dt-sec-contextualization

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Security Contextualization Skill

安全情境化Skill

Resolve security signals and entity attribute sets to runtime Dynatrace Smartscape entities, summarize findings across entity levels, and connect signals that land on different levels (e.g. a detection on a

K8S_POD

vs. a CVE on a

KUBERNETES_NODE

) via a shared runtime entity.

将安全信号和实体属性集解析为运行时Dynatrace Smartscape实体，汇总跨实体层级的发现内容，并通过共享运行时实体连接落在不同层级的信号（例如

K8S_POD

上的检测与

KUBERNETES_NODE

上的CVE）。

What This Skill Covers

本Skill涵盖内容

Identity → Smartscape mapping — given a row carrying any of
```
dt.smartscape_source.id
```
,
```
container_image.digest
```
,
```
container_image.id
```
,
```
host.ip
```
,
```
dt.entity.*
```
, or
```
k8s.*
```
fields, resolve it to a Smartscape entity at any requested level (CONTAINER / K8S_POD / workload / K8S_NODE / HOST / cloud /
```
GENAI_SERVICE
```
— AI/GenAI workloads).
Artifact → runtime bridge —
```
container_image.digest
```
→
```
smartscapeNodes CONTAINER
```
→
```
is_part_of.*
```
→ parent workload or
```
runs_on.host
```
→ HOST. Works without pre-enriched
```
dt.smartscape_source.id
```
.
Cross-level correlation — tiered entity matching to determine whether two findings (e.g. a detection and a CVE from different legs) relate through a shared runtime entity. Tier 1: exact entity id match; Tier 2: same workload/pod/host by name; Tier 3: same namespace/cluster (context-only — does not contribute to scoring).
Pod → node topology — resolve
```
K8S_POD
```
to its
```
K8S_NODE
```
via
```
k8s.node.name
```
(co-projected field) or Smartscape edge traversal. Enables "detection hit pod X — does that pod run on a vulnerable node?"
Coverage match recipes — 2-way and 3-way container→workload match patterns shared across dt-sec-insights coverage counting queries.
Entity enrichment — given findings, IoC matches, or raw Smartscape nodes, produce per-entity risk-level breakdowns and entity-key bundles for downstream scoring.
IoC enrichment — attribute an already-matched IoC (IP / domain / URL / email / CVE / hash / MITRE TTP) with adversary context (actor, malware family, MITRE technique, targeting, provider) by reverse-looking-up the ingested
```
THREAT_REPORT
```
events whose observable arrays contain that IoC.

身份→Smartscape映射 — 给定包含
```
dt.smartscape_source.id
```
、
```
container_image.digest
```
、
```
container_image.id
```
、
```
host.ip
```
、
```
dt.entity.*
```
或
```
k8s.*
```
字段的行，将其解析为任意请求层级的Smartscape实体（CONTAINER / K8S_POD / 工作负载 / K8S_NODE / HOST / 云 /
```
GENAI_SERVICE
```
— AI/生成式AI工作负载）。
工件→运行时桥接 —
```
container_image.digest
```
→
```
smartscapeNodes CONTAINER
```
→
```
is_part_of.*
```
→ 父工作负载或
```
runs_on.host
```
→ HOST。无需预富集的
```
dt.smartscape_source.id
```
即可工作。
跨层级关联 — 分层实体匹配，以确定两个发现（例如来自不同分支的检测和CVE）是否通过共享运行时实体相关联。层级1：精确实体ID匹配；层级2：同名工作负载/Pod/主机；层级3：同命名空间/集群（仅上下文 — 不影响评分）。
Pod→节点拓扑 — 通过
```
k8s.node.name
```
（共投影字段）或Smartscape边缘遍历将
```
K8S_POD
```
解析为其对应的
```
K8S_NODE
```
。支持“检测命中Pod X — 该Pod是否运行在存在漏洞的节点上？”这类场景。
覆盖匹配规则 — dt-sec-insights覆盖计数查询中共享的双向和三向容器→工作负载匹配模式。
实体富集 — 给定发现内容、IoC匹配项或原始Smartscape节点，生成每个实体的风险等级细分和实体密钥包，用于下游评分。
IoC富集 — 通过反向查找可观测数组中包含该IoC的已摄入
```
THREAT_REPORT
```
事件，为已匹配的IoC（IP / 域名 / URL / 邮箱 / CVE / 哈希 / MITRE TTP）添加攻击者上下文（攻击者、恶意软件家族、MITRE技术、攻击目标、提供商）。

