Detection finding events represent alerts or detections generated by security tools or Dynatrace detection rules. Detections are available for both Dynatrace-generated and third-party ingested data.
Provides an overview of detection findings by normalized risk level.
fetch security.events| filter event.type == "DETECTION_FINDING"| summarize {findings = count()}, by: {dt.security.risk.level}| sort findings desc
Lists the most recent detection findings across the domain.
fetch security.events| filter event.type == "DETECTION_FINDING"| sort timestamp desc
Counts detection findings by provider and product.
fetch security.events| filter event.type == "DETECTION_FINDING"| summarize {findings = count()}, by: {event.provider, product.name}| sort findings desc
A detection finding is an alert raised by a security tool or a Dynatrace detection rule when it observes suspicious or malicious activity—for example, an exploit attempt, a policy violation, or anomalous behavior. Detection findings are available for both Dynatrace-generated data and findings ingested from third-party security tools, and are primarily consumed in the Threats & Exploits app. Unlike a vulnerability finding, which reports a known weakness in a scanned object, a detection finding reports activity that was observed. Native Dynatrace findings (produced by the Automated Detections capability) additionally carry detection.* fields (the configured detection strategy) and scan.* fields (the scan that produced them); ingested third-party findings do not.
Lists the most recent detection findings.
fetch security.events| filter event.type == "DETECTION_FINDING"| sort timestamp desc
Counts detection findings by normalized risk level.
fetch security.events| filter event.type == "DETECTION_FINDING"| summarize {findings = count()}, by: {dt.security.risk.level}| sort findings desc
Counts critical and high detection findings by finding type and risk level.
fetch security.events| filter event.type == "DETECTION_FINDING"| filter in(dt.security.risk.level, {"CRITICAL", "HIGH"})| summarize {findings = count()}, by: {finding.type, dt.security.risk.level}| sort findings desc
Core event metadata. These fields identify the event record and are added automatically by Dynatrace during ingest.
| Attribute | Type | Description | Examples |
|---|---|---|---|
event.id | string | stable Display name: Event IDIn combination with timestamp, this field uniquely identifies a specific event. | 1669863368163_07755297913417681159 |
event.kind | string | stable Display name: Event kindDescribes the general nature of the event, without detailing the event's specific contents. It helps to determine the record type of a raw event. Tags: permission | SECURITY_EVENT |
event.type | string | stable Display name: Event typeThe unique type identifier of a given event. Tags: permission | DETECTION_FINDING |
timestamp | timestamp | stable Display name: TimestampTime (UNIX Epoch time in nanoseconds) when the event was ingested. | 1649822520123123123 |
Information about the security finding.
| Attribute | Type | Description | Examples |
|---|---|---|---|
finding.id | string | stable Display name: Finding IDUnique identifier string of a finding. | A-2GJ3LSUM; arn:aws:guardduty:us-east-1:124381674733:detector/14c0550905ccbe6e5d5455071c73c1e5/finding/5c3665bd5af0488e94f482fc549a37c1 |
finding.time.created | timestamp | stable Display name: Finding createdTime when the finding was created. | 2024-06-24T04:47:21.154000000+02:00 |
finding.title | string | stable Display name: Finding titleTitle or summary of the finding. | Title of finding |
finding.type | string | stable Display name: Finding typeOriginal type of the finding reported by the vendor. | SQL injection; Command injection; JNDI injection; SSRF; TTPs/Execution/Execution:Runtime-SuspiciousShellCreated |
Information about the object in which the detection finding was raised.
| Attribute | Type | Description | Examples |
|---|---|---|---|
object.id | string | resource experimental Identifier of the affected object. Either this or object.name has to be set. | HOST-E0D8F94D9065F24F; i-06becf87d5326157a; arn:aws:ecr:eu-central-1:124567890123:repository/unguard-frontend/sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1 |
object.name | string | resource experimental Name of the affected object. Either this or object.id has to be set. | kube-controller-manager-k8s-mst01-t12; daemonset-25qlv |
object.type | string | resource experimental Type of the affected object. | host; ec2_instance; container_image; process; HOST; EC2_INSTANCE; CONTAINER_IMAGE |
Information about the product or tool that raised the detection finding.
| Attribute | Type | Description | Examples |
|---|---|---|---|
event.provider | string | stable Display name: Event providerSource of the event, for example, the name of the component or system that generated the event. Tags: permission | OneAgent; AWS Security Hub; Amazon GuardDuty |
product.name | string | experimental Name of the product that emitted the data 1 | Runtime Application Protection; GuardDuty |
product.vendor | string | experimental Organization that owns or distributes the source system that produced the data 2 | Dynatrace; Amazon |
Required when using product.* fields. Use the official product name as marketed by the vendor. Should be specific enough to identify the product uniquely within a vendor.
