Modern SecOps practices imply an engineering approach to handling threats. This involves not only treating threat detection as code but also using automation to reduce toil and support faster response to ongoing attacks. When detecting an attack, we don’t want to lose valuable time. Instead, we want to start our investigation quickly and remediate the issue as fast as possible.

This blog will cover the following three important building blocks of handling detected threats:

1. Leave no gaps: By executing our queries steadily and regularly we can make sure not to miss signs of suspicious behavior. In case we detect something, we want to create an event that represents the found activity.
2. Get the right eyes on it: Cloud-native environments can be complex, and only responsible teams may know the ins and outs of their applications.
3. Respond quickly: By using automation we can trigger evidence collection or even disrupt the adversary’s actions.

Leave no gaps

To access the Dynatrace AutomationEngine, start by creating a new workflow. We’ll give it a descriptive name and create a trigger to execute it every 10 minutes.

Next, we’re going to add a workflow action that executes DQL queries for us. We’re then pasting the query we examined in the previous blog post that aims to detect possibly compromised service accounts. Before we schedule the query, let’s add a few additional fields to make it better usable going forward:

| fieldsAdd object.name = k8s.pod.name
| fieldsAdd object.type = "k8spod"
| fieldsAdd finding.title = "Access Denied for Service Account Accessing Secret(s) or Configmap(s)"
| fieldsAdd finding.severity = "MEDIUM"
| fieldsAdd finding.time.created = toTimestamp(now())
| fieldsAdd finding.id = hashSha256(concat(toString(finding.time.created), toString(random())))
| fieldsAdd event.description = concat("Access denied for service account ", `user.name`, " accessing secret(s) or configmap(s)")
| fieldsAdd event.id = finding.id
| fieldsAdd actor.ips = array(sourceIP)

These additional fields allow the event to later be properly displayed in the Threats & Exploits app. If you choose another query to be scheduled, feel free to adjust the values accordingly. Stay tuned for part three of this series to learn more about T&E.

This query is now executed every 10 minutes. Let’s add another action to it to further process the query results. Based on the technique Tiit Hallas, principal product manager at Dynatrace, described in his blog post, Generate security events from Dynatrace Security Investigator via OpenPipeline, we’re going to add an action that creates a custom detection finding. Combining this with the OpenPipeline configuration allows us to create detection findings every time our query finds something suspicious.

Make sure to add the following fields in OpenPipeline to create a proper detection finding event:

• kind: SECURITY_EVENT
• type: DETECTION_FINDING
• provider: Dynatrace

Get the right eyes on it

SecOps teams often have two problems: there are never enough people, and they can’t know everything about the environment. Both shortcomings can be addressed by democratizing threat detection and response, including collaborating on investigations.

After successfully creating an event that represents our finding, it’s now time to involve the right people. The Dynatrace platform can make use of ownership information being set using native techniques, such as labels in Kubernetes. This flexible and scalable way to measure who is responsible for a certain workload, namespace, or cluster helps ensure we can programmatically find the right people and notify them immediately, such as via Slack. In my cluster, I’ve set a pod label named dt.owner on the deployment to the corresponding team name. Check out the docs to learn more about ownership.

template:
    metadata:
      labels:
        app.kubernetes.io/name: proxy-service
        app.kubernetes.io/part-of: unguard
        dt.owner: unguard-team

The resulting part of the workflow then looks something like this:

Respond quickly

The third pillar of our workflow will be all about automated response. Maybe we want to deploy a workload that collects forensic evidence. Maybe we want to deploy a network policy quarantining a workload, or maybe we want to get rid of a possibly compromised pod completely. The latter obviously doesn’t solve our problem, but it may stop the bleeding for a while and set the attacker back to square one, gaining us some valuable time for investigating the detection finding and discussing possible remediation options.