When to Use This Skill

使用场景

Intent / trigger	Reference
Map findings / IoC matches to workloads, hosts, or cloud entities	`identity-mapping.md` -> `entity-enrichment.md`
Which Smartscape entity does this container image / digest run as?	`identity-mapping.md` § Mapping Primitive (Path 2 - container digest)
Do this detection and this CVE relate via a shared entity?	`correlation-and-coverage.md` § Correlation
Pod X fired - does it run on a vulnerable node?	`correlation-and-coverage.md` § Correlation (Pod->Node Topology)
Per-entity risk summary (Critical/High/Medium/Low)	`entity-enrichment.md`
Coverage match recipe - which workloads are covered by product Y?	`correlation-and-coverage.md` § Coverage
Which entity-identity fields are relevant to a finding type?	`identity-mapping.md` § Data Model
Enrich a matched IoC (IP/domain/hash/CVE/...) with threat-report adversary context	`ioc-enrichment.md`
Scope findings to AI/GenAI workloads; which processes belong to an AI service; resolve a process to its AI service	`identity-mapping.md` § Mapping Primitive (Path 4 - `GENAI_SERVICE -> SERVICE -> PROCESS` )

意图 / 触发词	参考文档
将发现内容/IoC匹配项映射到工作负载、主机或云实体	`identity-mapping.md` -> `entity-enrichment.md`
此容器镜像/摘要以哪个Smartscape实体运行？	`identity-mapping.md` § 映射原语（路径2 - 容器摘要）
此检测和此CVE是否通过共享实体关联？	`correlation-and-coverage.md` § 关联
Pod X触发告警 - 它是否运行在存在漏洞的节点上？	`correlation-and-coverage.md` § 关联（Pod->Node拓扑）
每个实体的风险摘要（Critical/High/Medium/Low）	`entity-enrichment.md`
覆盖匹配规则 - 哪些工作负载被产品Y覆盖？	`correlation-and-coverage.md` § 覆盖
哪些实体身份字段与发现类型相关？	`identity-mapping.md` § 数据模型
为已匹配的IoC（IP/域名/哈希/CVE/...）添加威胁报告的攻击者上下文	`ioc-enrichment.md`
将发现范围限定为AI/生成式AI工作负载；哪些进程属于AI服务；将进程解析为其对应的AI服务	`identity-mapping.md` § 映射原语（路径4 - `GENAI_SERVICE -> SERVICE -> PROCESS` ）

How This Skill Is Organized

本Skill的组织方式

SKILL.md (this file) — entry point and routing.
references/
- identity-mapping.md — generalized identity->Smartscape resolver (mapping primitive Paths 1/2/3/4), pre-flight identifier checks, level selection, and entity-identity field guidance.
- entity-enrichment.md — consumers of the mapping primitive: cloud (Path 1), K8s workload (3-way), host-by-IP, host-by-entity, natural-language fallback, problem->entities->findings chain. Per-entity risk-level breakdowns (Critical/High/Medium/Low).
- correlation-and-coverage.md — cross-level entity convergence, pod->node topology resolution, scoring contract, and 2-way/3-way coverage match recipes shared with dt-sec-insights.
- ioc-enrichment.md — reverse-lookup IoC enrichment: attribute a matched IoC to ingested
```
THREAT_REPORT
```
  events and surface adversary context (actor / malware / MITRE / targeting). Single and batch (per-IoC) templates; supported-IoC taxonomy.

SKILL.md（本文档） — 入口点和路由说明。
references/
- identity-mapping.md — 通用身份→Smartscape解析器（映射原语路径1/2/3/4）、预飞检查标识符、层级选择和实体身份字段指南。
- entity-enrichment.md — 映射原语的消费者：云（路径1）、K8s工作负载（三向）、按IP匹配主机、按实体匹配主机、自然语言回退、问题->实体->发现内容链。每个实体的风险等级细分（Critical/High/Medium/Low）。
- correlation-and-coverage.md — 跨层级实体收敛、Pod->节点拓扑解析、评分约定，以及与dt-sec-insights共享的双向/三向覆盖匹配规则。
- ioc-enrichment.md — 反向查找IoC富集：将已匹配的IoC归因于已摄入的
```
THREAT_REPORT
```
  事件，并展示攻击者上下文（攻击者 / 恶意软件 / MITRE / 攻击目标）。单条和批量（按IoC）模板；支持的IoC分类。

Universal Best Practices

通用最佳实践

Always load
dt-dql-essentials
first — DQL syntax and function names differ from SQL. Confirm all functions before generating queries.
Ground every query in a named template — do not improvise Smartscape joins. The 3-way match, digest→CONTAINER→workload, and pod→node traversal patterns are precise; deviating produces silent zero-row results.
Run the pre-flight check before the full 3-way enrichment — external providers vary widely. Confirm at least one identifier path is populated before running the expensive append chain.
Check
dt.smartscape_source.type
before trusting Path 1 — a non-null
```
dt.smartscape_source.id
```
is not proof of workload-level resolution; the field may point to a namespace, cluster, or cloud resource. Only K8s workload types (
```
K8S_DEPLOYMENT
```
,
```
K8S_DAEMONSET
```
,
```
K8S_STATEFULSET
```
,
```
K8S_CRONJOB
```
,
```
K8S_JOB
```
,
```
K8S_REPLICASET
```
) are eligible for workload enrichment via Path 1.
Dedup early and after
append
— dedup before joins to collapse re-ingested duplicates; dedup again after
```
append
```
because the same finding can match multiple paths.
Tier 3 correlation is context only — same namespace/cluster shared by two findings does not raise the exposure score. Never treat a cluster-level shared attribute as proof of entity-level relatedness.
Route topology queries to
dt-obs-kubernetes
— pod→node placement and Smartscape edge traversal patterns live in
```
dt-obs-kubernetes/references/pod-node-placement.md
```
. Do not re-author them here; reference them and apply the output in
```
correlation-and-coverage.md
```
.
No
dt.system.bucket
filters — security event data may live in any bucket; filtering by bucket risks hiding findings.
THREAT_REPORT is the one
security.events
query allowed here — reverse lookup only.
```
ioc-enrichment.md
```
attributes a matched IoC to reports (IoC → report). Broad THREAT_REPORT overviews, IOC rollups, and forward report → environment correlation stay in
```
dt-sec-insights
```
(
```
threat-intelligence.md
```
). Never author finding/posture queries here.