Required when using product.* fields. Identifies the top-level vendor regardless of how the data was ingested. For open-source projects, use the primary commercial distributor or sponsoring organization (for example, "Red Hat" for OpenShift, "Google" for GKE). For Dynatrace-produced data, use "Dynatrace".
Optional fields for detection findings (their existence in an event does not influence if they're displayed in T&E or not).
| Attribute | Type | Description | Examples |
|---|---|---|---|
event.end | string | stable Display name: Event endTimestamp of latest activity associated with this finding in UTC (given in Grail preferred Linux timestamp nano precision format). | 1757405399 |
event.start | string | stable Display name: Event startTimestamp of earliest activity associated with this finding in UTC (given in Grail preferred Linux timestamp nano precision format). | 1757405398 |
threat.attack.subtechnique.ids | string[] | experimental MITRE ATT&CK sub-technique identifiers for this detection, in T{parent}.{sub} dotted format. Independent of threat.attack.technique.ids—no positional alignment is assumed or required. The parent technique is encoded in the sub-technique ID itself, for example, T1059.003 belongs to technique T1059). Omit when no sub-technique information is available; don't use empty string placeholders. Sub-technique names are derivable from IDs via the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.subtechnique.ids, "T1059.003") | ['T1059.003']; ['T1059.003', 'T1078.002'] |
threat.attack.subtechnique.names | string[] | experimental Human-readable names of the MITRE ATT&CK sub-techniques for this detection. Optional companion to threat.attack.subtechnique.ids. When populated, elements must correspond positionally to threat.attack.subtechnique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide sub-technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base. | ['Windows Command Shell']; ['Windows Command Shell', 'Domain Accounts'] |
threat.attack.tactic.ids | string[] | experimental MITRE ATT&CK tactic identifiers for this detection, in TA-prefixed format. A detection may map to zero or more tactics. Omit or set to an empty array when tactic information is unavailable from the producing source. Tactic names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.tactic.ids, "TA0002") | ['TA0002']; ['TA0002', 'TA0004'] |
threat.attack.tactic.names | string[] | experimental Human-readable names of the MITRE ATT&CK tactics for this detection. Optional companion to threat.attack.tactic.ids. When populated, elements must correspond positionally to threat.attack.tactic.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide tactic names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base. | ['Execution']; ['Execution', 'Privilege Escalation'] |
threat.attack.technique.ids | string[] | experimental MITRE ATT&CK technique identifiers for this detection, in T-prefixed format. A detection may map to zero or more techniques. The primary pivot field for ATT&CK heat maps and technique coverage dashboards. Technique names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.technique.ids, "T1059") | ['T1059']; ['T1059', 'T1078'] |
threat.attack.technique.names | string[] | experimental Human-readable names of the MITRE ATT&CK techniques for this detection. Optional companion to threat.attack.technique.ids. When populated, elements must correspond positionally to threat.attack.technique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base. | ['Command and Scripting Interpreter']; ['Command and Scripting Interpreter', 'Valid Accounts'] |
threat.attack.version | string | experimental Version of the MITRE ATT&CK framework used to classify this detection. Useful for audit and reproducibility, since tactic and technique IDs can be added or renumbered across major ATT&CK versions. Some producers don't embed the framework version in their event payloads; omit when version provenance can't be reliably determined. Use bare version numbers without a "v" prefix. | 14.1; 15.1; 16.0 |
Fields added by Dynatrace to normalize and enrich the finding with platform-level risk assessment and Smartscape entity resolution.
| Attribute | Type | Description | Examples |
|---|---|---|---|
dt.security.risk.level | string | stable Display name: Security risk levelRisk score level, mapped and normalized by Dynatrace. | LOW; MEDIUM; HIGH; CRITICAL; NONE; NOT_AVAILABLE |
dt.smartscape_source.id | smartscapeId | resource stable Display name: Smartscape source IDThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1 Tags: smartscape-id | K8S_CLUSTER-E0D8F94D9065F24F; AWS_LAMBDA_FUNCTION-E0D8F94D9065F24F |
dt.smartscape_source.type | string | stable Display name: Smartscape source typeThe entity type of the entity whose identifier is held in dt.smartscape_source.id. | K8S_CLUSTER; AWS_LAMBDA_FUNCTION |
The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.
A detection finding generated by Dynatrace Runtime Application Protection, reporting a blocked SQL injection attempt against a Node.js process. Dynatrace resolves the targeted process to a Smartscape entity and adds dt.smartscape_source.* during ingest.
