Dynatrace Software Intelligence Platform with Microsoft Sentinel

Solution: Dynatrace

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index

Attribute	Value
Publisher	Dynatrace
Support Tier	Partner
Support Link	https://www.dynatrace.com/services-support/
Categories	Security - Others,IT Operations,DevOps,Migration,Security - Threat Protection,Security - Vulnerability Management
Version	3.0.4
Author	Dynatrace - microsoftalliances@dynatrace.com
First Published	2022-10-18
Last Updated	2026-05-08
Solution Folder	Dynatrace
Marketplace	Azure Marketplace · Popularity: ⚪ Very Low (8%)

Dynatrace is a leading observability platform that provides automatic and intelligent observability at scale for cloud-native and enterprise workloads; with Dynatrace Application Security, your DevSecOps teams can resolve security issues faster, accelerating software delivery. Integrating Dynatrace with Microsoft Sentinel enables DevSecOps teams to detect, prioritize, triage, and remediate attacks rapidly. DevSecOps teams benefit from the high-accuracy threat signals Dynatrace surfaces. It helps them avoid time-consuming investigation activities, freeing them up for more critical tasks. Microsoft Sentinel data connectors poll Dynatrace for new attacks, vulnerabilities, audit logs, and problem events.

Included data connectors:

Attacks, Common attacks on application layer vulnerabilities which can be detected and blocked using Dynatrace, like SQL injection, command injection, and JNDI attacks.
Runtime vulnerabilities, Software vulnerabilities detected throughout all layers of the application stack.
Audit logs, Security-relevant events for a Dynatrace tenant.
Problems, AI-powered observability problems raised across cloud and hybrid environments.

Learn More about Dynatrace | Dynatrace Docs

Underlying Microsoft Technologies used:

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

a. Microsoft Sentinel

b. Azure Logic Apps

Data Connectors
Tables Used
Content Items

Data Connectors

This solution provides 12 data connector(s):

Tables Used

This solution uses 13 table(s):

Table	Used By Connectors	Used By Content
`DynatraceAttacksV2_CL`	Dynatrace Attacks V2, [Deprecated] Dynatrace Attacks V1	Analytics, Workbooks
`DynatraceAttacksV3_CL`	Dynatrace Attacks V3, [Deprecated] Dynatrace Attacks V1	Analytics, Workbooks
`DynatraceAttacks_CL`	[Deprecated] Dynatrace Attacks V1	Analytics, Workbooks
`DynatraceAuditLogsV2_CL`	Dynatrace Audit Logs V2, [Deprecated] Dynatrace Audit Logs V1	Workbooks
`DynatraceAuditLogsV3_CL`	Dynatrace Audit Logs V3, [Deprecated] Dynatrace Audit Logs V1	Workbooks
`DynatraceAuditLogs_CL`	[Deprecated] Dynatrace Audit Logs V1	Workbooks
`DynatraceProblemsV2_CL`	Dynatrace Problems V2, [Deprecated] Dynatrace Problems V1	Analytics, Workbooks
`DynatraceProblemsV3_CL`	Dynatrace Problems V3, [Deprecated] Dynatrace Problems V1	Analytics, Workbooks
`DynatraceProblems_CL`	[Deprecated] Dynatrace Problems V1	Analytics, Workbooks
`DynatraceSecurityProblemsV2_CL`	Dynatrace Runtime Vulnerabilities V2, [Deprecated] Dynatrace Runtime Vulnerabilities V1	Analytics, Workbooks
`DynatraceSecurityProblemsV3Raw_CL`	Dynatrace Runtime Vulnerabilities V3	Summary Rule
`DynatraceSecurityProblemsV3_CL`	Dynatrace Runtime Vulnerabilities V3, [Deprecated] Dynatrace Runtime Vulnerabilities V1	Analytics, Workbooks
`DynatraceSecurityProblems_CL`	[Deprecated] Dynatrace Runtime Vulnerabilities V1	Analytics, Workbooks

Internal Tables

The following 1 table(s) are used internally by this solution's content items:

Table	Used By Connectors	Used By Content
`SecurityAlert`	-	Playbooks

Content Items

This solution includes 19 content item(s):

Content Type	Count
Playbooks	7
Analytic Rules	5
Parsers	4
Summary Rule	2
Workbooks	1

Analytic Rules

Name	Severity	Tactics	Tables Used
Dynatrace - Problem detection	Informational	DefenseEvasion, Execution, Impact, InitialAccess, LateralMovement, Persistence, PrivilegeEscalation	`DynatraceProblemsV2_CL` `DynatraceProblemsV3_CL` `DynatraceProblems_CL`
Dynatrace Application Security - Attack detection	High	Execution, Impact, InitialAccess, PrivilegeEscalation	`DynatraceAttacksV2_CL` `DynatraceAttacksV3_CL` `DynatraceAttacks_CL`
Dynatrace Application Security - Code-Level runtime vulnerability detection	Medium	DefenseEvasion, Execution, Impact, InitialAccess, LateralMovement, Persistence, PrivilegeEscalation	`DynatraceSecurityProblemsV2_CL` `DynatraceSecurityProblemsV3_CL` `DynatraceSecurityProblems_CL`
Dynatrace Application Security - Non-critical runtime vulnerability detection	Informational	DefenseEvasion, Execution, Impact, InitialAccess, LateralMovement, Persistence, PrivilegeEscalation	`DynatraceSecurityProblemsV2_CL` `DynatraceSecurityProblemsV3_CL` `DynatraceSecurityProblems_CL`
Dynatrace Application Security - Third-Party runtime vulnerability detection	Medium	DefenseEvasion, Execution, Impact, InitialAccess, LateralMovement, Persistence, PrivilegeEscalation	`DynatraceSecurityProblemsV2_CL` `DynatraceSecurityProblemsV3_CL` `DynatraceSecurityProblems_CL`

