Security events

• Latest Dynatrace
• Reference
• Updated on Oct 05, 2026

Security events are a special type of data representing security-relevant data generated by Dynatrace, but also third-party vendors. The security events models are organized into the following subcategories:

In the security.events table, the data is separated in different buckets, depending on the origin of the data. For Dynatrace generated data, data is stored in the default_securityevents_builtin bucket, data ingested through the ingest APIs is stored in the default_securityevents bucket, unless rerouted to another bucket in OpenPipeline.

Query

Provides an overview of all security events by event type.

fetch security.events
| summarize {events = count()}, by: {event.type}
| sort events desc

Lists the most recent security events across all security event domains.

fetch security.events
| sort timestamp desc

Counts security events by provider and event type to show which sources generate which kinds of events.

fetch security.events
| summarize {events = count()}, by: {event.provider, event.type}
| sort events desc

Shared fields

The following field groups are shared across security event models.

Affected entities fields

Affected entity fields

Related entities fields

Vulnerable component fields

Security event fields

event.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Object fields

Scan fields

scan.result.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Entry points fields

Resource describing entry points of a vulnerability.

Product fields

Identification of the external system that produced the data and the logical schema of its content, independent of signal type and ingestion method

Sink code fields

The individual parts of an application where data from entry points ends up, potentially causing a vulnerability to be exploited.

Security events Smartscape fields

Shared Smartscape fields for security events.

Vulnerability scan events

A vulnerability scan event records that a specific object—such as a running process group, container image, or code artifact—was scanned for vulnerabilities by a particular tool, together with scan coverage metadata. It lets you distinguish an object that was scanned and found clean from one that was never scanned. Vulnerability scan events are produced both by Dynatrace Runtime Vulnerability Analytics (process scans) and by ingested third-party scanners such as Black Duck.

Query

Lists the most recent vulnerability scan events provided by Dynatrace Runtime Vulnerability Analytics.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| sort timestamp desc
| filter product.vendor == "Dynatrace"

Counts unique scanned objects by object type.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| dedup {object.id}, sort: {timestamp desc}
| summarize {scanned_objects = countDistinctExact(object.id)}, by: {object.type}
| sort scanned_objects desc

Counts vulnerability scan events by provider and product.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| summarize {scans = count()}, by: {event.provider, product.name}
| sort scans desc

Show vulnerability scans over time by different vendors and their products.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| summarize count = count(), by: {bin(timestamp, 1h), product.vendor, product.name}

Lists the most recent unique vulnerability scans performed on code artifacts.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| filter object.type == "CODE_ARTIFACT"
| dedup {object.id}, sort: {timestamp desc}
| sort timestamp desc

Counts unique code artifact repositories scanned by each provider.

fetch security.events
| filter event.type == "VULNERABILITY_SCAN"
| filter object.type == "CODE_ARTIFACT"
| dedup {object.id}, sort: {timestamp desc}
| summarize {scanned_repositories = countDistinctExact(artifact.repository)}, by: {event.provider, product.name}
| sort scanned_repositories desc

Vulnerability scan events metadata fields

Meta-information on the vulnerability scan event.

Vulnerability scan events affected object data fields

Information about the affected object to which the scan belongs.

Vulnerability scan events scanner metadata fields

Information about the scan and the product that performed it.

Vulnerability scan events product data fields

Information about the third-party product from where Dynatrace fetches data.

Extensions

Vulnerability scan events container image data fields

Container-image-specific data for scans performed on container image registries.

Vulnerability scan events OS data fields

Information about the operating system on which the scan is performed.

Vulnerability scan events entity fields

Information about the entity being scanned.

Vulnerability scan events Kubernetes resource fields

The associated Kubernetes resource (if any)