dt-sec-contextualization
Resolve security signals, IoC matches, or Smartscape nodes to runtime Dynatrace entities and connect findings on different entity levels through a shared runtime entity. Covers identity-to-Smartscape mapping (incl. container-image digest/ID to workload), cross-level topology (K8s pod detection vs. node CVE via pod-to-node), per-entity risk summarization, and coverage match recipes shared by dt-sec-insights. Trigger: "map these findings to workloads/hosts", "which workload does this container image run as", "do these findings relate through the same runtime entity", "enrich this IoC match with entity context", "which threat report mentions this IoC". Queries security.events ONLY for THREAT_REPORT IoC enrichment (matched IoC to attributing reports); Do NOT use for broad security.events posture/overview (use dt-sec-insights), general DQL (use dt-dql-essentials), IoC hunting in logs/spans (use dt-sec-ioc-hunting), or K8s observability outside the security cross-level context (use dt-obs-kubernetes).
Install
With your agent
Install OMGSkills skill "dynatrace/dynatrace-for-ai:skills/dt-sec-contextualization" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/Dynatrace/dynatrace-for-ai /tmp/dynatrace-for-ai && ln -s /tmp/dynatrace-for-ai/skills/dt-sec-contextualization ~/.claude/skills/dt-sec-contextualizationFrom README
Security Contextualization Skill Resolve security signals and entity attribute sets to runtime Dynatrace Smartscape entities, summarize findings across entity levels, and connect signals that land on different levels (e.g. a detection on a K8SPOD vs. a CVE on a KUBERNETESNODE) via a shared runtime entity. What This Skill Covers Identity → Smartscape mapping — given a row carrying any of dt.smartscapesource.id, containerimage.digest, containerimage.id, host.ip, dt.entity., or k8s. fields, resolve it to a Smartscape entity at any requested level (CONTAINER / K8SPOD / workload / K8SNODE / HOST / cloud / GENAISERVICE — AI/GenAI workloads). Artifact → runtime bridge — containerimage.digest → smartscapeNodes CONTAINER → ispartof. → parent workload or runson.host → HOST. Works without pre-enriched dt.smartscapesource.id. Cross-level correlation — tiered entity matching to determine whether two findings (e.g. a detection and a CVE from different legs) relate through a shared runtime entity.
More from this repo
dt-obs-analytics
Used to analyze dashboards and notebooks using Davis analyzers — anomaly detection, novelty scoring, and correlation.
dt-obs-compliance-assistant
Used to monitor and investigate EU DORA compliance posture using Dynatrace Compliance Assistant.
dt-obs-ext-monitors
3rd-party test and monitor result ingestion into Dynatrace Grail via the platform events ingest API...