始终先加载
dt-dql-essentials
— DQL语法和函数名称与SQL不同。生成查询前确认所有函数。
每个查询都基于命名模板 — 不要随意编写Smartscape连接语句。三向匹配、摘要→CONTAINER→工作负载和Pod→节点遍历模式都是精确的；偏离会导致静默的零行结果。
在完整的三向富集前运行预飞检查 — 外部提供商差异很大。在运行昂贵的追加链之前，确认至少有一条标识符路径已填充。
信任路径1前检查
dt.smartscape_source.type
— 非空的
```
dt.smartscape_source.id
```
并不一定能解析到工作负载层级；该字段可能指向命名空间、集群或云资源。只有K8s工作负载类型（
```
K8S_DEPLOYMENT
```
、
```
K8S_DAEMONSET
```
、
```
K8S_STATEFULSET
```
、
```
K8S_CRONJOB
```
、
```
K8S_JOB
```
、
```
K8S_REPLICASET
```
）才有资格通过路径1进行工作负载富集。
尽早去重并在
append
后去重 — 连接前去重以合并重复摄入的内容；
```
append
```
后再次去重，因为同一发现可能匹配多个路径。
层级3关联仅作为上下文 — 两个发现共享同一命名空间/集群并不会提高暴露评分。切勿将集群级共享属性视为实体级关联的证据。
将拓扑查询路由到
dt-obs-kubernetes
— Pod→节点放置和Smartscape边缘遍历模式位于
```
dt-obs-kubernetes/references/pod-node-placement.md
```
中。请勿在此处重新编写；请引用它们并在
```
correlation-and-coverage.md
```
中应用输出结果。
不要使用
dt.system.bucket
过滤器 — 安全事件数据可能存储在任何bucket中；按bucket过滤可能会隐藏发现内容。
THREAT_REPORT是此处允许的唯一
security.events
查询 — 仅用于反向查找。
```
ioc-enrichment.md
```
将已匹配的IoC归因于报告（IoC → 报告）。宽泛的THREAT_REPORT概览、IOC汇总和正向报告→环境关联由
```
dt-sec-insights
```
（
```
threat-intelligence.md
```
）负责；本Skill仅负责反向IoC→报告富集（
```
ioc-enrichment.md
```
）。切勿在此处编写发现内容/态势查询。

Skill	Role
`dt-dql-essentials`	Load first. Core DQL syntax, functions, Smartscape patterns.
`dt-sec-insights`	Consumer of mapping primitive; owns finding-schema queries and coverage counting logic. Owns forward threat-intel (report → environment correlation, overviews, IOC rollups) in `threat-intelligence.md` ; this skill owns only the reverse IoC → report enrichment ( `ioc-enrichment.md` ).
`dt-sec-ioc-hunting`	Routes cross-evidence correlation and entity enrichment to this skill.
`dt-obs-kubernetes`	Pod→node topology; K8s entity placement patterns.
`dt-obs-hosts`	Host inventory; process-level context for HOST/PROCESS_GROUP findings.
`dt-obs-aws` / `dt-obs-azure` / `dt-obs-gcp`	Cloud Smartscape topology for cloud-entity enrichment.

Skill	角色
`dt-dql-essentials`	优先加载。核心DQL语法、函数、Smartscape模式。
`dt-sec-insights`	映射原语的消费者；负责发现内容模式查询和覆盖计数逻辑。在 `threat-intelligence.md` 中负责正向威胁情报（报告→环境关联、概览、IOC汇总）；本Skill仅负责反向IoC→报告富集（ `ioc-enrichment.md` ）。
`dt-sec-ioc-hunting`	将跨证据关联和实体富集路由到本Skill。
`dt-obs-kubernetes`	Pod→节点拓扑；K8s实体放置模式。
`dt-obs-hosts`	主机清单；HOST/PROCESS_GROUP发现内容的进程级上下文。
`dt-obs-aws` / `dt-obs-azure` / `dt-obs-gcp`	用于云实体富集的云Smartscape拓扑。