Using the Kubernetes automation capabilities combined with the Dynatrace operator, we can apply, delete, or modify any resource we’d like to. In this example, we’re deleting the pod right away to get rid of a possible foothold established by an adversary. This also completes our workflow for handling possibly compromised Kubernetes service accounts (or any other threat detection scenario you’d like to handle that way).

Threat detection with Dynatrace: What’s next?

Now that we have configured our initial set of actions, we can investigate the origins and the impact of the suspicious activity.

Stay tuned for part three of this blog series to learn about how we can do triage and investigation of this and other detection findings in Dynatrace.

The post Threat detection in cloud native environments (part 2): How to automate threat management using workflows appeared first on Dynatrace news.

After organizations struggled to recover from the CrowdStrike update outage on their Windows hosts in July, teams are now looking for ways to bolster the resiliency of their software update and continuous delivery practices.

The widespread impact of the CrowdStrike issue demonstrated how critical it is to avoid outages and failures during software deployments to maintain user trust and satisfaction. Traditional deployment techniques that roll out updates or patches directly into full production can present significant risks and lead to potential downtime.

Modern deployment techniques using progressive delivery—such as rolling, blue/green, canary, and feature flagging—offer a more controlled and gradual approach to releasing software. By implementing these strategies, organizations can minimize the impact of potential failures and ensure a smoother transition for users.

Eliminating the potential for outages may not be possible in all situations. That said, a unified observability and security platform such as Dynatrace can enhance modern deployment practices and enable teams to proactively monitor performance, validate changes, and best protect their downstream customers and end users from disruptions.

Bolster continuous delivery with software development lifecycle integrations

Software testing is critical, yet issues can still make it into production that negatively impact the customer experience. Dynatrace strives to protect its own customers through extensive automated test validation, complemented by staged rollouts to customer segments, which include quick feedback loops to determine whether the software is safe to continue deployments. Customers can adopt many modern and safe continuous delivery practices with Dynatrace in combination with their existing software pipelines.

By embedding Dynatrace observability into their own CI/CD pipeline, customers can prevent issues from ever leaving pre-production environments. This integration enhances the pre-release phase and plays a crucial role in the quick feedback cycle after deployment, allowing teams to identify issues immediately. Furthermore, the Dynatrace Site Reliability Guardian ensures service-level objectives (SLOs) and further validation thresholds are not violated both before and after deployment.

Progressive delivery methods to release higher-quality software, faster

The following common progressive delivery methods enable organizations to release software in a more controlled manner. 

Rolling deployments

In a rolling deployment, software is gradually rolled out, replacing previous software in a serial one-by-one fashion or in batch sets. Dynatrace can monitor production environments for performance degradations and outage events that may cause customers to lose access. The Dynatrace AutomationEngine, in conjunction with the existing deployment platforms, enables immediate and automatic software rollbacks to previous versions, limiting the blast radius for customers.

Blue/green deployments

A blue/green deployment strategy involves selecting a “blue” group to run the new software while the “green” group continues to run the previous version. The Davis AI engine immediately recognizes any anomalies, performance issues, or outages between the two groups. In case there is a degradation of service, Dynatrace picks it up and, embedded by the pipeline, can ensure all customers are rooted back to the proven, stable deployment.

Canary deployments

The Canary deployment strategy releases software to customers in incremental phases, gradually increasing the production load on the new deployment. Dynatrace enables customers to set quality measures or SLO targets for performance, outages, or other usage metrics to mitigate risk. By integrating AutomationEngine into the pipeline, customers can safely increase or decrease the load on canary deployments.

Feature flagging

Feature flagging is another popular technique used in progressive delivery that allows teams to roll out new features incrementally and with minimal risk. It supports A/B testing, canary releases, and quick rollbacks, ensuring smoother transitions and more controlled feature releases. The result is testing features in production with specific user segments, gathering feedback and making data-driven decisions on a broader rollout. Embedding feature flags in the codebase can make it easier to control the visibility and behavior of features in real time without redeploying or disrupting an application. This leads to enhanced agility, improves quality, and accelerates time-to-market, all while maintaining a seamless user experience.

