Existing GitHub Advanced Security integrations

GitHub Advanced Security is a suite of security products that help you enhance the security of your code hosted in GitHub repositories. This includes products such as Dependabot, Code Security, and Secret Protection.

Dynatrace already integrates with GitHub Advanced Security to ingest security alerts and audit logs, which allows you to ingest, visualize, prioritize, and automate security alerts, helping to reduce noise and provide focused remediation to the issues that matter to your critical production environments. Having this available in Dynatrace breaks down the silos between DevSecOps teams, unifying security findings along the Software Development Lifecycle (SDLC) and enriching them with runtime context.

Why send runtime context to GitHub?

As covered in earlier blogs, platform-native Dynatrace® Apps and Workflows help you visualize and analyze GitHub Advanced Security findings as well as automate your responses. However, your developers and Application Security (AppSec) managers might still want the ability to manage these alerts in GitHub alongside their code and take advantage of features such as security campaigns, which allows them to fix security alerts at scale and better manage and reduce your security backlog.

The new runtime context feature in our GitHub Advanced Security integration allows you not only to report whether a specific artifact is deployed, but also to share the valuable Runtime Vulnerability Analytics (RVA) advanced assessments, such as public internet exposure and reachable data assets identified by Dynatrace. This additional context helps GitHub users to filter the security alerts and focus on remediation with runtime-aware prioritization criteria.

How the Dynatrace GitHub Advanced Security integration works

Dynatrace discovers and continuously monitors your running Kubernetes workloads. It maps running containers to your GitHub repositories and sends the runtime context (including public internet exposure and reachable data assets) to GitHub as deployment records linked to the artifacts.

Step 1: Discover workloads

The Dynatrace GitHub Advanced Security integration first discovers running container images that are monitored by Dynatrace using Dynatrace Query Language (DQL) queries against the Dynatrace Grail® data lakehouse. This enumerates all the unique images in your runtime environment. You can also use namespace filters to limit the scope of this discovery process.

Step 2: Match discovered images to GitHub repositories

Based on user access permissions to GitHub repositories, the integration will determine which container images from the runtime are associated with each repository.

Images can be mapped to GitHub repositories in one of two ways:

• Artifact attestations (recommended): If a step for attestation is included in your build workflows, it will link your built and deployed images to their respective repositories. Attestation also provides provenance and integrity guarantees for your built images. This is the ideal matching mechanism and works for images hosted in any
• Image naming schemes: In case you don’t have an attestation created, and you’re hosting your images in the GitHub Container Registry (io), Dynatrace will attempt to discover the appropriate repository by parsing the image name for a match with the visible and accessible repositories of the configured user.

Step 3: Send runtime context to GitHub

Once Dynatrace has a set of container images mapped to GitHub repositories, it sends this information, along with the runtime context, to GitHub as deployment records. This includes any appropriate “internet-exposed” and “sensitive-data” runtime risks that have been detected through RVA.

Step 4: Utilize context information in GitHub security campaigns and filters

Use this additional context when prioritizing Dependabot and code scanning alerts at the organization level and when creating security campaigns. You can create campaigns by filtering to see whether a given alert affects a repository with a reported deployment. Campaigns can be further prioritized by filtering for alerts where internet exposure or sensitive data access has been reported (for example, when an image interacts with a database).

The following quick demo video shows how Dynatrace shares the runtime context of a running container with GitHub, using the integration. In addition to the basic deployment information, Dynatrace sends the advanced assessments from Dynatrace Runtime Vulnerability Analytics capability, which allows then to fine tune the filtering on the GitHub side for security findings that have internet exposure or access to sensitive data assets.

What´s next

Discover the power of Dynatrace bi-directional integration with GitHub Advanced Security products to deliver ultimate code-to-runtime visibility across teams, from development to operations and DevSecOps.

Learn more from our previous blogs:

• Ingest and enrich GitHub Advanced Security vulnerability findings
• Hands-free vulnerability remediation with Dynatrace and GitHub

For full details of the prerequisites and steps for setting up the GHAS integration, please go to Ingest GitHub Advanced Security security events and audit logs in Dynatrace Documentation.

The post Prioritize GitHub Advanced Security alerts with runtime context from Dynatrace appeared first on Dynatrace news.

What is Qualys host scanning?

Qualys is a leading provider of vulnerability management solutions. Qualys Enterprise TruRisk platform offers a range of products, including Vulnerability Management, Detection, & Response (VMDR), which helps detect and prioritize vulnerabilities for remediation on hosts.

Host monitoring has been a best practice in security hygiene for decades and is required by various compliance standards. If your organization is already applying all the best practices for host scanning, you may still be wondering how to improve the prioritization of detected vulnerabilities.

Challenges in managing host vulnerabilities

Imagine you periodically run scans of hosts in your environments: production hosts, development hosts, etc. Each scan discovers hundreds or even thousands of vulnerabilities. Your goal is to minimize the risk by fixing the most critical vulnerabilities first.

Even with a simple strategy like this, your DevSecOps teams might still struggle to handle all the vulnerabilities. Your MTTR (Mean Time to Remediation) is increasing, and your management is not happy about it.

In addition, while focusing on critical vulnerabilities, are you sure you’re prioritizing the top risk for your organization? That approach is a good start; however, some top-risk vulnerabilities might not be critical in severity; they’re the ones that directly impact your critical production applications and services. Even if it is a high-severity vulnerability, you may want to address it before a critical vulnerability because it affects your production environment.

What can you do? Is there a way to further improve vulnerability prioritization?

The answer is yes; you need to consider additional runtime context and focus on production risk in addition to severity.

You may want to have a robust deduplication mechanism in place and visibility into the top risks. And you might also benefit from tracking the fixes and posture drifts, increasing security coverage, and reducing the number of risks over time.

Dynatrace as a runtime security platform

The Dynatrace platform offers native Runtime Vulnerability Analytics that detect vulnerabilities in your running applications and services, helping keep your application’s security risk low. This complements the host scanning and provides a complete picture of the security risks.

As an observability platform, Dynatrace also monitors the infrastructure on which your apps and services run. Hosts are one such infrastructure entity. Dynatrace knows whether a host is connected to the internet, how much traffic flows through it, whether production applications are running on that host, and how those applications are connected to other hosts and services in your organization.

With Dynatrace OpenPipeline® as the data ingest engine and Grail® as the unified data lakehouse, it is possible to ingest security findings from third-party products to bring security context to operational personas.

DevSecOps teams can simultaneously benefit from ingested and contextualized security findings using Dynatrace as a security platform, gaining ultimate visibility into all risks in one place, prioritizing based on production risks, and improving their security posture.

Qualys integration in work

Dynatrace integrates with Qualys to connect host vulnerability findings with runtime application context, allowing smarter vulnerability prioritization and better visibility into your security risks from the perspective of your runtime environment.

Here is how this integration works, and how it allows you to achieve your goals in several simple steps:

Step 1: Ingest and unify

Dynatrace delivers this integration as an extension that allows granular control over the data flow between Qualys and the Dynatrace platform.

Leveraging OpenPipeline, Qualys vulnerability findings and activity logs are pushed to Dynatrace and stored in Grail, where they’re mapped to semantic conventions that make them available in a unified schema for further analysis.

Step 2: Deduplicate and visualize

As soon as Qualys vulnerability findings are in Grail, you can view them in the Vulnerabilities app as individual findings or, using deduplication logic, as a focused list of unique findings. In this way, hundreds of findings reported repeatedly by each executed scan are deduplicated and become tens of vulnerabilities instead.

Here’s what it might look like before deduplication:

And here is what it looks like after applying the deduplication filter:

The Qualys integration also includes several ready-made dashboards that help you deduplicate and display vulnerability findings in a summarized view.

Step 3: Enrich and prioritize

The next step is to use the Dynatrace runtime context to further prioritize the vulnerabilities.

In this sample dashboard, which is also shipped with the integration, we first filter the ingested vulnerability findings for monitored hosts and then add the production application-level filter.

This filtering approach focuses on runtime impact and helps reduce the number of vulnerabilities to address.

Step 4: Communicate and remediate

With Dynatrace native automation capabilities represented in the Workflows app, you can operationalize the vulnerability findings by notifying relevant stakeholders and creating work tickets for remediation.

Step 5: Track improvement

Whether remediation is applied or new vulnerabilities are identified, you can easily monitor changes across scans to see which vulnerabilities are new, unresolved, or fixed.

Here is a dashboard we provide with the integration that helps achieve this goal:

Step 6: Increase security coverage

Finally, Dynatrace also helps you to understand whether you’ve covered all important hosts in your environment with vulnerability scans. This security observability is fueled by monitored host entities and Qualys ingested findings.

Here is a snippet from the security coverage dashboard shipped with the integration:

What’s next

The Dynatrace platform helps reduce noise from vulnerability scanning and provides runtime insights to efficiently prioritize remediation efforts.

Follow our updates and news about additional integrations and learn about which products from your security stack we already cover.

If you don’t find support for your product or tool, feel free to contact us in our Community channel.

Get started

To learn more about the Qualys integration and how to set it up, read our documentation for ingesting Qualys vulnerability findings, scanning events, and auditing logs.

The post Ingest, enrich, and deduplicate Qualys vulnerability findings with Dynatrace appeared first on Dynatrace news.

Recognize the unavoidable need for runtime security

No security strategy can guarantee absolute protection. Modern software complexity and dynamic threats mean some risks will evade detection (Figure 1). According to Dynatrace analysis, a significant portion of Fortune 500 companies remain vulnerable to known vulnerabilities, such as Spring4Shell.

Left-shifted tools often lack runtime context, making it hard to prioritize vulnerabilities by real-world impact. Runtime security bridges this gap by continuously monitoring production environments, detecting and mitigating threats in real time. This approach helps organizations adapt to emerging risks instead of relying on pre-deployment checks.

