Skip to main content
affpapa.org
RU EN
skill CX Codex

dt-obs-log-semantic-mapping — Claude Code skill: map audit logs

A skill that maps vendor audit log fields to the Dynatrace semantic dictionary and validates the result.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add Dynatrace/dynatrace-for-ai --skill dt-obs-log-semantic-mapping -a claude-code
Open on GitHub

What dt-obs-log-semantic-mapping does

The skill covers four log classes: authentication, authorization, user_action and http. Each one comes with its key namespaces — audit.*, actor.*, browser.*, device.*, object.*, http.*, url.* and others. Feed it a raw vendor payload or an already ingested event.

Three workflows. Workflow A suggests a mapping from a raw payload to fetch logs fields. Workflow B1 validates a mapping against a pasted event. Workflow B2 reaches into a live tenant: it pulls logs by log.source and runs the static check on what comes back.

Buried fields are the main thing it hunts. The skill inventories what stayed inside content versus what got promoted to top-level attributes, then proposes OpenPipeline extraction rules for the gaps. Load the dt-dql-essentials skill before touching those rules — OpenPipeline processors run on DQL functions like parse and fieldsAdd, and non-DQL syntax produces invalid rules. One more constraint from references/openpipeline-constraints.md: parseJson is unavailable, so the parse plus fieldsFlatten pair stands in for it.

What it helps with

  • map raw vendor audit log fields onto the Dynatrace semantic dictionary
  • validate an existing mapping against a pasted ingested event
  • find fields buried in content instead of promoted to top level
  • write OpenPipeline extraction rules using DQL functions
  • run validation against live logs selected by log.source

Example prompts for the agent

  • Map this CyberArk payload to the Dynatrace semantic dictionary
  • Validate my mapping against this ingested log event
  • Write OpenPipeline rules for the fields still stuck in content

How to install dt-obs-log-semantic-mapping

1Skills CLI (Vercel)

npx skills add Dynatrace/dynatrace-for-ai --skill dt-obs-log-semantic-mapping -a claude-code

2Manually: put the files in place

~/.claude/skills/dt-obs-log-semantic-mapping/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/dt-obs-log-semantic-mapping/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about dt-obs-log-semantic-mapping

How do I install dt-obs-log-semantic-mapping in Claude?

Run npx skills add Dynatrace/dynatrace-for-ai --skill dt-obs-log-semantic-mapping -a claude-code. The skill lands at ~/.claude/skills/dt-obs-log-semantic-mapping/SKILL.md.

What does dt-obs-log-semantic-mapping do?

It suggests and validates mappings from vendor audit logs to the Dynatrace semantic dictionary. It handles both raw payloads and live tenant data.

Do I need live Dynatrace tenant access?

Only for Workflow B2, which fetches live records by log.source. Workflows A and B1 work from a raw payload or a pasted event.

Source text

SKILL.md · Apache-2.0 
---
name: dt-obs-log-semantic-mapping
description: "Suggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events. Use when: mapping a vendor audit log feed, authentication logs, user activity logs to the Dynatrace SD; checking required semantic fields; proposing OpenPipeline processor extraction rules based on DQL; running runtime validation (fetches live logs by log.source, then applies static validation)."
license: Apache-2.0
---

# dt-obs-log-semantic-mapping

Build and validate semantic-dictionary-aligned mappings for audit log integrations.

## Purpose

Use this skill when a user wants to:

- **Suggest** a mapping from a raw vendor audit log payload to Dynatrace `fetch logs` fields (Workflow A).
- **Validate** a mapping against a pasted ingested log event (Workflow B1 — static).
- **Validate** against live tenant data via live tenant access (Workflow B2 — runtime: fetches logs by `log.source`, then runs B1 on the result).

## Log Classes

| Class | Description | Key namespaces | Example sources |
|---|---|---|---|
| `authentication` | Login, logout, MFA, token | `audit.*`, `actor.*`, `browser.*`, `device.*` | CyberArk, Okta, Azure SignInLogs |
| `authorization` | Access decisions, permission changes | `audit.*`, `actor.*`, `object.*` | CyberArk, Okta |
| `user_action` | CRUD on platform resources | `audit.*`, `actor.*`, `object.*`, `product.*` | Okta, GitHub, Sonatype |
| `http` | HTTP request/response (WAF, network devices) | `http.*`, `url.*`, `server.*`, `geo.*`, `client.*` | Akamai SIEM, Cloudflare |

## Workflows

| Mode | Input | Source |
|---|---|---|
| **Workflow A** — Suggest mapping | Raw vendor log payload | `references/mapping-workflow.md § Workflow A` |
| **Workflow B1** — Static validation | Pasted ingested log event | `references/mapping-workflow.md § Workflow B1` |
| **Workflow B2** — Runtime validation | `log.source` value + live tenant access | `references/runtime-validation.md` — fetches logs, then runs B1 |

## Key Concepts

**Content field burial:** The primary validation concern. Fields in `content` (the raw vendor payload) that could be promoted to top-level semantic attributes but are not. The skill always inventories buried vs promoted fields and proposes OpenPipeline extraction rules to fix gaps.