As organizations implement progressive delivery strategies to enhance their release processes, integrating automated validation tools such as the Dynatrace Site Reliability Guardian (SRG) becomes essential for further optimizing these practices and ensuring robust performance monitoring

Site Reliability Guardian and AutomationEngine bolster continuous delivery tools and technologies

Dynatrace Site Reliability Guardian (SRG) integrates with continuous deployment practices and platforms to provide the following capabilities:

1. Automated change impact analysis: SRG automates analyzing the impact of changes on service availability, performance, and capacity objectives across various systems before a deployment goes live or during any of the deployment strategies.
2. Integration with CI/CD pipelines: Teams can integrate SRG into existing delivery pipelines including Jenkins, Github, GitLab, AWS, or Azure pipelines. This integration enables teams to validate releases automatically as part of their software development lifecycle before they are released to customers.
3. Workflow automation: AutomationEngine and workflows automate the execution of guardians or problem remediation. This can be tied to specific events such as deployments or configuration changes, allowing for automated validation and response to changes.
4. Service-level objectives (SLOs): SLOs enable site reliability engineers (SREs) to manage and track thresholds for critical services. The Davis AI engine proactively monitors these SLOs for degradations and acts before an SLO violation happens.
5. Automated release validation: The platform supports automated release validation for security and quality gates to ensure that only high-quality code progresses through the delivery pipeline. This integration reduces the risk of deploying faulty code to production.

Embed Dynatrace into your release process and gain even more control

The Dynatrace platform is an essential tool for customers deploying software. It provides critical data that enables rapid, fact-based decisions about continuing or rolling back deployments. By offering real-time performance metrics and insights into application health, the Dynatrace platform empowers teams to assess the impact of changes quickly. This capability minimizes downtime and ensures potential issues are addressed before affecting end users, allowing organizations to navigate software deployment complexities and enhance reliability confidently.

Enhance continuous delivery quality and manage the risk of another CrowdStrike update outage

Incidents like the CrowdStrike update outage illustrate the importance of adopting modern progressive delivery strategies to enhance software reliability and customer satisfaction. By adopting approaches like rolling, blue/green, and canary deployments, teams can mitigate risks associated with large-scale releases and ensure a smoother user experience. Integrating Dynatrace into these processes provides invaluable insights and automated monitoring capabilities, allowing DevOps teams to detect issues early and respond swiftly.

As organizations continue to navigate the complexities of software delivery, prioritizing modern deployment techniques and leveraging robust monitoring solutions will be key to avoiding outages and failures. Embracing these practices will ultimately lead to more resilient applications, happier users, and a stronger competitive edge in the market.

Contact us to learn how you can bolster the resiliency of your progressive delivery techniques with AI-driven automation that can help you avoid the effects of an outage like CrowdStrike.

The post CrowdStrike update outage: Managing continuous delivery and deployment risk with Dynatrace appeared first on Dynatrace news.

Bridge the gaps while staying secure

While more and more applications are moving to the cloud, the need for secure environments isn’t going away. EdgeConnect provides a secure bridge for SaaS-heavy companies like Dynatrace, which hosts numerous systems and data behind VPNs. EdgeConnect facilitates seamless interaction, ensuring data security and operational efficiency.

With the increasing adoption of SaaS platforms and escalating security concerns caused by the proliferation of cyber threats, companies are becoming increasingly aware of the importance of safeguarding their systems and data. In this hybrid world, IT and business processes often span across a blend of on-premises and SaaS systems, making standardization and automation necessary for efficiency. Enterprises seek solutions that enable these processes to interact across their entire system landscape without compromising security.

Due to a variety of challenges, organizations face significant difficulties in achieving seamless interaction between on-premises and SaaS systems. Security concerns make it risky to bridge these systems, leaving enough flexibility for users to achieve their goals and keeping IT in control of infrastructure and deployments.