Workbooks

Name	Tables Used
Dynatrace	`DynatraceAttacksV2_CL` `DynatraceAttacksV3_CL` `DynatraceAttacks_CL` `DynatraceAuditLogsV2_CL` `DynatraceAuditLogsV3_CL` `DynatraceAuditLogs_CL` `DynatraceProblemsV2_CL` `DynatraceProblemsV3_CL` `DynatraceProblems_CL` `DynatraceSecurityProblemsV2_CL` `DynatraceSecurityProblemsV3_CL` `DynatraceSecurityProblems_CL`

Playbooks

Name	Description	Tables Used
Add Dynatrace Application Security Attack Source IP Address to Threat Intelligence (STIX)	This playbook will add an attacker's source IP address to Microsoft Sentinel Threat Intelligence as ...	-
Enrich Dynatrace Application Security Attack Incident	This playbook will enriche Dynatrace Application Security Attack Incidents with additional informati...	-
Enrich Dynatrace Application Security Attack with related Microsoft Defender XDR insights	This playbook will enrich Dynatrace Application Security Attack with related Microsoft Defender XDR ...	Internal use: `SecurityAlert` (read)
Enrich Dynatrace Application Security Attack with related Microsoft Sentinel Security Alerts	This playbook will enrich Dynatrace Application Security Attack with related Microsoft Sentinel Secu...	Internal use: `SecurityAlert` (read)
Ingest Microsoft Defender XDR insights into Dynatrace	This playbook will ingest Microsoft Defender XDR insights into Dynatrace.	-
Ingest Microsoft Sentinel Security Alerts into Dynatrace	This playbook will ingest Microsoft Sentinel Security Alerts into Dynatrace.	-
[Deprecated] Add Dynatrace Application Security Attack Source IP Address to Threat Intelligence	NOTE: This playbook is deprecated and will be removed in a future version. The Microsoft Graph Secur...	-

Parsers

Name	Description	Tables Used
DynatraceAttacks	-	`DynatraceAttacksV2_CL` (read) `DynatraceAttacksV3_CL` (read) `DynatraceAttacks_CL` (read)
DynatraceAuditLogs	-	`DynatraceAuditLogsV2_CL` (read) `DynatraceAuditLogsV3_CL` (read) `DynatraceAuditLogs_CL` (read)
DynatraceProblems	-	`DynatraceProblemsV2_CL` (read) `DynatraceProblemsV3_CL` (read) `DynatraceProblems_CL` (read)
DynatraceSecurityProblems	-	`DynatraceSecurityProblemsV2_CL` (read) `DynatraceSecurityProblemsV3_CL` (read) `DynatraceSecurityProblems_CL` (read)

Summary Rule

Name	Description	Tables Used
Consolidate_DynatraceRuntimeVulnerabilities	Collapses raw Dynatrace runtime vulnerability events into one current-state row per vulnerability, a...	`DynatraceSecurityProblemsV3Raw_CL` (read)
Consolidate_DynatraceRuntimeVulnerabilities	Collapses raw Dynatrace runtime vulnerability events into one current-state row per vulnerability, a...	`DynatraceSecurityProblemsV3Raw_CL` (read)

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.4	30-06-2026	Added V3 data connectors (DynatraceRuntimeVulnerabilitiesV3, DynatraceAttacksV3, DynatraceAuditLogsV3, DynatraceProblemsV3) using the Dynatrace Grail DQL Storage Query API with platform token authentication. Updated parsers (v3.0.0) to union V1, V2, and V3 sources. Added STIX 2.1 threat intelligence playbook (replaces deprecated tiIndicators playbook). Fixed TimeGenerated in DynatraceRuntimeVulnerabilitiesV3 DCR to use source event timestamp. Fixed AttackIdentifier casing in playbooks. Marked V1 connectors as deprecated.
3.0.3	28-04-2026	Fixed timestamp type mismatch in Parsers (DynatraceAttacks, DynatraceAuditLogs, DynatraceProblems, DynatraceSecurityProblems): V1 Unix epoch millisecond fields now converted to datetime, resolving duplicate typed columns in query results. Marked Add_DynatraceApplicationSecurityAttackSourceIpThreatIntelligence playbook as deprecated due to the deprecation of the Microsoft Graph Security tiIndicators API and its connector in Logic Apps.
3.0.2	02-04-2026	Added DCR based connectors.
3.0.1	18-01-2024	Changes for rebranding from Microsoft 365 Defender to Microsoft Defender XDR, Updated user-agent strings used when calling Dynatrace REST API's, Added new Entity Mappings to Analytic Rules Aligned Playbook, Data Connector & Workbook version numbers with rest of solution.
3.0.0	16-10-2023	Enabled new api paging mode on Data Connector to fix issues related to polling Dynatrace REST API's with a large number of results.