Dt obs log semantic mapping
Skill Dynatrace/dynatrace-for-ai/skills/dt-obs-log-semantic-mapping
Skills, prompts, and instructions for building AI agents on top of Dynatrace production context
npx -y skills add Dynatrace/dynatrace-for-ai --skill dt-obs-log-semantic-mappingAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Suggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events. Use when: mapping a vendor audit log feed, authentication logs, user activity logs to the Dynatrace SD; checking required semantic fields; proposing OpenPipeline processor extraction rules based on DQL; running runtime validation (fetches live logs by log.source, then applies static validation).
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.8 KB, as published. Nobody here has run it
dt-obs-log-semantic-mapping
Build and validate semantic-dictionary-aligned mappings for audit log integrations.
Purpose
Use this skill when a user wants to:
- Suggest a mapping from a raw vendor audit log payload to Dynatrace
fetch logsfields (Workflow A). - Validate a mapping against a pasted ingested log event (Workflow B1 — static).
- Validate against live tenant data via live tenant access (Workflow B2 — runtime: fetches logs by
log.source, then runs B1 on the result).
Log Classes
| Class | Description | Key namespaces | Example sources |
|---|---|---|---|
authentication | Login, logout, MFA, token | audit.*, actor.*, browser.*, device.* | CyberArk, Okta, Azure SignInLogs |
authorization | Access decisions, permission changes | audit.*, actor.*, object.* | CyberArk, Okta |
user_action | CRUD on platform resources | audit.*, actor.*, object.*, product.* | Okta, GitHub, Sonatype |
http | HTTP request/response (WAF, network devices) | http.*, url.*, server.*, geo.*, client.* | Akamai SIEM, Cloudflare |
Workflows
| Mode | Input | Source |
|---|---|---|
| Workflow A — Suggest mapping | Raw vendor log payload | references/mapping-workflow.md § Workflow A |
| Workflow B1 — Static validation | Pasted ingested log event | references/mapping-workflow.md § Workflow B1 |
| Workflow B2 — Runtime validation | log.source value + live tenant access | references/runtime-validation.md — fetches logs, then runs B1 |
Key Concepts
Content field burial: The primary validation concern. Fields in content (the raw vendor payload) that could be promoted to top-level semantic attributes but are not. The skill always inventories buried vs promoted fields and proposes OpenPipeline extraction rules to fix gaps.
Prerequisite: When proposing OpenPipeline processor extraction rules, load the
dt-dql-essentialsskill first. OpenPipeline processors use DQL functions (parse,fieldsAdd,splitString, etc.) — using non-DQL syntax produces invalid rules.
Sparse mappings are valid: Integrations like GitHub or Sonatype may only populate core fields. Minimum required: timestamp, log.source, content, loglevel, audit.action, audit.identity.
References
references/data-model-notes.md— Log SD field taxonomy, audit namespace, enums, sample-derived patterns and known discrepanciesreferences/mapping-workflow.md— Intake checklist, Workflow A and B1 procedures, content field analysis, field priority orderreferences/validation-rules.md— Required fields, content/enum/type rules, discrepancy severityreferences/openpipeline-constraints.md— OpenPipeline processor command/function/operator/matcher restrictions;parseJsonunavailability +parse→fieldsFlattenalternative; iterative operators for array castingreferences/report-format.md— Mapping table, diff table, OpenPipeline sketch, Validation Summary templatesreferences/runtime-validation.md— Workflow B2: fetch live records, then run B1samples/audit-logs.json— Mapped samples: CyberArk, Okta, Azure SignInLogs, Sonatype, GitHubsamples/http-logs.json— Mapped samples: Akamai SIEM (WAF/HTTP class)- Dynatrace Log Semantic Dictionary