A look behind the curtain: EdgeConnect connects to the outside world

An EdgeConnect instance establishes a WebSocket secure connection (WSS/443) to the Dynatrace platform that doesn’t require opening ports or inbound connections. EdgeConnect acts as a bridge between Dynatrace and the network where it’s deployed

Setting up an EdgeConnect is simple. You can manage your EdgeConnect configuration in the Settings app under General > External requests. Once the initial setup is complete, Dynatrace routes all HTTP(s) service requests that match your configured rules via EdgeConnect.

Efficiency and control

EdgeConnect boasts a range of features designed for efficiency and control. It’s built for container-based deployments, operating either as a standalone container or within your Kubernetes or Openshift clusters. EdgeConnect is designed to forward HTTP(s) requests exclusively, ensuring secure data transmission. It supports multi-instance high availability and load balancing, providing robust performance and reliability.

EdgeConnect empowers operators with an optional allow list for domains during deployment. This feature enables IT to maintain control without the need for any configuration in Dynatrace, further simplifying the process.

The versatility of EdgeConnect enables many use cases:

• Automated creation and update of tickets in your local Jira instance using Dynatrace Workflows whenever Davis® AI identifies problems.
• Integration of data from your internal data warehouse to Dynatrace dashboards, blended with data from Grail.
• Flexible and adaptable connections to internet-based services like ServiceNow via a dedicated host and IP that you control.

What’s next

EdgeConnect is available for all Dynatrace SaaS environments, version 1.275+. Have a look at our documentation to learn more about how to configure and deploy EdgeConnect. Once deployed, you can manage your EdgeConnect configuration in the Settings app under General > External requests.

We’d love to hear your feedback about EdgeConnect. Let us know your thoughts or share your ideas about how we can improve EdgeConnect in the future.

The post Dynatrace EdgeConnect securely connects your local systems to Dynatrace SaaS appeared first on Dynatrace news.

It’s Sunday morning, and you’re having breakfast with your family. A notification about new Common Vulnerability and Exposures (CVE) pops up on your mobile device. Is the situation critical? Do you need to react immediately? Will the right team, or at least someone accountable, take care of the vulnerability if you don’t?

This is the sort of thing that Operations horror stories are made of, where the hero needs to choose between rescuing the company and your end users or sacrificing sleep and—even worse—family time.

But this is not the case for you, thankfully. You took advantage of the launch of AutomationEngine, configured ownership information for all the monitored entities in your IT landscape, and set up workflows that automatically create tickets and route them to the responsible teams when security vulnerabilities are detected. And in case of emergencies, such as this situation, incidents are also escalated to you.

Sense, think, and then act

Let’s briefly recap. AutomationEngine leverages Dynatrace observability, security monitoring, and Davis® causal AI to deliver answers from data at an enormous scale. AutomationEngine can precisely react to threats within hybrid and multicloud ecosystems, whether this involves blocking a malicious attacker, scaling an EBS volume, or restarting a service.

AutomationEngine provides a low-code/no-code approach to model workflows for targeted notification and collaboration, closed-loop remediation, quality/security gating, and more. And while the ecosystem is continuously growing, there will be situations where you need to connect a bespoke system, implement an edge case that is yet to be made available, or you want to cover complex customer business logic to address your requirements. The good news is that Dynatrace has you covered with a highly extensible ecosystem.

In line 1 of the workflow shown above, ownership information and contact details are retrieved from affected entities to enrich the problem/vulnerability with additional metadata. Via a custom script, the workflow then matches the data with Snyk to enrich the workflow with additional security aspects and Slack notifications for critical vulnerabilities. Line 3 checks if a Jira ticket exists for the vulnerability. If so, the information is added to the ticket as a comment. Otherwise, a new ticket is created and routed to the responsible team. Finally, in the last line, an HTTP request is sent to an API to reconfigure your bespoke ordering system and temporarily deactivate a certain feature.

Slack channels can be dynamically defined by ownership information attached to a monitored entity. With Slack for workflows, you can send messages to multiple channels, post updates in threads, format messages, attach log files, and mark a thread with reactions, for example when a remediation task was successful.

Closed-loop functionality

Rather than a fire-and-forget functionality, Dynatrace Workflows provides closed-loop functionality that allows you to manage the lifecycle of an incident. With Jira transition status you can change the status or resolve a ticket, for example when a problem is closed. And since resolving issues often requires that additional fields be specified, you can add any mandatory fields to your workflow action.

Dynatrace provides three types of custom extensions to the Workflows ecosystem:

• HTTP calls: Trigger HTTP(S) calls to your bespoke system.
• JavaScript: Import SDKs and run your script within a workflow action.
• Custom apps: Write your own app to include any custom business logic and reusable workflow action.

Examples of each of these custom extension types are detailed below.

HTTP(S) call

HTTP(S) calls are available as a workflow action and allow you to insert any arbitrary API call. And in connection with Dynatrace EdgeConnect, you can trigger commands within your on-premises environment.

JavaScript

The JavaScript workflow action enables you to import SDKs and use your custom script within a workflow action. This powerful step provides boundless extension capabilities and allows you to code any business logic to access Dynatrace internal data or external systems.

Dynatrace^® Apps

Are you ready to level up? As soon as a desired business logic operates beyond one workflow step, Dynatrace provides you with a powerful platform to build your own app. Whether a beginner or a pro, Dynatrace Developer has the tools and support you need to create incredible apps with minimal effort, with an out-of-the-box design system, a beginner’s tutorial, sample apps for hands-on experience, and a strong community.

What’s next?

We are continuously enhancing the Dynatrace Workflow ecosystem, providing more feature-rich integrations into hyperscalers like AWS and workflow-template functionality with a broad repository across AIOps, DevOps, and Security, which will guide you through the first steps of AutomationEngine.

Conclusion

Try a Dynatrace free trial or request a demo to try out the new AutomationEngine. Check out the documentation and learn how to build apps. Go to the Dynatrace Launcher, invoke the search by pressing CTRL+K, and search for Workflow Automation Creator. This app will guide you interactively through the first steps of building an app. And If you’re looking for a certain third-party integration for automation that is currently missing, let us know by posting to the Dynatrace Community.

The post Benefit from easily extensible automation—from SaaS to the edge appeared first on Dynatrace news.

Cloud environments have become ever more complex, with an increasingly interconnected set of services. To tame this complexity and deliver differentiated digital experiences, IT, development, security, and business teams need automated workflows throughout these cloud ecosystems. But to be scalable, they also need low-code/no-code solutions that don’t require a lot of spin-up or engineering expertise.

IT leaders know that managing cloud environments through traditional manual monitoring practices will no longer suffice. According to recent Dynatrace data, 59% of CIOs say the increasing complexity of their technology stack could soon overload their teams without a more automated approach to IT operations and automated workflows.

Further, according to a Gartner® report, by 2025, 95% of decisions that currently use data will be at least partially automated.*

Development teams need automated workflows so they’re not stuck manually monitoring all stages of the software development lifecycle in their cloud environments. Similarly, security teams need to discover and automatically route security vulnerabilities to the right people to ensure prompt action. And operations teams need to forecast cloud infrastructure and compute resource requirements, then automatically provision resources to optimize digital customer experiences.

With the Dynatrace modern observability platform, teams can now use intuitive, low-code/no-code toolsets and causal AI to extend answer-driven automation for business, development and security workflows.

Low-code/no-code AutomationEngine fuels workflow automation

The Dynatrace platform brings modern observability and workflow automation to the fore.

With AutomationEngine, IT teams can now use their observability, security, and business data to automate workflows throughout hybrid and multicloud ecosystems.

For example, with AutomationEngine, teams can automate remediation and progressive delivery to continuously evaluate application performance against specific, measurable service-level objectives.