Dynatrace addresses this challenge by adding runtime context to left-shifted security findings, enabling environment-aware vulnerability prioritization. Dynatrace Application Security integrates seamlessly with third-party tools to ingest and enrich vulnerability data with runtime context. This context-rich prioritization reduces cognitive overload for teams across the SDLC.

The value of defense-in-depth in SDLC

A defense-in-depth approach layers multiple security controls across the SDLC to build resilient applications that can withstand sophisticated attacks. Rather than relying on a single security measure, defense-in-depth supports the strategy that if one layer misses a vulnerability, another will catch it.

This approach gains added relevance as modern development practices accelerate release cycles, often introducing new risks at every stage. By embedding security from the earliest phases of development through to production monitoring, teams can proactively identify, mitigate, and respond to threats before they escalate. Figure 2 illustrates this multi-layered approach, mapping out key capabilities across four critical SDLC phases: Development, Build, Deploy, and Observe (encompassing the commonly referred-to phases of runtime and monitoring).

Each phase contributes unique controls and processes to a strong overall security posture. This layered approach is essential for protecting sensitive data, maintaining customer trust and meeting regulatory requirements in an increasingly hostile cyber environment.

To understand how this works in practice, let’s look at an example of a cloud-native microservices application.

End-to-end scenario: How the Astronomy Shop application leverages runtime context

Consider  Astronomy Shop, an online retailer demo application built on containerized microservices such as frontend, product, cart, checkout, payment, order, and search — all deployed on Kubernetes. Astronomy Shop’s teams implement defense-in-depth across the SDLC phases to secure their application.

By leveraging runtime context, they validate and prioritize risks in production, ensuring that the most critical security issues are addressed first. Below is a walkthrough of how Astronomy Shop uses tools and Dynatrace capabilities throughout the SDLC to enhance security.

Effective security starts at the foundation: during development. This phase sets the tone for the entire security lifecycle.

Development phase: Build security from the ground up

Scenario: Developers commit code for services like product, cart, and checkout. Security scanning runs early, and threat modeling identifies sensitive paths (e.g., checkout and payment). Findings are triaged later using the runtime context to prioritize risks.

Sample tools:

• SonarQube for code quality and static application security testing (SAST), GitHub Advanced Security for dependency monitoring and software composition analysis (SCA).

The Dynatrace role:

• Ingests security findings from development tools via OpenPipeline’s security events ingest endpoint.
• Maps findings to the Semantic Dictionary in Grail™ for unified prioritization, analysis, and automation.
• Highlights critical and high alerts and deprioritizes non-executed code vulnerabilities while prioritizing medium issues exposed to sensitive data. This helps developers focus on vulnerabilities that pose real risks in production.

After development, the build phase is positioned to catch vulnerabilities before deployment.

Build phase: Strengthening security through automation and testing

Scenario: Astronomy Shop teams build and push container images to AWS ECR. Automated image scanning tools like AWS Inspector and Snyk Container assess vulnerabilities. Findings are enriched with runtime context to identify which issues truly impact production.

Sample tools:

• AWS Inspector for image scanning and Snyk for container scanning.
• Recommended approach: Artifact/container image scanning for OS and package vulnerabilities.

The Dynatrace role:

• Extends observability to the build phase for governance and security hygiene control.
• Adds runtime context to container scans, so developers know which vulnerabilities to prioritize. This simplifies decision making and reduces cognitive load.
• Automates security gates and workflows with tools like Site Reliability Guardian to ensure no critical vulnerabilities affect production.

And now, we move on to deployment, the critical moment when applications face real-world threats.

Deploy phase: Safeguard production with real-time oversight

Scenario: The Astronomy Shop team deploys services to Kubernetes using Helm or GitOps. Admission policies and baseline checks run, while cloud controls enforce guardrails and flag misconfigurations.

Sample tools:

• Kyverno for workload and cluster policies, AWS Security Hub for cloud security posture management (CSPM).

The Dynatrace role:

• Monitors deployment success and audits deployment operations by ingesting SDLC events.
• Enriches KSPM and cloud misconfiguration findings with runtime context to prioritize critical issues.
• Detects and addresses configuration issues with Dynatrace KSPM, ensuring continuous monitoring in Kubernetes and cloud environments.

Once deployed, applications should be actively monitored to detect and address emerging threats and potential signs of compromise.

Observe phase: Monitor production for threats

Scenario: The Astronomy Shop application is deployed to production and actively monitored. A new vulnerability is discovered in a library, and Dynatrace detects and locates the issue in real time. Malicious actors attempt to exploit the vulnerability, but the application remains secure due to proactive patching.

Sample tools:

• Dynatrace Runtime Application Protection (RAP), Runtime Vulnerability Analytics (RVA), Microsoft Defender for Cloud, Amazon GuardDuty, Microsoft Sentinel.

The Dynatrace role:

• Unifies third-party runtime detections and security signals into a single view for efficient processing.
• Provides deep runtime observability through OneAgent, extending visibility to process health, cloud, and infrastructure.
• Enables runtime security capabilities like RVA (Runtime Vulnerability Analytics), Security Posture Management (SPM), and Runtime Application Protection (RAP), serving as the final defense layer against threats.

Figure 3 highlights how Dynatrace integrates seamlessly across the SDLC, enhancing security with runtime context and enabling teams to prioritize and address the vulnerabilities that matter most.

Let’s examine practical scenarios where Dynatrace enhances left-shifted security findings with runtime context, enabling environment-aware prioritization.

Practical scenarios: Elevate security with runtime context

1. Prioritize SAST findings in code
   Static scanners often detect thousands of vulnerabilities, many of which are irrelevant in production. Runtime context enables teams to prioritize vulnerabilities based on actual risk. For instance, critical severity vulnerabilities in non-executed code could be deprioritized, while medium-severity vulnerabilities exposed to the internet and near sensitive data become high priorities.
2. Prioritize container scanner findings
   Container scans often flag numerous vulnerabilities. Runtime context helps determine whether these issues truly impact production. For example, a critical vulnerability in a library that is never executed in production can be deprioritized, while containers not deployed in production can be addressed later.
3. Prioritize KSPM findings on clusters
   Post-deployment, runtime context helps identify which security issues in workload cluster components or configurations impact production services. Critical vulnerabilities with no direct impact on production can be deprioritized, letting teams focus on what matters most.
4. Prioritize cloud alerts and compliance findings
   Continuous assessment of cloud environments and prioritization of misconfigurations with the application insights reduces the noise from cloud alerts and help to remediate the most important issues first.

Ready to strengthen your security in production?

Explore how Dynatrace can integrate seamlessly into your DevSecOps processes providing application-level insights to security findings across the SDLC for smarter prioritization.

The post Strengthen production security: Bridge SDLC best practices with runtime validation appeared first on Dynatrace news.

At Dynatrace, we believe you shouldn’t have to fix every cloud misconfiguration—rather, we believe you should focus on the ones that matter to your production environments. That’s why we’ve integrated Dynatrace with AWS Security Hub and Kiro CLI to streamline triaging and remediation of critical findings, focusing efforts where they count most.

The challenge in managing complex cloud environments

Modern cloud environments are complex with many moving parts and constant change. Whether initially misconfigured or affected by configuration drift, these environments pose a compliance issue and a significant security threat if exploited by malicious actors. Depending on the scale and composition of your environments, you may end up with thousands of misconfigurations that need to be addressed. Or do they?

AWS provides native services, such as AWS Security Hub, that help detect misconfigurations in your cloud environments. Such misconfigurations are often referred to as compliance findings. Many of the findings might not pose an immediate threat to production systems. AWS Security Hub’s latest capabilities, such as Exposure findings, already help a lot in distilling the most critical findings.

Is it possible to get additional validation of findings with deeper context into your production services and applications? That would help you understand which findings affect your crown jewels and prioritize their remediation over other issues.
And is it possible to automate this process, thereby reducing human intervention and the required deep understanding of the complex environments?

This is a modern dilemma for SREs and security teams: how to prioritize remediation without compromising operational integrity or wasting valuable resources on non-critical issues.

Context-aware remediation with Dynatrace and Kiro CLI

The Dynatrace® AI-powered observability platform monitors your applications and has all the runtime insights required to help organizations navigate through thousands of compliance findings and use the runtime context to prioritize them. Dynatrace’s Model Context Protocol (MCP) server exposes this deep runtime context to automation and agentic AI-driven workflows.

The Kiro CLI allows interaction with specialized AI agents and AWS native capabilities using MCP servers. It serves as the SRE assistant, possessing knowledge of all connected products and the ability to remediate issues.

To further streamline and connect the dots, Dynatrace integrates with AWS Security Hub, supporting the latest OCSF (Open Cybersecurity Schema Format). This allows SREs to fine-tune the triaging and enrichment to their particular needs, leveraging Dynatrace Workflows as the automation engine.

In the next section, we present a use case with two scenarios that demonstrate how detection, triage, and remediation of cloud misconfiguration were made more efficient using Dynatrace and the latest AWS advances in automation and AI domains.

Intelligent triage in action

This use case starts with compliance findings, detected by AWS Security Hub. In the first scenario, an SRE retrieves critical findings using the Kiro CLI and verifies them with Dynatrace using the Dynatrace remote MCP server, which is connected to a dedicated Kiro custom agent.

In the second scenario, the initial validation is automated with Dynatrace Workflows and supported by the AWS Security Hub integration. The validated findings are then sent to a Jira ticket, which can be picked up later by the SRE directly from the Kiro CLI.

