How to use
- Copy the installation command and review the source package before installing it in your own agent environment.
- Check the source document for required tools, credentials and supported hosts.
- Describe your input and desired deliverable; review the output against the source material.
npx skills add https://github.com/dynatrace/dynatrace-for-ai --skill dt-obs-log-semantic-mappingBefore you start
- Installation does not include a model subscription, API allowance or permission to access your files.
- Repository stars and installation counts describe activity, not an independent quality or security test.
Original skill document
Rendered from the source repository. Headings, examples, code, tables, links, and referenced images are preserved.
dt-obs-log-semantic-mapping
Build and validate semantic-dictionary-aligned mappings for audit log integrations.
Purpose
Use this skill when a user wants to:
- Suggest a mapping from a raw vendor audit log payload to Dynatrace
fetch logsfields (Workflow A). - Validate a mapping against a pasted ingested log event (Workflow B1 — static).
- Validate against live tenant data via live tenant access (Workflow B2 — runtime: fetches logs by
log.source, then runs B1 on the result).
Log Classes
| Class | Description | Key namespaces | Example sources |
|---|---|---|---|
authentication | Login, logout, MFA, token | audit.*, actor.*, browser.*, device.* | CyberArk, Okta, Azure SignInLogs |
authorization | Access decisions, permission changes | audit.*, actor.*, object.* | CyberArk, Okta |
user_action | CRUD on platform resources | audit.*, actor.*, object.*, product.* | Okta, GitHub, Sonatype |
http | HTTP request/response (WAF, network devices) | http.*, url.*, server.*, geo.*, client.* | Akamai SIEM, Cloudflare |
Workflows
| Mode | Input | Source |
|---|---|---|
| Workflow A — Suggest mapping | Raw vendor log payload | references/mapping-workflow.md § Workflow A |
| Workflow B1 — Static validation | Pasted ingested log event | references/mapping-workflow.md § Workflow B1 |
| Workflow B2 — Runtime validation | log.source value + live tenant access | references/runtime-validation.md — fetches logs, then runs B1 |
Key Concepts
Content field burial: The primary validation concern. Fields in content (the raw vendor payload) that could be promoted to top-level semantic attributes but are not. The skill always inventories buried vs promoted fields and proposes OpenPipeline extraction rules to fix gaps.
Prerequisite: When proposing OpenPipeline processor extraction rules, load thedt-dql-essentialsskill first. OpenPipeline processors use DQL functions (parse,fieldsAdd,splitString, etc.) — using non-DQL syntax produces invalid rules.
Sparse mappings are valid: Integrations like GitHub or Sonatype may only populate core fields. Minimum required: timestamp, log.source, content, loglevel, audit.action, audit.identity.
References
references/data-model-notes.md— Log SD field taxonomy, audit namespace, enums, sample-derived patterns and known discrepanciesreferences/mapping-workflow.md— Intake checklist, Workflow A and B1 procedures, content field analysis, field priority orderreferences/validation-rules.md— Required fields, content/enum/type rules, discrepancy severityreferences/openpipeline-constraints.md— OpenPipeline processor command/function/operator/matcher restrictions;parseJsonunavailability +parse→fieldsFlattenalternative; iterative operators for array castingreferences/report-format.md— Mapping table, diff table, OpenPipeline sketch, Validation Summary templatesreferences/runtime-validation.md— Workflow B2: fetch live records, then run B1samples/audit-logs.json— Mapped samples: CyberArk, Okta, Azure SignInLogs, Sonatype, GitHubsamples/http-logs.json— Mapped samples: Akamai SIEM (WAF/HTTP class)- Dynatrace Log Semantic Dictionary