AutomationEngine also enables automated routing of security vulnerabilities to the proper teams while reducing false positives to ensure prompt action.

But automating workflows requires precise, accurate, and real-time answers from data that’s trustworthy.

This is the role of Dynatrace causal AI, fueled by Davis and topological mapping through Smartscape. With Davis and Smartscape, the Dynatrace platform provides teams with precise answers about the source of problems and incidents. Then, teams can use the AutomationEngine and its easy low-code/no-code interface to create automated workflows to enable various tasks that previously required manual work. An automated workflow, for example, might identify an application issue, send an alert to ServiceNow, generate a help desk ticket, and even trigger a remediation step.

All these tasks can take place seamlessly—ultimately resolving issues or identifying them proactively—and without needing to interrupt an engineer from a more strategic task.

Using Dynatrace AutomationEngine, teams can forecast future requirements and automate the provisioning of cloud infrastructure and compute resources to optimize the user experience. In addition, they can automatically route precise answers about performance and security anomalies to relevant teams to ensure action in a timely and efficient manner.

Bringing precise, answer-driven automation to observability, security, and business

As IT operations teams, security, DevOps, and others look to automate workflows, they need a solid platform foundation that enables data in context as well as provides precise and trustworthy answers.

To date, traditional observability tools ingest and process only partial data in silos which makes them ineffective to truly address application performance or security issues. Others lack causal AI to process data in full context that can actually pinpoint the root cause of problems.

With a data lakehouse, DevSecOps and business teams can aggregate, store, and centralize structured and unstructured data in one cost-efficient repository without predetermining which data is going to be necessary to generate insights in the future.

The Dynatrace Grail data lakehouse enables teams to ingest logs, metrics, traces, business events, and other data to get a full picture of their hybrid and multicloud environments. Because all the data is already contextualized and centralized, teams no longer have to manually sift through data and alerts to identify the team responsible for the problem. In turn, AutomationEngine uses this data in context to eliminate manual tasks and enable data-driven, automated workflows.

The low-code/no-code AutomationEngine brings several benefits to customers.

1. AutomationEngine enables user-friendly low-code/no-code automation

Even non-automation engineers can easily create ad-hoc automated workflows using a low-code/no-code interface. For example, teams can schedule a routine task or routing alerts with a visual drag-and-drop workflow creation experience. Operations teams can visualize their runbook automation as boxes and lines with flow logic for operational tasks. For example, using drag-and-drop on visual elements, teams can create an automation that queries a ticketing system like Jira or sends a Slack message to a specific person upon discovering an issue or vulnerability.

Cloud-native engineers benefit by creating GitOps-style automation-as-code and can evaluate Kubernetes events for faster issue remediation. And, ultimately, platform and site reliability engineers can provide answer-driven automation and higher-quality software with automated security and quality gates.

2. Tool consolidation reduces complexity

AutomationEngine reduces the number of home-grown tools teams need to rely on and improves the interoperability of ecosystem tools. As a result, it becomes easier to automate processes and reduce complexity. Further, AutomationEngine provides a centralized platform for managing and optimizing automation processes. This helps organizations chart a path to automation, improving efficiency and reducing the risk of errors or inconsistencies.

3. Compliance and data privacy are built into automated workflows

With AutomationEngine woven into the Dynatrace platform, it reduces the risk of sensitive data leaving the system. Further, all automated workflows are governed by an audit trail, access control, SSO, and security protection. This unburdens teams so they can concentrate on the actual automation task. Finally, a dedicated EdgeConnect component enables secure integrations for on-premises systems.

4. Answer-driven automation

When automation is based on false positives, it creates a situation of garbage in, garbage out. AutomationEngine is integrated within the Dynatrace platform, including Grail and Davis AI. Trustworthy, accurate answers and insights are a prerequisite for reliable security, business, and IT automation, especially when implementing feedback loop-based automation. This is true for workflow-based automation, as well as modern, event-driven cloud-native automation. With the ability to initiate and orchestrate automated actions throughout the ecosystem of collaboration—including ITSM, DevOps, and security tools–answer-driven automation delivers immediate and significant value to the organization.