{"event.kind": "SECURITY_EVENT","event.type": "DETECTION_FINDING","event.provider": "OneAgent","product.vendor": "Dynatrace","product.name": "Runtime Application Protection","finding.id": "A-35VEHCHS","finding.title": "Blocked SQL injection attempt at Query.ErrorPacket() (Query.js:83:17)","finding.type": "SQL injection","finding.action": "denied","finding.time.created": "2026-07-14T18:07:39.274000000Z","dt.security.risk.level": "CRITICAL","object.id": "PROCESS-87234EE293F14F76","object.type": "PROCESS","object.name": "BloatedNodeJsSoftwareGroup-IG-1","dt.smartscape_source.id": "PROCESS-87234EE293F14F76","dt.smartscape_source.type": "PROCESS"}
A detection finding ingested from Akamai SIEM reporting a cross-site scripting attempt against a web endpoint, showing the finding metadata, the affected object (the targeted URL), and the normalized Dynatrace risk level.
{"event.kind": "SECURITY_EVENT","event.type": "DETECTION_FINDING","event.provider": "Akamai","product.vendor": "Akamai","product.name": "Akamai SIEM","finding.id": "1753176775716859162-86508-3000110-","finding.title": "Cross-site Scripting (XSS) Attack (SmartDetect)","finding.type": "Cross-site scripting","finding.action": "observed","finding.time.created": "2026-04-24T13:19:00.959138000Z","dt.security.risk.level": "MEDIUM","detection.analytic.name": "Cross-site Scripting (XSS) Attack (SmartDetect)","detection.analytic.type": "Rule","object.id": "atlas-int-01-channel-api.sampledomain.com:443/authz/v2/token","object.type": "URL","object.name": "atlas-int-01-channel-api.sampledomain.com:443/authz/v2/token"}
A native finding produced by the Automated Detections capability (a scheduled DQL detection). In addition to the finding metadata, it carries the native detection.* strategy, the detection.analytic.* classification, the scan.* correlation key, and—because the detection has findingEventIncludeExecutedQuery enabled—the per-finding drilldown query fields (finding.query.*, finding.drilldowns). Correlate with the corresponding detection scan event via scan.id.
{"event.kind": "SECURITY_EVENT","event.type": "DETECTION_FINDING","event.provider": "Dynatrace Automated Detections","product.vendor": "Dynatrace","product.name": "Automated Detections","finding.id": "A-4KQ2ZP1M","finding.title": "Brute force login attempts against admin on host prod-web-01","finding.type": "Brute force","finding.action": "observed","finding.time.created": "2026-07-14T18:07:39.274000000Z","dt.security.risk.level": "HIGH","detection.id": "5fd01409-c65b-4d93-8fc5-340259c288df","detection.name": "Brute Force Login Attempts","detection.description": "Detects repeated failed authentication attempts against a single user account from the same source IP within a short window.","detection.owner.id": "team-security-ops","detection.analytic.name": "Brute Force Login Attempts","detection.analytic.type": "Rule","detection.analytic.category": "DQL","detection.analytic.id": "5fd01409-c65b-4d93-8fc5-340259c288df","scan.id": "9f3c2e1a-4b7d-4a8e-bc6f-3d2e9a1f7c4b","scan.actor.id": "srv-threat-detection","finding.query.filter": "filter dt.smartscape_source.id == \"PROCESS_GROUP-E0D8F94D9065F24F\"","finding.query.compiled": "fetch logs | filter log.source == \"windows.security\" | filter dt.smartscape_source.id == \"PROCESS_GROUP-E0D8F94D9065F24F\"","finding.query.timeframe.start": "2026-07-14T18:02:00.000000000Z","finding.query.timeframe.end": "2026-07-14T18:07:00.000000000Z","finding.drilldowns": [{ "title": "Failed logins on affected host", "query": "fetch logs | filter log.source == \"windows.security\" | filter event.type == \"FAILED_LOGIN\" | filter dt.smartscape_source.id == \"PROCESS_GROUP-E0D8F94D9065F24F\"", "timeframe.start": "2026-07-14T18:02:00.000000000Z", "timeframe.end": "2026-07-14T18:07:00.000000000Z" },{ "title": "Source IPs by attempt count", "query": "fetch logs, from: now()-24h | filter log.source == \"windows.security\" | summarize attempts = count(), by: {source.ip} | sort attempts desc" }],"object.id": "PROCESS_GROUP-E0D8F94D9065F24F","object.type": "PROCESS_GROUP","object.name": "prod-web-01 auth service","dt.smartscape_source.id": "PROCESS_GROUP-E0D8F94D9065F24F","dt.smartscape_source.type": "PROCESS_GROUP"}