> **Prerequisite:** When proposing OpenPipeline processor extraction rules, load the `dt-dql-essentials` skill first. OpenPipeline processors use DQL functions (`parse`, `fieldsAdd`, `splitString`, etc.) — using non-DQL syntax produces invalid rules.

**Sparse mappings are valid:** Integrations like GitHub or Sonatype may only populate core fields. Minimum required: `timestamp`, `log.source`, `content`, `loglevel`, `audit.action`, `audit.identity`.

## References

- `references/data-model-notes.md` — Log SD field taxonomy, audit namespace, enums, sample-derived patterns and known discrepancies
- `references/mapping-workflow.md` — Intake checklist, Workflow A and B1 procedures, content field analysis, field priority order
- `references/validation-rules.md` — Required fields, content/enum/type rules, discrepancy severity
- `references/openpipeline-constraints.md` — OpenPipeline processor command/function/operator/matcher restrictions; `parseJson` unavailability + `parse`→`fieldsFlatten` alternative; iterative operators for array casting
- `references/report-format.md` — Mapping table, diff table, OpenPipeline sketch, Validation Summary templates
- `references/runtime-validation.md` — Workflow B2: fetch live records, then run B1
- `samples/audit-logs.json` — Mapped samples: CyberArk, Okta, Azure SignInLogs, Sonatype, GitHub
- `samples/http-logs.json` — Mapped samples: Akamai SIEM (WAF/HTTP class)
- [Dynatrace Log Semantic Dictionary](https://docs.dynatrace.com/docs/semantic-dictionary/model/log)

© Dynatrace · Apache-2.0 · Dynatrace/dynatrace-for-ai

Similar skills

Everything for DevOps and infrastructure →
dtctl Dynatrace Operates Dynatrace through its CLI to investigate incidents, inspect logs and traces, and manage observability resources. Use it for DQL queries and dashboards. CX Codex +1 1,300installs Dynatrace Expert official github Integrates Dynatrace observability and security directly into repository workflows. It investigates incidents, verifies deployments, and identifies vulnerabilities via traces and logs. ★ 40,418repo stars log-analysis akillness A skill that reads runtime logs: it picks one evidence packet first, then isolates the earliest failure. Useful when the log is long and you need the one line that matters. CX Codex +1 384installs authoring-log-alerts PostHog Walks an agent through picking services, baselining them over a week and drafting thresholds that fire 0–3 times per week in a PostHog project. CX Codex +1 356installs elasticsearch-esql elastic A skill that has the agent write and run ES|QL queries: check the index schema first, then generate the query and execute it. CX Codex +1 4,800installs cx-telemetry-querying coralogix A skill that routes telemetry questions to the right signal — metrics, logs, traces or RUM — and loads the reference files the agent needs before querying. CX Codex +1 4,700installs

From the same set29

dt-alerting A skill that walks the whole Dynatrace alerting lifecycle: picking an anomaly detector, storing events in Grail, grouping problems and routing notifications. CX Codex +1 1,800installs dt-js-runtime A skill that documents the Dynatrace server-side JS runtime: function contract, sandbox limits, available Web APIs and Node.js modules. Useful when writing code for the AppEngine sandbox. CX Codex +1 1,700installs dt-obs-genai Generates Dynatrace DQL queries to monitor GenAI apps and agents. It helps track token consumption, p95 latencies, tool call errors, and blocked responses. CX Codex +1 1,400installs dt-sec-insights A skill that writes DQL queries against Dynatrace security data: vulnerabilities, runtime attacks, compliance posture and scan coverage. CX Codex +1 1,400installs dt-platform-costs Analyzes actual Dynatrace DPS consumption and spend directly from dt.system.events via DQL. Helps teams track cost drivers and chargeback. CX Codex +1 1,400installs dt-obs-ext-monitors Sends third-party test outcomes and CI monitor results to Dynatrace Grail through the events ingest API. Replaces the deprecated synthetic v1 endpoint. CX Codex +1 1,100installs dt-sec-ioc-hunting Hunts indicators of compromise from reports and advisories across Dynatrace logs and spans, then scores threat exposure from 0 to 100. CX Codex +1 1,000installs dt-obs-network-flows A Dynatrace skill that reads network flows from three sources and answers who talks to whom and where connections break. CX Codex +1 912installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor