# dt-sec-insights

> Claude/Codex skill by [@dynatrace](https://omgskills.com/library/dynatrace/index.md) · 167 stars · Updated 2026-10-23

Query and analyze Dynatrace security data in security.events with DQL: vulnerabilities, threat detections, compliance posture, and scan coverage. Covers Dynatrace-native Runtime Vulnerability Analytics (RVA — CVEs, reachability, exposure, exploit), Runtime Application Protection (RAP), Automated Detections, and Security Posture Management (KSPM/CSPM), plus external security products and tools. Trigger: "open critical vulnerabilities", "vulnerable functions in use and publicly exposed", "top vulnerable libraries / K8s workloads", "CIS/DORA compliance pass rate", "SQL injection detections", "map external findings to workloads", "hosts not covered by scanning". Do NOT use for explaining existing DQL (use dt-dql-essentials), Davis problems (dt-obs-problems), logs (dt-obs-logs), distributed tracing (dt-obs-tracing), service RED metrics (dt-obs-services), or platform usage/audit telemetry (dt-platform).

Tags: agent-skills, ai-agents, claude-code, devops, dql, dynatrace, mcp, observability

## Install

```sh
git clone https://github.com/Dynatrace/dynatrace-for-ai /tmp/dynatrace-for-ai && ln -s /tmp/dynatrace-for-ai/skills/dt-sec-insights ~/.claude/skills/dt-sec-insights
```

## From README

Security Insights Skill Query and analyze Dynatrace security data in security.events using DQL. Events come from Dynatrace-native sources (RVA, RAP, Automated Detections, SPM) or external products ingested via integrations (AWS Security Hub, Amazon GuardDuty, GitHub Advanced Security, Snyk, Qualys, Tenable, and more). What This Skill Covers Vulnerability management — open CVEs on running code from DT-native RVA (risk-ranked with Dynatrace Security Score and the four-dimension runtime assessment: vulnerable-function-in-use, public network exposure, reachable data assets, public exploit available) plus external SCA / SAST / image scanners. Compliance posture — DT-native KSPM (Kubernetes-only: CIS, DORA, NIST, STIG) plus CSPM/VSPM and external compliance/posture providers. Runtime attacks and threats — DT-native detections (RAP runtime attacks, Automated Detections rules) plus external detection providers.

## Links

- HTML page: https://omgskills.com/library/dynatrace/dynatrace-for-ai/skills/dt-sec-insights/
- GitHub: https://github.com/Dynatrace/dynatrace-for-ai
- Author: [@dynatrace](https://omgskills.com/library/dynatrace/index.md)

## More from this repo

- [dt-obs-analytics](https://omgskills.com/library/dynatrace/dynatrace-for-ai/skills/dt-obs-analytics/index.md) — Used to analyze dashboards and notebooks using Davis analyzers — anomaly detection, novelty scoring, and correlation.
   - [@dynatrace](https://omgskills.com/library/dynatrace/index.md) · 167 stars
- [dt-obs-compliance-assistant](https://omgskills.com/library/dynatrace/dynatrace-for-ai/skills/dt-obs-compliance-assistant/index.md) — Used to monitor and investigate EU DORA compliance posture using Dynatrace Compliance Assistant.
   - [@dynatrace](https://omgskills.com/library/dynatrace/index.md) · 167 stars
- [dt-obs-ext-monitors](https://omgskills.com/library/dynatrace/dynatrace-for-ai/skills/dt-obs-ext-monitors/index.md) — 3rd-party test and monitor result ingestion into Dynatrace Grail via the platform events ingest API...
   - [@dynatrace](https://omgskills.com/library/dynatrace/index.md) · 167 stars