By combining Dynatrace deep observability with Kiro CLI intelligent automation, teams gain the ability to triage findings based on actual runtime impact. Instead of treating every misconfiguration as equally urgent, this solution helps prioritize those misconfigurations that pose real risks to business-critical applications. This not only reduces alert fatigue but also ensures that remediation efforts are focused, efficient, and aligned with operational priorities.

The result? A streamlined security posture that’s proactive rather than reactive. Teams can move faster, reduce manual overhead, and maintain a higher level of confidence in their cloud infrastructure while keeping production safe and stable.

Scenario 1: Kiro CLI-driven validation with Dynatrace MCP

In this scenario, an SRE interacts with Kiro CLI to perform validation and remediation actions with the help of Dynatrace MCP.

1. Detection: AWS Security Hub identifies cloud misconfigurations.
2. Verification
   • An SRE interacts with the Kiro CLI to extract top findings.
   • The Dynatrace agent, invoked by the Kiro CLI, utilizes the Dynatrace MCP server to verify whether these findings impact production applications.
3. Remediation
   • SRE remediates confirmed findings via Kiro CLI; others are suppressed.
   • Findings are resolved and verified in AWS Security Hub.

Scenario 2: Dynatrace-driven automated triaging and Kiro CLI remediation

In this scenario, initial validation and triage are automated in Dynatrace Workflows, and the SRE then acts on the Jira tickets to perform assisted remediation using the Kiro CLI.

1. Detection: AWS Security Hub identifies cloud misconfigurations.
2. Verification
   • AWS Security Hub integration ingests findings into Dynatrace.
   • A Dynatrace workflow analyzes new critical/high-risk findings and performs the automated verification using the Davis CoPilot® workflow action.
3. Remediation:
   • A Jira ticket is created automatically with the summary of the verification results.
   • An SRE uses Kiro CLI to act on the Jira findings. Confirmed findings are remediated, while the unconfirmed findings can be suppressed.
   • Findings are resolved in AWS Security Hub and are no longer in the top findings dashboard in Dynatrace.

What’s next

As AI footprint growth and capabilities evolve, the collaboration between AWS and Dynatrace will extend to additional use cases for agentic AI workflows and observability-context-supported issue remediation. One such example is covered in this recent blog post.

In this blog post, we demonstrated how the Dynatrace remote MCP server can be integrated with Kiro CLI for SRE use cases. Stay tuned as the collaboration extends to additional use cases that help development teams remediate vulnerabilities and performance issues directly from their IDEs.

Get started

To get started, learn more about Dynatrace MCP and sign up for the preview to experience how real-time production context makes your organization more efficient.

For details on how to set this up, refer to Dynatrace documentation.

The post Smarter cloud security with Dynatrace and Kiro CLI appeared first on Dynatrace news.

DevSecOps teams often operate with fragmented tools and data, as code and dependencies are analyzed during coding and at build time, while runtime risks typically surface later in production. Without a unified, contextualized view, teams face alert fatigue and misaligned priorities, focusing on issues that might not impact customer-facing services while potentially overlooking those that do.

SonarQube provides in-depth, integrated code quality and security analysis within CI pipelines across a wide range of programming languages, which is essential for early detection of code issues and vulnerabilities. With its in-depth analysis of code issues and tight integration with development tools, SonarQube provides all the necessary information for addressing and remedying discovered issues.

Nevertheless, should dev teams fix all discovered issues? How can they determine which vulnerabilities to prioritize? Additional context is required to prioritize remediation efforts intelligently and efficiently.

Dynatrace puts your security and quality findings into context

Dynatrace provides deep insights into application runtime, offering a detailed view of application performance and the runtime impact of potential issues.

The Dynatrace integration with SonarQube Cloud and SonarQube Server unifies and contextualizes security and quality findings across the SDLC. Ingested findings can be uniformly prioritized across tools and environments. Remediation efforts are automatically orchestrated to notify relevant stakeholders and trigger remediation processes. Additionally, during processing, findings can be mapped to monitored runtime entities to evaluate their impact on production environments.

Dynatrace delivers SonarQube integration as an extension that allows granular control over the data flow between SonarQube and the Dynatrace® platform.

SonarQube security and quality findings, alongside the audit logs, are ingested via OpenPipeline®, transformed into a unified Dynatrace semantic dictionary data format, and stored in Dynatrace Grail®. From there, teams can leverage Dynatrace-native applications, such as Dashboards, Notebooks, Site Reliability Guardian, Workflows, and Security Investigator, to visualize, process, and automate remediation of the issues with precision—reducing noise and focusing on vulnerabilities that truly impact running applications.

Users can use ready-made dashboards delivered with the integration to visualize and analyze the findings.

What’s next

We’ll continue to streamline the operationalization of third-party findings, such as those from SonarQube, across native Dynatrace® Apps. Our goal is to surface externally ingested findings more broadly so teams can triage and remediate them from a single platform.

Get started today

Visit our documentation for security events ingestion to explore the full range of Dynatrace platform integrations with various DevSecOps security products.

For full details on the prerequisites and steps for setting up the SonarQube integration, please refer to Ingest SonarQube security and quality events, metrics, and audit logs.

The post Ingest and enrich SonarQube security and quality findings with Dynatrace appeared first on Dynatrace news.

The value of automation and agentic AI

The Dynatrace® AI-powered observability and security platform, with its remote Model Context Protocol (MCP) server, revolutionizes this process by integrating observability context into automation and agentic AI-driven workflows. By connecting Dynatrace with GitHub Copilot coding agent, organizations can achieve prioritized and automated vulnerability remediation that not only streamlines security but also maintains system performance and developer efficiency.

Both developers and site reliability engineers (SREs) benefit from this agentic AI collaboration, bringing actionable runtime insights from Dynatrace directly into GitHub and efficiently automating vulnerability remediation.

Automated security remediation with smart runtime verification use case

GitHub Dependabot proactively alerts developers when known vulnerabilities are detected in their projects’ dependencies, helping teams stay secure and compliant. As organizations and projects scale, prioritizing and addressing the alerts becomes a challenge: deciding which vulnerabilities matter most in a given context and streamlining the path to remediation.

Let’s dig deeper into two different scenarios, where Dynatrace can help to improve remediation by automating developer tasks and prioritizing work based on impact.

To optimize remediation efforts and minimize release delays, it’s essential to prioritize vulnerabilities based on their actual impact on production applications.

Dynatrace providing context for automating the remediation of GitHub Dependabot alerts

In a typical environment, when streamlining vulnerability remediation, you might utilize GitHub Actions workflows to regularly poll Dependabot. Once a new alert is detected, the workflow creates a new issue and assigns it to the GitHub Copilot coding agent.

To fully understand the problem and its impact, GitHub Copilot coding agent queries Dynatrace—using the remote MCP server—to get additional runtime data. Dynatrace confirms that the vulnerable library is loaded, and that its own Runtime Vulnerability Analytics (RVA) identifies the same issue and verifies the impact by highlighting if the vulnerable function is used in live environments and if it’s exploitable.

Equipped with the additional context, the coding agent generates a code-level fix. To remediate and prevent insecure code, the fix is added as a pull request to the GitHub repository, awaiting developer review to ensure human oversight.

Once the change is approved and the fix deployed, Dynatrace continuously monitors the environment, verifying the remediation and ensuring the issue is resolved without introducing new problems.

Automate and orchestrate security findings from GitHub Dependabot with Dynatrace Workflows

Unifying and contextualizing vulnerability findings across different tools helps apply prioritization and centralize automation for real-time runtime validation and fix deployment, supporting SREs to minimize potential disruptions to their services.

With the Dynatrace integration for GitHub Advanced Security, you can continuously forward GitHub Dependabot alerts to Dynatrace. Once ingested, Dynatrace uses its capabilities for further analysis, including an RVA verification that provides a contextual understanding of the potential impact on the monitored environment.

The workflow creates a new GitHub issue, including a comprehensive summary of alerts with their confirmation status.

GitHub Copilot Coding Agent automatically picks up the issue and submits the proposed fix for verified alerts as a pull request for a developer to review. This ensures the remediation process remains transparent and allows for human oversight before deployment. Once the pull request is approved and merged, the alert is remediated and the code is secured.

Automated end-to-end security remediation

These two scenarios exemplify how organizations can shift from reactive to proactive security management, automating repetitive tasks and providing actionable insights for developers.

The relationship between Dynatrace and GitHub demonstrates the power of agentic AI in modern software development, where runtime data drives decision-making and empowers coding agents to apply fixes to code environments—all in a standardized way, applying enterprise guardrails.

Reduce your mean time to resolution (MTTR), enhance developer productivity, and ensure robust system security by automating security remediation—all without sacrificing performance or uptime.

The benefits of the coding agent are further amplified with the GitHub announcement of introducing custom agents. Dynatrace has just launched its first custom agent, which seamlessly integrates Dynatrace’s observability and security capabilities into GitHub Copilot, empowering teams to maintain operational excellence, ensure application reliability, and uphold security compliance across the entire software development lifecycle (SDLC).

This allows teams to streamline incident response, perform root cause analysis, validate deployments, triage production errors, and many more use cases—all directly within their GitHub repository workflows.

By delivering real-time insights and actionable data from production environments, Dynatrace extends GitHub’s reach into production, effectively closing the SDLC. Stay tuned for our upcoming blog, where we’ll dive deeper into the powerful capabilities of Dynatrace’s custom agent for GitHub Copilot.

Ready to transform your security workflows?

Explore how Dynatrace can integrate seamlessly into your development landscape using our remote MCP Server and read through our walkthrough documentation.

Sign up for the preview and experience how real-time production context makes your organization more efficient.

The post Hands-free vulnerability remediation with Dynatrace and GitHub Copilot appeared first on Dynatrace news.