In addition to the low-code/no-code AutomationEngine, Dynatrace announced a host of platform enhancements at Perform 2023 in Las Vegas. These enhancements further enable IT, DevOps, and security pros to move from data in context to insights on which they can execute with confidence, including the following:

• expanded Grail data lakehouse capabilities to enable new data types and graph analytics;
• a new user experience and interface and updated dashboards to more easily visualize trends;
• data Notebooks for petabyte-scale data exploration and analytics for real-time insights;
• AppEngine to create custom, compliant data-driven apps for answers and automation.

For more on AutomationEngine, visit our website.

_______________________________________

* ^{Gartner, “Emerging Tech: Venture Capital Growth Insights for Decision Intelligence Platforms,” Aakanksha Bansal, Alys Woodward, Akhil Singh, 10 February 2023.}

^{GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.}

The post How low-code/no-code AutomationEngine advances automated workflows appeared first on Dynatrace news.

Cloud environments—including multicloud, hybrid, and cloud-native ecosystems—offer unmatched agility, scalability, and cost-effectiveness, though they also present new challenges and complexities that are impossible to manage manually. As cloud environments become increasingly ubiquitous, so does the need for effective and efficient management.

Dynatrace integrates observability and security monitoring while leveraging causal AI to deliver answers and intelligent automation from data at an enormous scale. The Dynatrace platform provides real-time situational awareness of your cloud ecosystem to give you the confidence that your organization is operating as it should. With answer-driven automation powered by the new Dynatrace AutomationEngine, we’re releasing a solution that further extends our platform, putting answers into action, and empowering organizations to overcome cloud management challenges and unlock the full potential of their cloud strategy while reducing manual effort.

Context is king

Many modern enterprises suffer because their top technical talent is consumed with manual toil. According to the Global CIO Report 2022, 71% of CIOs say the explosion of data produced by cloud-native technology stacks is beyond human abilities to manage manually. Building effective and reliable systems is only possible with automation, which, in the past, proved difficult due to the following issues:

• Complexity of systems: The complexity of modern systems makes it difficult to gather all the necessary information to automate decision-making.
• Lack of standardization: The lack of standardization across tools and technologies makes it difficult to handle automation decisions and actions across different systems.
• Lack of data: In many cases, available data may not be enough to make informed decisions due to data silos, distribution, or negligence.
• Incorrect action on unreliable data: Automation systems without context-rich observability and security data often fail in pinpointing the best remediation actions to take, resulting in unwanted or incorrect reactions, as well as false-positive and false-negative alerts.
• Evolving threats: New security threats and vulnerabilities are constantly emerging. This makes it difficult for pure rule-based automation systems to adapt to new threats and vulnerabilities in real time.
• Primitive safety nets: Having no real-time automation feedback loop results in additional toil and escalation actions.

With the introduction of AutomationEngine, the Dynatrace platform has overcome these automation challenges

Dynatrace enables full observability by supporting open-source tools, as well as Dynatrace OneAgent and other data-ingest methods in enriching the classic observability pillars of metrics, traces, and logs with topology, user behavior, security, metadata, and network data. Dynatrace Davis® AI integrates all this context-rich data to provide answers within complex, multi-level systems and environments.

Extending the platform with Dynatrace AutomationEngine unlocks the power to combine observability, security, and business data with causal AI to easily automate BizDevSecOps workflows at enterprise scale.

