — no fallbacks permitted: entity/namespace/workload name substrings, ML library component lists, process/image/label patterns are all prohibited substitutes. |
| New AI-workload vulnerabilities this period | vulnerabilities-dynatrace-advanced.md § UC-AI2 | prior-window anti-join on {genai_service.id, vulnerability.id} |
Detections (threats & attacks)
| Intent / example | Reference | Pattern |
|---|---|---|
| Severity / time-window overview (DT + external) | detections.md · all-security-events.md | DETECTION_FINDING summary; default unqualified timeframe is 2h, widen to 24h only if empty |
By attack type (SQL injection, crypto-mining, …) | detections.md | finding.type substring match |
| Attacker IPs / campaigns | detections.md | expand actor.ips + ip() |
| MITRE technique / sub-technique | detections.md | threat.attack.* arrays |
| RAP-only / Automated-Detections-only | detections.md § Provider Routing | product.name=="Runtime Application Protection" / event.provider=="Dynatrace Automated Detections" |
| Map detections to entities; repeated firing | detections.md · dt-sec-contextualization entity-enrichment.md | object.id grouping / enrichment |
| A specific external provider | all-security-events.md § Scoping to a Specific Provider | provider contains idiom |
More from dynatrace
Use this skill in a project
Open any RiverX project, search the Skills panel for dynatrace/dynatrace-for-ai/dt-sec-insights, and install it in one click.