Dynatrace integrates with Microsoft Sentinel to unify, visualize, and automate security findings across tools and environments. By adding Dynatrace runtime context to security findings, teams can take advantage of smarter prioritization, reduce alert noise, and focus DevSecOps efforts on efficiently remediating critical issues that affect production environments and applications.  

Tackling the challenges of a siloed approach

Each organization has many stakeholders responsible for developing, building, delivering, monitoring, and securing its critical assets. Depending on the organizational structure, these stakeholders can be part of a myriad of siloed teams—for example, development, operations, and security. In many cases, each team uses different tools to observe, monitor, and detect issues in the development artifacts and runtime resources for which they are responsible.

Without proper communication, maintaining healthy applications and services becomes increasingly difficult.

• Security teams need operations and developers to address the security threats they observe.
• Operations teams want to ensure that deployed artifacts go through proper testing and validation in the development phase.
• Developers need help prioritizing issues they need to fix based on security and runtime insights.

Even if teams must operate in silos, the information they need must be shared across the organization, as all relevant stakeholders need the full context to be efficient in their tasks.

There is no single platform that can provide all those insights in a single place. Nevertheless, various products and tools can share data and interoperate with each other to ensure the necessary information is available to the stakeholders who need it.

Unifying security and observability with Microsoft Sentinel and Dynatrace

That’s where the power of Microsoft Sentinel and Dynatrace can help. Microsoft Sentinel is a modern, cloud native security information and event management (SIEM) platform, helping SecOps teams to store, analyze, process, detect, and react to security threats. It can unify data from various sources, creating alerts and managing incidents. Additionally, Sentinel is natively integrated with Microsoft security solutions, such as Microsoft Defender for Cloud, and extendible with plenty of third-party data connections to ingest alerts and logs.

Dynatrace is an AI-powered unified observability and security platform that helps teams maintain the health of applications and services delivered by their organizations by detecting performance and security problems in applications. Powered by Davis® AI, the platform automatically analyzes and identifies the root causes of issues, guiding you through the remediation process and providing full contextualized observability and security data.

Dynatrace integrates bi-directionally with Microsoft Sentinel to support different stakeholders with the context they need in the products and tools they use.

Dynatrace data connectors in Microsoft Sentinel bring the required observability and security data to SecOps teams. For more details on the integration, check out this blog post.

The new Microsoft Sentinel ingestion integration with Dynatrace brings security alerts reported in Sentinel to SRE and operations teams. The ingested findings are contextualized and connected to monitored Dynatrace entities to provide an enriched experience while investigating potential problems in applications.

How the integration works

The Dynatrace integration with Microsoft Sentinel leverages Azure Event Hubs to continuously export security alerts from Sentinel. Azure Functions pick up and process the exported alerts, which are then sent to a dedicated Dynatrace OpenPipeline^® security events ingest endpoint.

In Dynatrace, alerts are mapped to Dynatrace semantic conventions and stored in the Dynatrace Grail^® data lakehouse, allowing teams to uniformly access and analyze ingested data.

Dynatrace Dashboards, Notebooks, Threats and Exploits, and Security Investigator apps help visualize, analyze, and investigate the ingested security findings.

With Workflows, teams can then automate the triaging of similar security findings in the future, create working tickets for DevSecOps teams, and send notifications to the relevant stakeholders.

This integration provides a couple of ready-made dashboards to help you get started with the data analysis, as well as a sample workflow template to make it easier to automate remediation actions.

Data ingest setup and monitoring is simplified with guided onboarding instructions provided by the integration and a dedicated monitoring view.

Take the next step with Dynatrace and Microsoft Sentinel

Dynatrace continues to enhance the contextualization of ingested data, driving deeper insights and more intuitive exploration. As integration capabilities evolve, security alerts will become even more deeply embedded in the monitored entity experience—empowering teams to act faster and with greater confidence.

Discover how to ingest Microsoft Sentinel security events, and explore security use cases for insight into how Dynatrace helps teams operationalize security findings. And stay tuned for more announcements in the Application Security domain.

The post Ingest and enrich Microsoft Sentinel security alerts with Dynatrace appeared first on Dynatrace news.

Dynatrace integrates with GitHub Advanced Security (GHAS) to break down the silos between DevSecOps teams, unifying security findings along the Software Development Lifecycle (SDLC) and enriching them with runtime context. Dynatrace allows you to ingest, visualize, prioritize, and automate security findings, helping to reduce noise from alerts and provide focused remediation to the issues that matter to your critical production environments.

Manage vulnerabilities throughout the SDLC

As a DevSecOps best practice, application artifacts must be scanned and assessed for vulnerabilities in each relevant stage of the Software Development Lifecycle. This includes detecting vulnerabilities in your code repository early in the lifecycle of your code artifacts, vulnerabilities in your build artifacts, such as build manifests and container images, and potential vulnerabilities in your pre-production runtime environment prior to deployment to production.

GitHub is a developer platform that helps Dev teams to develop, maintain, build, and distribute their artifacts, from coding time to runtime. With a dedicated set of security capabilities delivered by GitHub Advanced Security products, developers can keep pace with security validation at each stage of the SDLC without slowing down.

Nevertheless, the number of vulnerability findings detected can be overwhelming, and prioritizing them can be tricky. This increases the risk of critical vulnerabilities slipping through the cracks between pipeline stages and exposing your production services and applications to exploitation by hackers.

This is where runtime context can help by filtering for the most important vulnerabilities and focusing your remediation efforts on the vulnerabilities that have a direct impact on your production services.

Add runtime context with Dynatrace

The Dynatrace® AI-powered observability platform monitors your applications and has all the runtime insights required to help organizations navigate through hundreds and thousands of vulnerability findings and use the runtime context to prioritize them.

Various code/build time artifacts, such as source code and container images, can be mapped to the runtime entities they affect, for example, running containers or processes. As soon as the mapping is established, you get immediate insight into how a specific vulnerability detected in a dev artifact affects your runtime environment. The observability data collected and monitored by Dynatrace on the runtime entities provides additional insights for prioritization, such as internet exposure, relationships to other services, and even ownership information.

Having the power of observability data allows SREs who are responsible for production services and applications to gain insight into the security hygiene of the DevSecOps processes and effectively communicate to the DevSecOps teams the top vulnerabilities that need to be addressed with the highest priority.

Moreover, by integrating Dynatrace into your CI/CD pipeline prior to the promotion of new services and applications to production, SREs can define security gates that prevent critical vulnerabilities from being deployed in the first place.

Integrate with GitHub Advanced Security

Dynatrace delivers GHAS integration as an extension that allows granular control over the data flow between GitHub and the Dynatrace platform. In the first version, the integration periodically fetches Dependabot alerts and audit logs from GitHub and stores them in the Dynatrace Grail data lakehouse for later analysis, visualization, and automation use cases.

Platform-native Dynatrace® Apps, such as Dashboards and Notebooks, help you visualize and analyze your security findings. Workflows, meanwhile, help you automate your response—efficiently triaging the findings, creating tickets for DevSecOps teams, and notifying the relevant stakeholders.

Dynatrace also provides several ready-made dashboards as part of the extension to serve as a starting point for security findings analysis and visualization.

• The Vulnerability findings dashboard provides an overview of vulnerability findings across various products, allowing you to centrally and uniformly prioritize them.
• The Security product coverage dashboard provides an overview of your security product coverage across various scanned artifacts to help identify coverage gaps.

What’s next

The Dynatrace integration with GitHub Advanced Security will evolve to ingest additional types of vulnerability findings beyond Dependabot alerts to extend visibility to all the security insights provided by GHAS products.

Get started

Visit our documentation pages for security events ingest to explore the full range of Dynatrace platform integrations with various DevSecOps security products.

For full details of the prerequisites and steps for setting up the GHAS integration, please go to Ingest GitHub Advanced Security security events and audit logs in Dynatrace Documentation.

The post Ingest and enrich GitHub Advanced Security vulnerability findings with Dynatrace appeared first on Dynatrace news.

Observability context is critical to prioritizing Amazon GuardDuty findings

Security remains top of mind for enterprises as the tech landscape continues to evolve, making threat detection and monitoring one of the most critical aspects of an organization’s IT strategy. Amazon GuardDuty is a threat detection service that continuously monitors an organization’s AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.

Amazon GuardDuty monitors and analyzes events and logs from various AWS services, spanning the entire cloud infrastructure, including running containers in an AWS environment.

However, teams operating in multicloud environments need more than traditional monitoring can provide. To effectively address security issues, teams need a unified monitoring platform to prioritize and efficiently respond to various threats.

Moreover, findings can come from various types of environments, including development, testing, and production. This increases the number of findings to prioritize, increasing the amount of noise, along with the probability of missing critical issues.

Additional runtime and organizational context are required to efficiently filter out the less important findings and focus on the critical issues that directly affect sensitive services and applications.

Reduce alert noise and prioritize critical issues with runtime context

The Dynatrace AI-powered observability platform integrates with Amazon GuardDuty to bring its valuable security findings into the Dynatrace Grail® data lakehouse.

Leveraging OpenPipeline®, the integration processes and maps security findings to a unified data format, making it uniformly accessible for analysis across tools and cloud environments.

Platform-native Dynatrace® Apps, such as Dashboards, Notebooks, and Security Investigator, help you visualize and analyze your security findings. The Workflows app, meanwhile, helps you automate your response—efficiently triaging the findings, creating tickets for DevSecOps teams, and notifying the relevant stakeholders without manual intervention that could slow down the distribution process and tie down your resources.

The Threats and Exploits app serves as your starting point for consuming the ingested findings and as a guide for exploring the potential impact of each detection.

