Compliance Assistant

Track, manage, and investigate EU DORA compliance posture using real-time observability and security insights from the Dynatrace Compliance Assistant app.

Critical Disclaimer

The Dynatrace compliance score and all outputs from Compliance Assistant are indicative metrics based on real-time observability data and automated systems. They do not replace comprehensive or formal compliance assessments and do not constitute a legal determination of a company's compliance status under EU DORA or any other regulation.

Never claim that a score, tier, or Compliance Assistant output means an organization is legally compliant or non-compliant with EU DORA. Always present results as operational indicators to support remediation decisions, not as legal or regulatory verdicts.

When to Use This Skill

✅ Use for:

EU DORA compliance posture, compliance score, compliance snapshot, score tier
Critical or Important Functions (CIFs): health, KPI monitoring, impact analysis, setup questions
Incident lifecycle under DORA: unclassified problems, potential major incidents, classified major incidents
ICT risk inputs: vulnerabilities, security detection findings, misconfigurations (ICT asset configuration results)
Incident classification under EU DORA: materiality thresholds, duration criteria, economic impact
DQL queries for
```
compliance.incident
```
bizevents, CIF health, or unclassified problems on CIFs
Onboarding, permissions, and settings for Compliance Assistant

❌ Do not use for:

Regulatory frameworks other than EU DORA — SOC2, PCI-DSS, HIPAA, ISO 27001 are not supported by this app
Generic Davis problems with no DORA, CIF, or compliance context → use
```
dt-obs-problems
```
Generic vulnerability or security finding queries not scoped to compliance or DORA → use application security skills
Generic "score" queries without "compliance" or "DORA" — Dynatrace has many scores
Configuring Business Flow or defining business process steps → see Business Flow documentation
Configuring Security Posture Management rules → see SPM documentation
General DQL syntax help → use
```
dt-dql-essentials
```

Prerequisites

Installation

Install Compliance Assistant from Dynatrace Hub.

Required Permissions

Permission	Purpose
`storage:buckets:read`	Read buckets
`storage:events:read`	Read events
`storage:entities:read`	Read entities table
`storage:metrics:read`	Required for Istio discovery findings rule
`storage:filter-segments:read`	Read filter segments
`settings:objects:read`	Read Log ingest settings
`settings:schemas:read`	Read settings schemas
`state:app-states:read`	Read app state
`hub:catalog:read`	Read app version
`storage:security.events:read`	Fetch security events

Required Data Sources

Source	Purpose
Business Flow	CIF monitoring and incident detection on business processes — required for incident classification
Vulnerability events	Continuous vulnerability assessment (DORA requirement)
Detection finding events	Continuous cyber threat assessment (DORA requirement)
Compliance events	ICT asset secure configuration baseline verification (DORA requirement) — powered by Security Posture Management

Core Concepts

Compliance Framework

Compliance Assistant currently supports EU DORA (Digital Operational Resilience Act) only. It consolidates observability and security insights into a single compliance posture view for this framework. Support for additional frameworks is planned.

Dynatrace Score (Compliance Snapshot)

A real-time, tiered score summarizing current ICT risk posture across potential incidents, security detection findings, vulnerabilities, and misconfigurations. The score tier is determined by the most severe active condition; within a tier, the score is reduced by a penalty for each criterion met.

Score tiers:

Tier	Max score	Triggered when…
On Track	100	No criteria met across incidents, security detection findings, vulnerabilities, misconfigurations
Low	99	Any low-severity finding in security detection findings/vulnerabilities/misconfigurations
Medium	79	Any medium-severity finding, or ≥1 unclassified incident
High	59	Any high-severity finding, or ≥5 unclassified incidents
Critical	34	Any critical security detection finding/vulnerability/misconfiguration, or ≥1 potential major incident
Major	5 (fixed)	≥1 confirmed classified major incident — short-circuits to a fixed score of 5

Penalty mechanic: Within a tier, score = tier max − (6 × number of criteria met in that tier). For example, Medium tier with 2 criteria met: 79 − 12 = 67.

This score is a high-level operational indicator. It does not confirm regulatory compliance or legal status.

Critical or Important Functions (CIFs)

Under EU DORA, financial entities must identify and monitor business functions that, if disrupted, could significantly impact financial performance or service continuity. In Compliance Assistant, CIFs are configured by linking Business Flow business processes to the DORA framework. Smartscape on Grail provides end-to-end visibility by linking each CIF to its underlying IT components.

