dt-sec-insights
Query and analyze Dynatrace security data in security.events with DQL: vulnerabilities, threat detections, compliance posture, and scan coverage. Covers Dynatrace-native Runtime Vulnerability Analytics (RVA — CVEs, reachability, exposure, exploit), Runtime Application Protection (RAP), Automated Detections, and Security Posture Management (KSPM/CSPM), plus external security products and tools. Trigger: "open critical vulnerabilities", "vulnerable functions in use and publicly exposed", "top vulnerable libraries / K8s workloads", "CIS/DORA compliance pass rate", "SQL injection detections", "map external findings to workloads", "hosts not covered by scanning". Do NOT use for explaining existing DQL (use dt-dql-essentials), Davis problems (dt-obs-problems), logs (dt-obs-logs), distributed tracing (dt-obs-tracing), service RED metrics (dt-obs-services), or platform usage/audit telemetry (dt-platform).
Install
With your agent
Install OMGSkills skill "dynatrace/dynatrace-for-ai:skills/dt-sec-insights" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/Dynatrace/dynatrace-for-ai /tmp/dynatrace-for-ai && ln -s /tmp/dynatrace-for-ai/skills/dt-sec-insights ~/.claude/skills/dt-sec-insightsFrom README
Security Insights Skill Query and analyze Dynatrace security data in security.events using DQL. Events come from Dynatrace-native sources (RVA, RAP, Automated Detections, SPM) or external products ingested via integrations (AWS Security Hub, Amazon GuardDuty, GitHub Advanced Security, Snyk, Qualys, Tenable, and more). What This Skill Covers Vulnerability management — open CVEs on running code from DT-native RVA (risk-ranked with Dynatrace Security Score and the four-dimension runtime assessment: vulnerable-function-in-use, public network exposure, reachable data assets, public exploit available) plus external SCA / SAST / image scanners. Compliance posture — DT-native KSPM (Kubernetes-only: CIS, DORA, NIST, STIG) plus CSPM/VSPM and external compliance/posture providers. Runtime attacks and threats — DT-native detections (RAP runtime attacks, Automated Detections rules) plus external detection providers.
More from this repo
dt-obs-analytics
Used to analyze dashboards and notebooks using Davis analyzers — anomaly detection, novelty scoring, and correlation.
dt-obs-compliance-assistant
Used to monitor and investigate EU DORA compliance posture using Dynatrace Compliance Assistant.
dt-obs-ext-monitors
3rd-party test and monitor result ingestion into Dynatrace Grail via the platform events ingest API...