Additionally, Dynatrace allows teams to contextualize ingested security findings with the additional runtime context. This context helps to better filter incoming findings and further reduce the number of alerts handled by various security teams. This way, teams stay focused on the issues that really matter to your critical services and applications.

Breaking down the Amazon GuardDuty and Dynatrace integration

The Amazon GuardDuty integration leverages Amazon EventBridge and AWS Lambda as the transit points for forwarding the various security findings to Dynatrace. The ingested events are processed in OpenPipeline, mapped to Dynatrace semantic conventions, and stored in Grail in a unified security event data model.

The integration provides easy-to-follow steps for setting up the integration and monitoring capabilities to ensure the integration runs properly.

Teams can easily access the ingested security findings using various platform-native apps that help them accomplish various use cases.

Dynatrace also provides several ready-made artifacts as part of the application to serve as a starting point for analysis and automation, including the following:

• Sample dashboards visualize your security findings and assess monitoring coverage.
• Sample workflows automate the orchestration of critical findings by creating notifications and tickets.

Take the next step with Dynatrace and Amazon GuardDuty

With Dynatrace AI-powered observability context added to Amazon GuardDuty findings, SRE and security teams can now filter out noisy alerts and focus their efforts on the most impactful critical issues.

As the Amazon GuardDuty integration evolves, it will provide additional context that’s mapped and easily accessible in Dynatrace Query Language and available in the Threats and Exploits app.

For more information about how to ingest Amazon GuardDuty security findings, check out our documentation.

The post Ingest and enrich Amazon GuardDuty security findings with Dynatrace appeared first on Dynatrace news.

Modern organizations are often overwhelmed by security alerts, making it nearly impossible for them to determine what to prioritize and how to identify an issue’s root cause. That’s why the Dynatrace® AI-powered observability platform integrates with Microsoft Defender for Cloud to centralize security findings from across an organization’s tools and environments.

This unified view allows automated workflows and clearer visualization of security issues. Dynatrace enriches security findings with application runtime context, helping DevSecOps teams cut through alert noise and focus on fixing the issues that actually affect production.

Prioritize and focus on critical security findings

Microsoft Defender for Cloud is a cloud native application protection platform (CNAPP) that includes security measures and practices designed to protect cloud-based applications from various cyber threats and vulnerabilities.

It offers multiple security capabilities, including container image scanning, workload protection, and posture management. While Microsoft Defender for Cloud integrates with other cloud platforms, its focus and expertise remain within the Microsoft ecosystem.

Analyzing security findings in a multicloud environment poses a core challenge: how to gain a centralized view and prioritize findings from numerous tools and across different cloud platforms. This complexity is amplified in environments with mixed findings from development, testing, and production, increasing the risk of critical issues being overlooked.

To overcome this, organizations need more than just a centralized platform for security findings; runtime context is essential to identifying and focusing on critical issues affecting sensitive services and applications.

Add runtime context to Microsoft Defender for Cloud findings

The future of multicloud security lies in context-driven protection that automatically correlates findings across cloud platforms while applying runtime intelligence to prioritize threats based on actual business impact. The question isn’t whether to consolidate security operations; it’s how quickly organizations can transform fragmented alerts into actionable intelligence before threats move seamlessly across their hybrid infrastructure.

The Dynatrace AI-powered observability platform integrates with Microsoft Defender for Cloud, ingesting critical security findings—including vulnerability detections and security alerts—into the Dynatrace Grail® data lakehouse. This integration leverages OpenPipeline® to process and map these diverse security findings into a unified data format, thereby enabling consistent analysis across all tools and cloud environments.

Once in Dynatrace, platform-native applications like Dashboards, Notebooks, and Security Investigator provide powerful visualization and analysis capabilities. Furthermore, the Workflows app automates the triaging of findings, streamlines ticket creation for DevSecOps teams, and ensures timely stakeholder notifications.

Crucially, Dynatrace enhances these capabilities by allowing teams to enrich security findings with runtime context. This additional layer of context is instrumental in refining filters for incoming findings, which dramatically reduces the noise for security teams. Ultimately, this empowers them to concentrate their efforts on the issues that pose a genuine threat to their critical services and applications.

How the integration works

The Microsoft Defender for Cloud integration leverages Azure Event Hubs and Azure Functions as transit points for forwarding the various security findings to Dynatrace. The ingested events are processed in OpenPipeline, mapped to Dynatrace semantic conventions, and stored in Grail in a unified security event data model.

Integrating Dynatrace with Microsoft Defender for Cloud is easy, with step-by-step directions. You even get in-depth monitoring capabilities to ensure the integration runs properly.

Once the integration is set up and running, teams can easily access security findings using various Dynatrace platform-native apps, such as Dashboards, Notebooks, Security Investigator, Workflows, and more.

Additionally, Dynatrace provides several ready-made artifacts to serve as your analysis and automation starting point:

• Access sample dashboards to visualize security findings and assess the coverage.
• Use sample workflows to automate the orchestration of critical findings by creating notifications and tickets.

Take Microsoft Defender for Cloud findings to the next level with Dynatrace

The Microsoft Defender for Cloud integration represents a significant step forward in unifying security and observability data on the Dynatrace platform. As this integration continues to evolve, expanding support for vulnerability detection and compliance findings, you’ll gain unprecedented visibility into your security posture alongside metrics for application performance.

By ingesting and enriching Microsoft Defender data within Dynatrace, alongside many other security data ingests, teams can break down traditional silos between security and operations, enabling faster incident response and more informed decision-making. The centralized view of both security events and performance data creates opportunities for correlation that were previously difficult to achieve using disparate toolsets.

For detailed setup instructions, read how to Ingest Microsoft Defender for Cloud security events.

The post Ingest and enrich Microsoft Defender for Cloud findings with Dynatrace appeared first on Dynatrace news.

Dynatrace® now integrates with VirusTotal to provide threat intelligence context for observables, helping your organization combat online threats such as cyberattacks, spamming, and other malicious activities.

In today’s continuously evolving threat landscape, enterprises face hundreds of suspicious activities coming from potentially malicious actors. Various security tools are capable of identifying suspicious activity and reporting it. However, Security Operations (SOC) and Incident Detection and Response (IDR) teams are often overwhelmed by the number of alerts and detections generated by these tools.

How can you distinguish between yet another false positive and a real threat? And how can you know that your organization’s response will be as fast as possible?

Threat intelligence information provides a strong indication of the maliciousness of detected activities based on industry reports. Whether it’s a random malicious act that affects some organizations or a comprehensive threat-actor activity that jeopardizes the whole industry, threat intelligence provides the additional context your teams need to decide how much attention to give to a certain alert.

Uplevel your security investigations with Dynatrace

The Dynatrace® platform integrates with various security detection tools and offers runtime context to better filter incoming alerts and focus only on those that impact your sensitive services and applications, which draws your organization’s internal prioritization considerations towards important alerts.

An additional element for reducing alert noise and achieving better prioritization of security alerts is threat intelligence context. Such context represents the external factors that must be taken into consideration during triaging.

Dynatrace integrates with VirusTotal and offers threat intelligence enrichment for observables, such as IP addresses. With provided threat context, such as IP reputation, your security  teams can perform:

• Threat-informed security investigations: Enhance your security investigations by leveraging IP reputation data to detect anomalous and malicious activity in Security Investigator.
• Automated threat-alert triaging: Classify and prioritize alerts using enriched threat intelligence in Workflows.

Easy VirusTotal integration via Dynatrace Apps

The VirusTotal integration is delivered as a Dynatrace app that can be installed in-product using the Dynatrace Hub.

As soon as the integration is installed, you can start using the threat intelligence enrichment capabilities in Workflows using the dedicated workflow action. It’s possible to configure multiple connections to VirusTotal and use your preferred connection for each workflow action.

Dynatrace also provides you with a sample workflow, which demonstrates an end-to-end automated threat-alert triaging use case. This sample workflow processes new critical detection findings and, based on the reputation of the involved IP addresses, decides whether to notify relevant stakeholders.

What’s next

The VirusTotal threat intelligence enrichment capabilities are not limited to workflow use cases. We’re working on enabling other Dynatrace® Apps, such as Security Investigator and Threat and Exploits, to natively support the VirusTotal integration and provide the additional context as part of each user journey.

Get started

For full details of the prerequisites and steps for setting up the VirusTotal integration, please visit our documentation, Enrich threat observables with VirusTotal.

The post Enrich observables with VirusTotal threat intelligence appeared first on Dynatrace news.

Dynatrace® now integrates with AbuseIPDB to provide threat intelligence context for observables, helping your organization combat online threats, such as cyberattacks, spamming, and other malicious activities.

In today’s continuously evolving threat landscape, enterprises face hundreds of suspicious activities coming from potentially malicious actors. Various security tools are capable of identifying suspicious activity and reporting it. However, Security Operations (SOC) and Incident Detection and Response (IDR) teams are often overwhelmed by the number of alerts and detections generated by these tools.

How can you distinguish between yet another false positive and a real threat? And how can you know that your organization’s response will be as fast as possible?

Threat intelligence context provides a strong indication of the maliciousness of detected activities based on industry reports. Whether it’s a random malicious act that affects some organizations or a comprehensive threat-actor activity that jeopardizes the whole industry, threat intelligence provides the additional context your teams need to decide how much attention to give to a certain alert.

Uplevel your security investigations with Dynatrace

The Dynatrace® platform integrates with various security detection tools and offers runtime context to better filter incoming alerts and focus only on those that impact your sensitive services and applications, which draws your organization’s internal prioritization considerations towards important alerts.

An additional element for reducing alert noise and achieving better prioritization of security alerts is threat intelligence context. Such context represents the external factors that must be taken into consideration during triaging.

