dt-sec-insights

# Security Insights Skill Query and analyze Dynatrace security data in `security.events` using DQL. Events come from **Dynatrace-native sources** (RVA, RAP, Automated Detections, SPM) or **external products** ingested via integrations (AWS Security Hub, Amazon GuardDuty, GitHub Advanced Security, Snyk, Qualys, Tenable, and more). ## What This Skill Covers - **Vulnerability management** — open CVEs on running code from DT-native RVA (risk-ranked with Dynatrace Security Score and the four-dimension runtime assessment: vulnerable-function-in-use, public network exposure, reachable data assets, public exploit available) plus external SCA / SAST / image scanners. - **Compliance posture** — DT-native KSPM (Kubernetes-only: CIS, DORA, NIST, STIG) plus CSPM/VSPM and external compliance/posture providers. - **Runtime attacks and threats** — DT-native detections (RAP runtime attacks, Automated Detections rules) plus external detection providers. - **Scan coverage analysis** — covered vs. not-covered k8s workloads/hosts/processes, by Dynatrace scanning feature (`Library Vulnerability Analytics`, `Operating System Vulnerability Analytics`, `Code-level Vulnerability Analytics`) or by external product. - **Entity enrichment** — map external findings to Dynatrace runtime entities (hosts, K8s workloads, cloud resources) via Smartscape. - **Dashboards / KPIs** — tiles, top-N tables, trend charts, coverage donuts. ## When to Use This Skill ✅ **Must-first routing rule:** ...