Automate what matters

Extending the Dynatrace platform natively with AutomationEngine leads to causal-AI-powered, answer-driven automation. This helps organizations to achieve proactive prevention, efficient operation, faster remediation, strong protection, and business acceleration. Use cases include but are not limited to:

• Targeted notification and collaboration: connect the right teams and equip them with answers in real-time
• Closed-loop remediation: automatically remediate problems and vulnerabilities
• Quality and security gating: block vulnerabilities and regressions before they reach production
• Continuous vulnerability assessment: detect zero-day vulnerabilities
• Predictive automation: take maintenance measures before risking a potential failure
• Progressive delivery orchestration: orchestrate releases based on user and system feedback
• Intelligent infrastructure and application orchestration: auto-scale and resize smarter load distributions
• Preventive security configurations: block malicious IPs based on known attack patterns

Dynatrace Workflows, powered by AutomationEngine, puts automation use cases at your fingertips. Every automated workflow consists of easy configuration, extensive trigger options, out-of-the-box actions and integrations, and unprecedented extensibility by leveraging webhooks, JavaScript code, and application actions powered by AppEngine.

Easy workflow creation and maintenance

Workflow creation and maintenance at scale

Another way to ensure always up-to-date workflows and automation at scale, teams can use the automation-as-code approach available with Dynatrace’ own configuration as code solution named Monaco. By shifting your automation configuration left, Monaco moves automation definition closer to not only your source code, but also your testing, observability, security, and remediation capabilities. Automation-as-code allows for powerful and concise automation across the full software development lifecycle. Another big advantage of automation-as-code is the scale at which automation is enabled. By following a programmatical approach, developers, DevOps and SREs benefit from a single source of truth and streamlined collaboration. This helps to eliminate outdated manual runbooks, which are inevitably fail.

Proactive automation

You can configure a variety of event triggers  to initiate custom workflows based on your needs:

• On-demand trigger: manual execution of an otherwise tedious chain of tasks, for example, audit automation
• API-based trigger: direct calls embedded into existing toolchains, for example, pipeline integration
• Schedule-based trigger: scheduled execution of recurring tasks, for example, reporting
• Problem, security, or Davis event-based trigger: Davis causal-AI triggered actions that reduce mean time to repair (MTTR), for example, problem remediation
• Dynatrace Query Language (DQL) event-filter trigger: results of event filters applied to the observability, security, and business data in Dynatrace to trigger actions based on certain event types, for example, deployments of a specific service

Boundless automation

Every workflow consists of several tasks that can be executed or skipped based on the conditions of previous tasks, retried based on error logic, or looped to iterate over lists. To enable this, workflows are aware of variables and context and can execute DQL queries in real-time. Besides executing actions within the Dynatrace platform itself, Dynatrace AutomationEngine allows the safe triggering of actions to both cloud services and—by leveraging Dynatrace EdgeConnect—on-premises services. Dynatrace provides an ever-growing ecosystem of deep, out-of-the-box, third-party integrations that connect automation with collaboration, ITSM, AIOps, DevOps, and security tools.

For truly limitless automation capabilities, Dynatrace Workflows can issue HTTP requests to any API and execute custom Javascript code. By leveraging Dynatrace AppEngine, any application can publish universally-available actions for all workflows, thereby extending custom logic to automated workflows. This automation context, embedded into every app, unlocks even more automation use cases.

Dynatrace AutomationEngine leverages platform-wide event triggers and timezone-aware schedules with dynamic recurrence rules. It allows custom flow logic and parallel task execution with automatic retry, and can be configured-as-code, all to accommodate the complexities of global enterprises.

What’s next?

Interested and want to learn more? The new Dynatrace user experience, including the newly developed AutomationEngine, will be available within 90 days. In the meantime, watch out for upcoming Dynatrace Observability Clinics and live “Ask me anything” sessions covering the main topics of this blog post. You can see a list of the next webinars on our website or follow us on LinkedIn to stay up-to-date with upcoming announcements and activities.

The AutomationEngine actions and integrations ecosystem are being continuously developed and extended. If you’re looking for a certain third-party integration for automation that is currently missing, let us know by posting to the Dynatrace Community.

The post AutomationEngine tames cloud complexity with answer-driven automation appeared first on Dynatrace news.