Dynatrace integrates with AbuseIPDB and offers threat intelligence enrichment for observables, such as IP addresses. With the provided threat context, such as IP reputation, your security teams can perform:

• Threat-informed security investigations: Enhance your security investigations by leveraging IP reputation data to detect anomalous and malicious activity in Security Investigator.
• Automated threat-alert triaging: Classify and prioritize alerts using enriched threat intelligence in Workflows.

Easy AbuseIPDB integration via Dynatrace Apps

The AbuseIPDB integration is delivered as a Dynatrace app that can be installed in-product using the Dynatrace Hub.

As soon as the integration is installed, you can start using the threat intelligence enrichment capabilities in Workflows using the dedicated workflow action. It’s possible to configure multiple connections to AbuseIPDB and use your preferred connection for each workflow action.

Dynatrace also provides you with a sample workflow, which demonstrates an end-to-end
automated threat-alert triaging use case. This sample workflow processes new critical detection findings and, based on the reputation of the involved IP addresses, decides whether to notify relevant stakeholders.

What’s next

The AbuseIPDB threat intelligence enrichment capabilities are not limited to workflow use cases. We’re working on enabling other Dynatrace® Apps, such as Security Investigator and Threat and Exploits, to natively support the AbuseIPDB integration and provide the additional context as part of each user journey.

Get started

For full details of the prerequisites and steps for setting up the AbuseIPDB integration, please visit our documentation, Enrich threat observables with AbuseIPDB.

The post Enrich observables with AbuseIPDB threat intelligence appeared first on Dynatrace news.

Dynatrace integrates with Snyk to break the silos between DevSecOps teams by unifying security findings along the Software Development Lifecycle (SDLC) and enriching them with runtime context. Dynatrace allows you to ingest, visualize, prioritize, and automate security findings, helping to reduce noise from alerts and provide focused remediation to the issues that matter to your critical production environments.

Managing vulnerabilities in a fragmented world

In today’s complex digital landscape, managing vulnerabilities effectively is crucial for maintaining robust security. However, the challenge often lies in the fragmentation of vulnerability data across different systems and tools.

Dynatrace provides deep insights into application runtime, offering a detailed view of application performance and the runtime impact of potential vulnerabilities. At the same time, Snyk focuses on various artifacts, conducting comprehensive assessments of code and container repositories.

During the SDLC development phases, various artifacts of your applications are assessed for security issues from their code phase throughout the build and deploy phases until they run in your production.

With the number of security findings generated, your DevSecOps teams can become overwhelmed and miss important issues that directly impact your production services and applications. A good example is a critical severity vulnerability discovered in a build-time artifact, such as a container image that isn’t deployed and doesn’t impact your runtime. Your DevSecOps teams shouldn’t be distracted by such findings and should focus on vulnerabilities in your production application that are exposed to the internet and present a real risk.

The Dynatrace solution

Dynatrace addresses these issues by providing unified security event ingest and analysis for security findings across tools and products. The ingested events are stored in the semantic dictionary format, which allows you to efficiently visualize, analyze, and automate the orchestration of security findings in a unified and product-independent way.

In addition, with runtime entity contextualization, security findings can be mapped to monitored entities. This runtime context can be used to better prioritize the findings based on runtime properties, such as focusing only on vulnerabilities affecting production applications.

Integration with Snyk

Dynatrace delivers Snyk integration as an extension that allows granular control over the data flow between Snyk and the Dynatrace platform.

• Snyk issues and audit logs are fetched periodically and pushed to Dynatrace via a dedicated security event ingestion endpoint.
• Events are processed, mapped to the Dynatrace Semantic Dictionary in OpenPipeline™, and stored in the Dynatrace Grail™ data lakehouse.
• With sample dashboards and workflows, users can start prioritizing and automating the orchestration of Snyk vulnerabilities.

As part of the integration, we provide a couple of ready-made documents to serve as a starting point for your data analysis and automation use cases.

Use case: Runtime contextualization of container findings

Use case: Visualize and analyze security findings

Use case: Discover coverage gaps in security scans

Use case: Automate and orchestrate security findings

“This integration complements the value Snyk AppRisk provides to the development teams, connecting the observability insights with the security findings. With the bi-directional integration, SREs and cloud teams now get security insights within the observability context in the Dynatrace Platform. The shared goal is to focus the DevSecOps teams and make them more efficient when addressing security issues.”

Jack Ryan, Partner Solutions Engineer at Snyk

Get started

With Dynatrace integration with Snyk, you can gain control over your security findings and help your DevSecOps teams focus their remediation efforts.

For more details about the prerequisites and the setup instructions, please visit Dynatrace Documentation, Ingest Snyk vulnerability findings, scans, and audit logs.

^{Dynatrace and the Dynatrace logo are trademarks of the Dynatrace, Inc. group of companies. All other trademarks are the property of their respective owners.}

The post Ingest and enrich Snyk vulnerability findings with Dynatrace appeared first on Dynatrace news.

Dynatrace integrates with Harbor to break the silos between DevSecOps teams by unifying security findings along the Software Development Lifecycle (SDLC) and enriching them with runtime context. Dynatrace allows you to ingest, visualize, prioritize, and automate security findings, helping to reduce noise from alerts and provide focused remediation on the issues that matter most to your critical production environments.

Manage vulnerabilities in a fragmented world

In today’s complex digital landscape, managing vulnerabilities effectively is crucial for maintaining robust security. However, the challenge often lies in the fragmentation of vulnerability data across different systems and tools.

Dynatrace provides deep insights into application runtime, offering a detailed view of how applications perform and the runtime impact of potential vulnerabilities. Meanwhile, Harbor continuously scans container images stored as artifacts in a registry for vulnerabilities.

DevSecOps teams that must address vulnerability findings are typically overwhelmed by the number of issues generated from assessments of the various artifacts. But should your teams care about all the findings? A good example is a critical severity vulnerability discovered in a build-time artifact, such as a container image that isn’t deployed and doesn’t impact your runtime. Your DevSecOps teams shouldn’t be distracted by such findings and should focus on vulnerabilities in your production application that are exposed to the internet and present an actual risk.

The Dynatrace solution

Dynatrace addresses these issues by providing unified security event ingest and analysis for security findings across tools and products. Ingested events are stored in the semantic dictionary, which allows you to efficiently visualize, analyze, and automate the orchestration of security findings in a unified and product-independent way.

In addition, with runtime entity contextualization, security findings can be mapped to monitored entities. This runtime context can be used to better prioritize findings based on runtime properties, such as focusing only on vulnerabilities that affect production applications.

Integration with Harbor

Dynatrace delivers Harbor integration as an extension that allows granular control over the data flow between Harbor and the Dynatrace platform.

1. Harbor vulnerability findings and audit logs are fetched periodically and pushed to Dynatrace via a dedicated security event ingest endpoint.
2. Events are processed, mapped to the Dynatrace Semantic Dictionary in OpenPipeline™, and stored in Grail™.
3. With sample dashboards and workflows, you can start prioritizing and automating the orchestration of your Harbor vulnerabilities.

As part of this integration, we provide ready-made documents that can serve as a starting point for your data analysis and automation use cases.

Use case: Visualize and analyze security findings

Use case: Discover coverage gaps in security scans

Use case: Automate and orchestrate security findings

Get started

The Dynatrace integration with Harbor gives you control over your security findings and helps your DevSecOps teams focus their remediation efforts.

For more details about the prerequisites and setup instructions, see Dynatrace Documentation, Ingest Harbor vulnerability findings, scans, and audit logs.

The post Ingest and enrich Harbor vulnerability findings with Dynatrace appeared first on Dynatrace news.

Dynatrace integrates with AWS Security Hub to unify, visualize, and automate security findings across tools and environments. Adding Dynatrace runtime context to security findings allows smarter prioritization, helps reduce the noise from alerts, and focuses your DevSecOps teams on efficient remediation of the critical issues that affect your production environments and applications.

About AWS Security Hub

AWS Security Hub prioritizes your most critical security issues and helps you respond at scale. It detects critical issues by correlating and enriching signals, for example, from threat detection and vulnerability management. This allows you to surface and prioritize active risks in your cloud environment. AWS Security Hub transforms security signals into actionable insights and offers intuitive visualizations and natural language summaries, enabling you to make more informed security decisions quickly. Security Hub also provides automated response workflows to streamline remediation at scale. As a result, you can reduce security risks, improve your team’s productivity, and minimize potential operational disruptions. Security Hub provides enhanced visibility into your security posture to protect your cloud environment.

Security findings in AWS Security Hub

AWS Security Hub provides a great way of aggregating security findings, especially those related to cloud infrastructure. The main categories are detections, vulnerabilities, and compliance misconfigurations. Third-party findings can be explored alongside AWS-native security findings with AWS Security Hub CSPM.

Findings from various stages of the Software Development Lifecycle (SDLC) are included: code scans, build scans, and runtime context. This helps you connect the dots to see the unified picture and understand the actual impact.

Our customers have asked for a better way to construct a full view of their security exposures when analyzing security findings across various environments and cloud infrastructures.

Findings can come from various types of environments: development, testing, and production. This increases the number of findings to prioritize. The amount of notifications generated also rises, along with the probability of missing critical issues.

Additional context is required to efficiently filter out the less important findings and focus attention on the real critical issues that directly impact your production applications.

Add context to AWS Security Hub findings

The Dynatrace® platform, powered by OpenPipeline®, provides unified security event ingestion and analysis across tools and cloud environments. Findings are mapped to Dynatrace semantic conventions and stored in Grail^® data lakehouse, allowing you to uniformly access and analyze your ingested data.

The Dashboards, Notebooks, and Security Investigator apps help you visualize the security findings. Dynatrace Workflows serves as your automation engine to efficiently process and triage the security findings, create working tickets for your DevSecOps teams, and send notifications to the relevant stakeholders.

