dynatrace/dynatrace-for-ai
Suggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events.
npx skills add dynatrace/dynatrace-for-ai --skill dt-obs-log-semantic-mapping
Related neighbors and high-traction skills in the same topics — useful to compare before installing.
Guidance for distinctive, intentional visual design when building new UI or reshaping an existi…
866.4K installsBrowser automation CLI for AI agents. Use when the user needs to interact with websites, includ…
810.4K installsReview UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "chec…
617.3K installsBuild, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and …
576.5K installsDebug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe …
568.9K installsOther skills from dynatrace/dynatrace-for-ai · top by installs.
npx skills add dynatrace/dynatrace-for-ai
Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.
main
Parsed from SKILL.md frontmatter.
Files included with this skill beyond the listing page.
SKILL.md
3,895 B
SUMMARY.md
465 B
Build and validate semantic-dictionary-aligned mappings for audit log integrations.
Use this skill when a user wants to:
fetch logs fields (Workflow A).log.source, then runs B1 on the result).| Class | Description | Key namespaces | Example sources |
|---|---|---|---|
authentication |
Login, logout, MFA, token | audit., actor., browser., device. |
CyberArk, Okta, Azure SignInLogs |
authorization |
Access decisions, permission changes | audit., actor., object.* |
CyberArk, Okta |
user_action |
CRUD on platform resources | audit., actor., object., product. |
Okta, GitHub, Sonatype |
http |
HTTP request/response (WAF, network devices) | http., url., server., geo., client.* |
Akamai SIEM, Cloudflare |
| Mode | Input | Source |
|---|---|---|
| Workflow A — Suggest mapping | Raw vendor log payload | references/mapping-workflow.md § Workflow A |
| Workflow B1 — Static validation | Pasted ingested log event | references/mapping-workflow.md § Workflow B1 |
| Workflow B2 — Runtime validation | log.source value + live tenant access |
references/runtime-validation.md — fetches logs, then runs B1 |
Content field burial: The primary validation concern. Fields in content (the raw vendor payload) that could be promoted to top-level semantic attributes but are not. The skill always inventories buried vs promoted fields and proposes OpenPipeline extraction rules to fix gaps.
Prerequisite: When proposing OpenPipeline processor extraction rules, load the
dt-dql-essentialsskill first. OpenPipeline processors use DQL functions (parse,fieldsAdd,splitString, etc.) — using non-DQL syntax produces invalid rules.
Sparse mappings are valid: Integrations like GitHub or Sonatype may only populate core fields. Minimum required: timestamp, log.source, content, loglevel, audit.action, audit.identity.
references/data-model-notes.md — Log SD field taxonomy, audit namespace, enums, sample-derived patterns and known discrepanciesreferences/mapping-workflow.md — Intake checklist, Workflow A and B1 procedures, content field analysis, field priority orderreferences/validation-rules.md — Required fields, content/enum/type rules, discrepancy severityreferences/openpipeline-constraints.md — OpenPipeline processor command/function/operator/matcher restrictions; parseJson unavailability + parse→fieldsFlatten alternative; iterative operators for array castingreferences/report-format.md — Mapping table, diff table, OpenPipeline sketch, Validation Summary templatesreferences/runtime-validation.md — Workflow B2: fetch live records, then run B1samples/audit-logs.json — Mapped samples: CyberArk, Okta, Azure SignInLogs, Sonatype, GitHubsamples/http-logs.json — Mapped samples: Akamai SIEM (WAF/HTTP class)