Back to Details

dt-obs-log-semantic-mapping

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

dt-obs-log-semantic-mapping

dt-obs-log-semantic-mapping

Build and validate semantic-dictionary-aligned mappings for audit log integrations.
构建并验证与语义字典对齐的审计日志集成映射。

Purpose

用途

Use this skill when a user wants to:
  • Suggest a mapping from a raw vendor audit log payload to Dynatrace 
    fetch logs
    fields (Workflow A).
  • Validate a mapping against a pasted ingested log event (Workflow B1 — static).
  • Validate against live tenant data via live tenant access (Workflow B2 — runtime: fetches logs by 
    log.source
    , then runs B1 on the result).
当用户需要以下操作时，可使用此技能：
  • 建议从原始供应商审计日志负载到Dynatrace 
    fetch logs
    字段的映射（工作流A）。
  • 验证粘贴的已摄入日志事件对应的映射（工作流B1 — 静态验证）。
  • 验证通过实时租户访问获取的实时租户数据对应的映射（工作流B2 — 运行时验证：通过
    log.source
    获取日志，然后对结果执行工作流B1）。

Log Classes

日志类别

ClassDescriptionKey namespacesExample sources
authentication
Login, logout, MFA, token
audit.*
, 
actor.*
, 
browser.*
, 
device.*
CyberArk, Okta, Azure SignInLogs
authorization
Access decisions, permission changes
audit.*
, 
actor.*
, 
object.*
CyberArk, Okta
user_action
CRUD on platform resources
audit.*
, 
actor.*
, 
object.*
, 
product.*
Okta, GitHub, Sonatype
http
HTTP request/response (WAF, network devices)
http.*
, 
url.*
, 
server.*
, 
geo.*
, 
client.*
Akamai SIEM, Cloudflare
类别描述键命名空间示例来源
authentication
登录、登出、多因素认证（MFA）、令牌
audit.*
, 
actor.*
, 
browser.*
, 
device.*
CyberArk, Okta, Azure SignInLogs
authorization
访问决策、权限变更
audit.*
, 
actor.*
, 
object.*
CyberArk, Okta
user_action
平台资源的增删改查（CRUD）操作
audit.*
, 
actor.*
, 
object.*
, 
product.*
Okta, GitHub, Sonatype
http
HTTP请求/响应（Web应用防火墙、网络设备）
http.*
, 
url.*
, 
server.*
, 
geo.*
, 
client.*
Akamai SIEM, Cloudflare

Workflows

工作流

ModeInputSource
Workflow A — Suggest mappingRaw vendor log payload
references/mapping-workflow.md § Workflow A
Workflow B1 — Static validationPasted ingested log event
references/mapping-workflow.md § Workflow B1
Workflow B2 — Runtime validation
log.source
value + live tenant access
references/runtime-validation.md
— fetches logs, then runs B1
模式输入来源
工作流A — 建议映射原始供应商日志负载
references/mapping-workflow.md § 工作流A
工作流B1 — 静态验证粘贴的已摄入日志事件
references/mapping-workflow.md § 工作流B1
工作流B2 — 运行时验证
log.source
值 + 实时租户访问权限
references/runtime-validation.md
— 获取日志，然后执行工作流B1

Key Concepts

核心概念

Content field burial: The primary validation concern. Fields in 
content
(the raw vendor payload) that could be promoted to top-level semantic attributes but are not. The skill always inventories buried vs promoted fields and proposes OpenPipeline extraction rules to fix gaps.
Prerequisite: When proposing OpenPipeline processor extraction rules, load the 
dt-dql-essentials
skill first. OpenPipeline processors use DQL functions (
parse
, 
fieldsAdd
, 
splitString
, etc.) — using non-DQL syntax produces invalid rules.
Sparse mappings are valid: Integrations like GitHub or Sonatype may only populate core fields. Minimum required: 
timestamp
, 
log.source
, 
content
, 
loglevel
, 
audit.action
, 
audit.identity
.
内容字段埋藏： 这是主要的验证关注点。
content
（原始供应商负载）中可提升为顶级语义属性但未被提升的字段。本技能会始终清点已埋藏和已提升的字段，并提出OpenPipeline提取规则来填补差距。
前置条件： 在提出OpenPipeline处理器提取规则前，需先加载
dt-dql-essentials
技能。OpenPipeline处理器使用DQL函数（
parse
、
fieldsAdd
、
splitString
等）—— 使用非DQL语法会生成无效规则。
稀疏映射是有效的： 像GitHub或Sonatype这类集成可能仅填充核心字段。最低必填字段：
timestamp
、
log.source
、
content
、
loglevel
、
audit.action
、
audit.identity
。

References

参考资料

  • references/data-model-notes.md
    — Log SD field taxonomy, audit namespace, enums, sample-derived patterns and known discrepancies
  • references/mapping-workflow.md
    — Intake checklist, Workflow A and B1 procedures, content field analysis, field priority order
  • references/validation-rules.md
    — Required fields, content/enum/type rules, discrepancy severity
  • references/openpipeline-constraints.md
    — OpenPipeline processor command/function/operator/matcher restrictions; 
    parseJson
    unavailability + 
    parse
    →
    fieldsFlatten
    alternative; iterative operators for array casting
  • references/report-format.md
    — Mapping table, diff table, OpenPipeline sketch, Validation Summary templates
  • references/runtime-validation.md
    — Workflow B2: fetch live records, then run B1
  • samples/audit-logs.json
    — Mapped samples: CyberArk, Okta, Azure SignInLogs, Sonatype, GitHub
  • samples/http-logs.json
    — Mapped samples: Akamai SIEM (WAF/HTTP class)
  • Dynatrace Log Semantic Dictionary
  • references/data-model-notes.md
    — 日志SD字段分类、审计命名空间、枚举、样本衍生模式及已知差异
  • references/mapping-workflow.md
    — 摄入检查清单、工作流A和B1流程、内容字段分析、字段优先级顺序
  • references/validation-rules.md
    — 必填字段、内容/枚举/类型规则、差异严重程度
  • references/openpipeline-constraints.md
    — OpenPipeline处理器命令/函数/运算符/匹配器限制；
    parseJson
    不可用的替代方案
    parse
    →
    fieldsFlatten
    ；数组转换的迭代运算符
  • references/report-format.md
    — 映射表、差异表、OpenPipeline草图、验证摘要模板
  • references/runtime-validation.md
    — 工作流B2：获取实时记录，然后执行工作流B1
  • samples/audit-logs.json
    — 已映射样本：CyberArk、Okta、Azure SignInLogs、Sonatype、GitHub
  • samples/http-logs.json
    — 已映射样本：Akamai SIEM（WAF/HTTP类别）
  • Dynatrace 日志语义字典