Supported findings can be mapped to the monitored runtime entities, allowing you to assess the risks and impact of the findings within the context of your business-critical services and applications. This is the key to smarter prioritization and noise reduction.

In addition to the unified analysis and prioritization of security findings, you gain insight into your security product coverage, identify gaps, and assess the effectiveness of your security tooling. Dynatrace helps answer questions such as: Which tools cover what parts of my environment? Where do I have security assessment gaps? And, which tools generate the most value?

How it works

AWS Security Hub integration leverages Amazon EventBridge as the transit point for forwarding the various security findings to Dynatrace in either ASFF for AWS Security Hub CSPM or OCSF for the enhanced version of AWS Security Hub.

Dynatrace supports both the OCSF and ASSF formats out of the box, processing and mapping the three security finding types (detections, vulnerabilities, and compliance) to the Dynatrace Semantic Dictionary and storing them in Grail as security events.

You can consume the ingested events via native Dynatrace® Apps, such as Dashboards, Notebooks, Workflows, and more.

The AWS Security Hub integration app provides easy-to-follow steps to set up the integration and monitoring capabilities to ensure the integration runs properly.

We also provide you with several ready-made documents to serve as a starting point for your analysis and automation:

• Sample dashboards to visualize the security findings and assess the coverage in Dashboards.
• Sample workflows to automate the orchestration of critical findings by creating notifications and tickets in Workflows.

What´s next

Read more about how to Ingest and enrich security findings delivered by Amazon EventBridge with Dynatrace, as well as how to Enrich Amazon ECR vulnerability findings with runtime context.

Also, visit Dynatrace Documentation to set up your integration and explore sample use cases.

The post Ingest and enrich AWS Security Hub findings with Dynatrace appeared first on Dynatrace news.

Dynatrace integrates with Amazon EventBridge to break the silos between DevSecOps teams by unifying security findings along the Software Development Lifecycle (SDLC) and enriching them with runtime context. Powered by OpenPipeline™, Dynatrace allows you to ingest, visualize, prioritize, and automate security findings, helping to reduce noise from alerts and provide focused remediation to the issues that matter to your critical production environments.

The complexity of multicloud environments

In complex multicloud environments, security findings are often siloed across build-time and runtime tooling, as well as spread across various environments. Thus, getting a holistic view of your security posture and risks is challenging. The consequences include:

• Time spent navigating various platforms to collect data.
• Difficulty prioritizing findings from disparate tools.
• Security coverage gaps.
• Excessive manual effort is required to notify stakeholders of critical findings.
• Remediation takes a long time.

Moreover, with the number of security findings generated, your DevSecOps teams might become overwhelmed and miss important issues that directly impact your production services and applications. A good example is a critical severity vulnerability discovered in a build-time artifact, such as a container image that isn’t deployed and doesn’t impact your runtime. Your DevSecOps teams shouldn’t be distracted by such findings and should instead focus on vulnerabilities in your production application that are exposed to the internet and present a real risk.

The Dynatrace solution

Dynatrace addresses these issues by providing unified security events ingest and analysis of security findings across cloud environments. The ingested findings are mapped to the monitored runtime entities, which allows you to assess the risks better and reprioritize remediation of the critical findings.

Security findings can be pushed to Dynatrace, as with Amazon EventBridge, or pulled from a third-party tool by a dedicated Dynatrace integration.

With built-in support for various products and security-finding standards, Dynatrace provides visibility into security posture from multiple stages of your SDLC. This allows you to orchestrate the findings effectively, drive faster remediation, discover security coverage gaps, optimize tooling usage, and maximize your ROI.

Ingest AWS EventBridge findings into Dynatrace

Dynatrace partners with AWS and serves as a destination for Amazon EventBridge rules. Depending on the use case, findings and logs can be forwarded to the dedicated OpenPipeline endpoints and ingested into Grail^TM.

Dynatrace supports security findings forwarded via Amazon EventBridge in the following scenarios:

• Ingested as raw events or in a supported generic standard data format, such as OCSF or ASFF.
• Forwarded as findings from the AWS Security Hub, including vulnerability, detection, and compliance events.
• Forwarded as container findings from the Amazon ECR (basic and enhanced scanning).

Dynatrace maps the ingested events to Semantic Dictionary conventions for the supported products and data formats. You can consume the events uniformly for visualization and analysis in Dashboards and Notebooks and automation use cases in Workflows.

For example, you can ingest Amazon ECR container image vulnerability findings into Dynatrace using Amazon EventBridge. Dynatrace provides a CloudFormation template and detailed instructions as part of the setup.Please read our documentation for individual integrations, Ingest Amazon ECR vulnerability findings and scan events, Ingest AWS Security Hub security findings, and our blog post, Enrich AWS ECR vulnerability findings with runtime context, for additional details on the integration setup and supported use cases.

Get started

Also, check out Amazon ECR monitoring & observability

Try it today

Leverage a seamless, out-of-the-box experience to optimize performance, reduce costs, and drive cloud-native innovation.

Contact your Dynatrace representative or visit our AWS integration page to start your free trial and see the difference intelligent cloud monitoring can make.

The post Ingest and enrich security findings delivered by Amazon EventBridge with Dynatrace appeared first on Dynatrace news.

Dynatrace integrates with Tenable to provide a single pane of glass for security findings across various environments and products, allowing unified analysis, prioritization, and orchestration of findings. With the enriched runtime context, you can focus on critical issues that impact your production apps and help reduce noise for the DevSecOps teams that remediate those issues.

Managing vulnerabilities in a fragmented world

In today’s complex digital landscape, managing vulnerabilities effectively is crucial for maintaining robust security. However, the challenge often lies in the fragmentation of vulnerability data across different systems and tools.

Dynatrace provides deep insights into application runtime, offering a detailed view of how applications perform and where potential vulnerabilities might lie. On the other hand, Tenable focuses on infrastructure, conducting comprehensive scans of hosts, web applications, and compliance checks.

This division can lead to alert noise from critical security findings in infrastructure, which might not always be relevant to your production environment and applications. Understanding and integrating these insights is key to effectively prioritizing and addressing the most critical vulnerabilities.

Enhance security with the Dynatrace and Tenable integration

Managing vulnerabilities effectively is crucial for maintaining robust security. The integration of Dynatrace with Tenable Vulnerability Management and the Tenable One platform brings a comprehensive approach to vulnerability management and user activity monitoring.

By integrating Dynatrace with Tenable, you can:

• Prioritize vulnerability findings with runtime context: Gain deeper insights into how vulnerabilities impact your applications in real time, allowing for more informed decision-making.
• Discover security product coverage gaps: Identify areas where your security products might not be providing adequate coverage, ensuring that no vulnerabilities are overlooked.
• Automate notifications and ticket creation for new findings: Streamline your response to new vulnerabilities with automated workflows.
• Monitor and detect suspicious user activity: Analyze and detect suspicious user activity within the Tenable platform.

This integration enhances your ability to manage vulnerabilities and ensures that your security efforts are aligned with your production environment and applications.

Integrating with Tenable

Dynatrace delivers this integration as an extension that allows granular control over the data flow between Tenable and the Dynatrace platform.

Leveraging OpenPipeline^TM, Tenable vulnerability findings and activity logs are pushed to Dynatrace and stored in Grail ^TM where they’re mapped to semantic conventions that make them available in a unified schema for further analysis.

With this integration, we also provide additional artifacts to help you get started with security data visualization and automation use cases:

• Sample dashboard for vulnerability findings: Surface all the vulnerability findings across various products. The dashboard connects the findings to monitored host entities for an impact view of your runtime exposures.

• Sample dashboard for product scan coverage: Visualize and discover coverage gaps in your environment. The dashboard provides the host entity scan coverage to ensure comprehensive security assessments.
• Sample workflow for Slack notifications: Receive instant alerts in Slack for new critical vulnerability findings, keeping your team informed and responsive.
  
• Sample workflow for Jira ticket creation: Automatically create Jira tickets for new critical vulnerabilities, ensuring they’re tracked and addressed promptly.

What’s next

Starting with asset scans from Tenable Vulnerability Management, Dynatrace gradually extends the support for additional vulnerability and misconfiguration scan types from Tenable.

For more detail, please dive into our documentation about ingesting Tenable vulnerability findings, scanning events, and auditing logs.

The post Enrich Tenable vulnerability findings with Dynatrace runtime context appeared first on Dynatrace news.

Dynatrace integrates with AWS Elastic Container Registry (ECR) to enable visibility, orchestration, and prioritization of cross-container-registry vulnerability findings. This integration provides a single pane of glass for container image scans of your containerized applications and is part of a larger effort to enrich vulnerability findings with runtime context.

In complex multicloud environments, vulnerability findings are often siloed between build-time and run-time tooling. Thus, getting a holistic view of security risks is challenging.

Dynatrace addresses this issue by providing unified ingest and analysis of container vulnerability findings across cloud and container registries. This ensures that SecDevOps has a continuous and comprehensive understanding of its security posture.

In addition, security findings detected during the build phase and in your artifact registries, such as Amazon ECR, might not be relevant to your production-critical applications. By enriching runtime context from the monitored entities, Dynatrace helps filter out the noise, prioritize critical findings, and focus your remediation efforts on what truly matters for your production environment.

Key Steps in the Integration Process

Container image scanning

Amazon ECR scans container images for vulnerabilities. You can choose between basic and enhanced scanning.

Data ingestion

The vulnerability findings are pushed into the Dynatrace platform through AWS Event Bridge via the dedicated security ingest endpoint powered by OpenPipeline^TM. You can set it up using an AWS CloudFormation template provided by Dynatrace. For instructions, see the documentation.

