dt-sec-semantic-mapping

# dt-sec-semantic-mapping Build and validate semantic-dictionary-aligned mappings for new security integrations. ## Purpose Use this skill when a user wants to: - **Suggest** a mapping from vendor API output to Dynatrace `security.events` fields (Workflow A). - **Validate** an existing mapping for completeness and quality against: - Local baseline samples and semantic dictionary (Workflow B1 — static, offline validation), or - Live tenant data via live tenant access (Workflow B2 — runtime validation) - Highlight discrepancies vs. the Semantic Dictionary and local references. - Get actionable mapping improvements. ## Semantic Dictionary The Semantic Dictionary (SD) defines the canonical field set for `security.events`. See `references/semantic-dictionary.md` for the canonical reference: local-vs-live sources, queryable Grail tables, when-to-query decision matrix, and the authority rule (live SD wins on disagreement). ## Required Inputs Always run the intake checklist in `references/intake-and-output.md` before generating or validating a mapping. If inputs are incomplete, continue with a partial draft but explicitly list missing evidence and confidence limits. ## Baseline Sources (self-contained) All baseline material lives inside this skill: - `samples/` — real integration payloads covering all finding types and providers. Consulted as a fallback when primary references (SD, data-model-notes, known-discrepancies, validation-rules, object-type-expectations) leave...