Data mapping

The ingested data is mapped according to the Dynatrace Semantic Dictionary, ensuring a unified format for analysis.

Analysis and automation

Once the findings are ingested, you can visualize, analyze, and automate in Dynatrace with Dashboards, Notebooks, and Workflows.

Use cases

Once security findings and scan events are ingested into Dynatrace Grail™, you can analyze them and perform automation tasks, leveraging the uniform data format.

Amazon ECR ingested data can be consumed as follows:

• Dashboards: Use the provided sample dashboards or create custom visualizations of the security findings and scan events.
• Notebooks and Security Investigator: Use vulnerability findings as an additional dimension for threat hunting and forensic investigations.
• Workflows: Automate the orchestration of critical vulnerability findings by creating alerts and tickets.

Explore individual use cases in Dynatrace Documentation:

• Visualize and contextualize security findings
• Automate and orchestrate security findings
• Discover coverage gaps in security scans
• Visit the Dynatrace Hub and leverage our Amazon ECR app

Get started

Visit Dynatrace Documentation and get started setting up your Amazon ECR data integration.

The post Enrich Amazon ECR vulnerability findings with runtime context appeared first on Dynatrace news.

Dynatrace, powered by OpenPipeline™, offers a single pane of glass that consolidates container security findings from your existing DevSecOps tools, providing a comprehensive runtime context-based prioritization. It helps unveil blind spots by identifying and addressing coverage gaps throughout your Software Development Lifecycle (SDLC). With contextual operationalization, you can prioritize, visualize, and automate the response to container findings, all within the context of runtime operations while reducing alert noise in the SDLC. Moreover, seamless integration is achieved through out-of-the-box solutions that connect, transform, and map your findings data into a unified format using the Dynatrace Semantic Dictionary, ensuring a smooth and efficient security workflow.

The challenge we’re tackling arises from multicloud environments, where container images are dispersed across different registries and scanned by various vulnerability scanners, if at all. This leads to container security findings scattered across multiple products, complicating achieving unified visibility. The consequences include time spent navigating various platforms to collect data, difficulty prioritizing findings from disparate tools, coverage gaps with containers deployed unscanned, and excessive manual effort required to notify stakeholders and generate tickets.

Addressing this issue is crucial for cloud architects, who aim to establish a robust container scanning process within the SDLC, ensuring timely action on findings and prioritization of critical vulnerabilities. Cloud architects also seek to minimize manual efforts in managing each finding. Meanwhile, developers need prompt notifications about new critical vulnerabilities affecting containers that they can trust and take action on without being overloaded by false positives, which lead to alert fatigue and risk critical alerts being ignored. Developers should handle as few tickets as possible, focusing on those that yield the maximum return on investment (ROI).

Why Dynatrace?

Container security in DevSecOps typically focuses on the build phase, where scanners flag numerous critical vulnerabilities without considering runtime context, often resulting in false alarms. Dynatrace revolutionizes this process by utilizing its insights into active containers and their operational significance. This allows you to prioritize genuine threats impacting live containers. Additionally, Dynatrace observability data for running containers, enriched with security insights, offers a comprehensive view for more effective issue resolution. In essence, Dynatrace refines container security management by integrating runtime context, thus elevating the prioritization and handling of vulnerabilities.

Generic ingest security endpoint

Dynatrace introduces a generic ingest security endpoint, a versatile feature that enables data ingestion directly from any third-party security tool.

This capability opens up a range of use cases, such as:

• Security findings visualization on custom dashboards tailored within Dynatrace.
• In-depth analysis of security findings using tools like Notebooks and Security Investigator.
• Automated orchestration of security findings through Dynatrace Workflows, enhancing efficiency and response times.
• Contextualization of third-party security findings with Dynatrace runtime entities, offering a more integrated and coherent security management experience.

With the generic ingest security endpoint, you can ingest any data in an unstructured format. However, to truly gain the benefits of uniform prioritization, the ideal scenario is to have the data in a unified format. To this end, we’re also releasing Dynatrace Semantic Dictionary conventions for vulnerability findings.

The Dynatrace Semantic Dictionary for vulnerability findings is a key feature in Dynatrace that enables a consistent and uniform analysis of security data. Dynatrace uses this format in supported third-party integrations, but this same format can also be used to map data from custom integrations.

It allows for uniform prioritization of container vulnerability findings across different tools, which can be conveniently managed and visualized through Dynatrace sample dashboards.

Additionally, this format supports automated notification of vulnerability findings across security tools, utilizing Dynatrace sample workflows to enhance efficiency.

Lastly, the generic ingest security endpoint provides a comprehensive understanding of the security findings coverage within your runtime environment, ensuring that all potential vulnerabilities are accounted for and addressed. This unified approach ensures that security management is systematic and effective, catering to the complex needs of modern containerized environments.

Dynatrace supported integrations

Dynatrace supported security data ingest integrations streamline the setup process and ensure automatic Semantic Dictionary (SD) mappings, providing a seamless integration experience.

With the first integrations in place, the foundations are there to build additional native integrations into the Dynatrace Platform to support additional container registries and generic security standards. This will expand our capability to provide contextual information to observability and security events, irrespective of where they originate. So, look for future blog announcements on this topic.

What’s next

• Watch the data-driven DevSecOps automation webinar, where we present and discuss the benefits of Dynatrace runtime context in operationalizing third-party security findings.
• To discover which products, tools, and standards we support, please visit the Dynatrace Hub.
• Explore the security data ingest capabilities and view the step-by-step setup guides for the supported integrations in Dynatrace Documentation.
• For additional out-of-the-box integration requests, please contact your Dynatrace account manager or submit a request in the Dynatrace Community.

The post Break the silos: Enrich vulnerability findings with runtime context appeared first on Dynatrace news.

In the past, all security “wisdom” was owned by security teams alone. Business and app owners could only dream of having continuous visibility into their application’s health from both the availability and security standpoint.

Dynatrace Application Security changed this by introducing Runtime Vulnerability Analytics for your production environments. This feature enables multiple stakeholders to have immediate visibility of the security posture of their apps and act accordingly.

The new version of the Dynatrace mobile app extends this visibility further to real-life vulnerability monitoring, providing quick and easy access to security insights directly on your mobile device.

With the Dynatrace mobile app, you get unified access to both observability and security-related insights, such as:

• Operational alerts on the availability and performance issues of your monitored apps and services.
• Security findings of third-party vulnerabilities.
• Detailed information about each alert or vulnerability to understand the immediate impact on your environment.

Scenario #1: You’re a CISO at a large corporation

You’re a CISO at a large corporation. You’re attending a special CISO dinner with peers from other companies, where you share knowledge and experience of various security topics.

One of your peers mentions a recent vulnerability that was hard to map and assess in production. It took them weeks to identify and fix the issue, which exposed the organization to potential cyberattacks and reputational damage.

You feel a surge of curiosity and concern. Could your organization also be exposed to this vulnerability? How would you know? How long would it take you to find out and resolve it?

You remember that you have Dynatrace installed on your systems. You know that with Dynatrace, your teams can easily detect and map such vulnerabilities in production and act accordingly.

Then, you recall that you recently installed the new Dynatrace mobile app on your phone. It should provide a quick answer to some of the questions.

• You open the Dynatrace mobile app and go to the Third-party vulnerabilities section, which shows your environment’s recent vulnerabilities.

• You quickly look up the mentioned vulnerability CVE in the mobile app and confirm that your organization is vulnerable.

• Next, you share the vulnerability info via your organization’s Slack channel with your security manager, asking that you review the information with them tomorrow.

Meanwhile, your security manager is out grocery shopping when your message arrives. Your security manager is curious about the details and so looks up the vulnerability in the Dynatrace app on their mobile device.

Fortunately, the vulnerability has no public internet exposure, which means it’s not easily exploitable by hackers. As a result, your security manager is relieved and less stressed about handling the issue. Your security manager can now sleep calmly and agrees to review the details with you tomorrow in the office.

Scenario #2: You’re an SRE working at a large bank

You’re an SRE (Site Reliability Engineer) working at a large bank. You’re responsible for the online banking platform that serves thousands of customers. You own all aspects of the health of the application, including all security aspects.

This weekend, you’re on-call. If anything happens to the app, you’ll need to go to the office to address the issue. You plan to spend the day at the beach with family and friends. You hope that you won’t be disturbed.

At lunchtime, you receive an email from the SOC (Security Operations Center) team. There was a prevented attempt to exploit a known vulnerability on one of the other apps. It was the log4j library that was exploited. This is a serious security issue that affects many Java applications.

All app owners on-call with log4j-related vulnerabilities in their apps are required to attend a war room meeting in a couple of hours to assess the impact. You’re at the beach, away from your office. How can you check the security status of your app without leaving the beach? Then you recall that you recently installed the new Dynatrace mobile app.

• You open the Dynatrace mobile app and look up the log4j library in the Application Security findings. You see that no vulnerabilities are open for this library on the online banking platform that you manage.

You also see that your development team resolved all critical vulnerabilities on the app.

You feel relieved and impressed. Thanks to the Dynatrace mobile app, you discovered and assessed the security status of your app in minutes, without leaving the beach. You decide to reply to the SOC team and inform them that your app is not affected by the log4j vulnerability.

With the Dynatrace mobile app, you can quickly and easily check your app’s operational and security status from anywhere. Reduce stress, increase confidence, and stay in control of any tough situation!

How to get started

• Install the new Dynatrace mobile app for your mobile device:
  • Android download
  • iOS download
• Learn more about related Dynatrace Application Security capabilities:
  • Manage third-party vulnerabilities
• Related articles:
  • Reduce incident response times with Davis® AIOps push notifications on your phone

The post Keep security findings at your fingertips with the Dynatrace mobile app appeared first on Dynatrace news.