Incident Lifecycle

Davis-detected problems affecting CIF business processes move through three states:

State	Definition
Unclassified problem	A Davis problem affects a CIF but fewer than 2 DORA materiality thresholds are breached
Potential major incident	≥2 monitored DORA materiality thresholds are breached
Classified major incident	Manually confirmed as major in Compliance Assistant; generates a `compliance.incident` bizevent snapshot

EU DORA materiality thresholds monitored:

Threshold	Criterion
CIFs affected	Blast radius across critical or important functions
Incident duration	24-hour threshold
Economic impact	€100,000 threshold, calculated from estimated cost per minute of affected CIFs × incident duration

Classification is always a manual step performed in the Compliance Assistant app. Do not classify incidents on behalf of the user.

Once classified, the generated

compliance.incident

bizevent can trigger automations via Dynatrace Workflows (e.g., creating a ServiceNow incident or Jira ticket enriched with compliance impact details).

ICT Risk Inputs

Signal type	Source	DORA requirement
Vulnerabilities	Vulnerability findings	Continuous vulnerability assessment
Security detection findings	Detection finding events	Continuous cyber threat assessment
ICT asset configuration results	Compliance events via Security Posture Management	Secure configuration baseline verification

DQL Reference

Classified Major Incidents

Fetch

compliance.incident

bizevents generated when an incident is classified as major. To retrieve a specific incident, filter by

problem.event.id

dql

fetch bizevents
| filter event.provider == "dynatrace.compliance.assistant"
| filter event.type == "compliance.incident"
| filter problem.event.id == {{.incident_id:string}}

To fetch all classified incidents:

dql

fetch bizevents
| filter event.provider == "dynatrace.compliance.assistant"
| filter event.type == "compliance.incident"

Key fields (see Semantic Dictionary for the full schema):

Field	Type	Description
`compliance.cifs_impacted.names`	string	Distinct list of names of the Business Flow entities configured as CIFs affected by the incident (e.g., `Account opening; Deposit and trade flow` )
`compliance.cifs_impacted.ids`	string	Distinct list of unique identifiers of the Business Flow entities configured as CIFs affected by the incident
`compliance.framework`	string	Display name of the compliance framework (e.g., `DORA` )
`compliance.incident.classified`	boolean	`true` when the incident has been manually classified as major in line with DORA requirements
`compliance.incident.comment`	string	Comment added by the user when classifying the incident as major (e.g., `"The incident was classified as major due to insights on reputational damage and user impact."` )
`compliance.incident.duration`	duration	Duration of the incident in nanoseconds, used to evaluate the 24h DORA duration materiality threshold
`compliance.incident.duration_criteria`	boolean	`true` if the DORA 24h incident duration materiality threshold was breached
`compliance.incident.economic_impact`	double	Estimated economic impact in EUR, calculated from the estimated cost per minute of affected CIFs × incident duration
`compliance.incident.economic_impact_criteria`	boolean	`true` if the DORA €100,000 economic impact materiality threshold was breached
`compliance.incident.name`	string	Display name of the incident — matches the `event.name` of the underlying `dt.davis.problem` (e.g., `CPU saturation` )
`compliance.incident.time.classified`	timestamp	Unix epoch timestamp (nanoseconds) when the incident was classified as major
`event.provider`	string	Always `dynatrace.compliance.assistant` for Compliance Assistant incident bizevents
`event.type`	string	Always `compliance.incident` for Compliance Assistant incident bizevents
`problem.category`	string	Problem category from the underlying Davis problem: `AVAILABILITY` , `ERROR` , `SLOWDOWN` , `RESOURCE_CONTENTION` , `CUSTOM_ALERT` , `MONITORING_UNAVAILABLE`
`problem.event.id`	string	Unique identifier of the underlying `dt.davis.problem` — use this to correlate with problem queries
`problem.status`	string	Status of the underlying Davis problem: `ACTIVE` or `CLOSED`

Unclassified Problems and Potential Major Incidents on CIFs

Finds Davis problems affecting CIFs that have no matching

compliance.incident

bizevent — i.e., problems not yet manually classified. The

isNull(lookup.event.id)

anti-join is the key pattern.

dql

fetch dt.davis.problems, from: {{.from}}, to: {{.to}}
| expand affected_entity_ids
| join [
    smartscapeNodes "*"
  ], on: {left[affected_entity_ids] == right[id_classic]}, prefix: "entities."
| join [
    smartscapeEdges "*"
  ], on: {left[entities.id] == right[target_id]}, prefix: "edges."
| join [
    smartscapeNodes "BIZ_FLOW"
  ], on: {left[edges.source_id] == right[id]}, prefix: "nodes."
| lookup [
    fetch bizevents
    | filter event.provider == "dynatrace.compliance.assistant"
      and event.type == "compliance.incident"
  ], sourceField: `event.id`, lookupField: `problem.event.id`, executionOrder: auto
| filter isNull(lookup.event.id)
| fields display_id,
         name = event.name,
         status = event.status,
         cif = nodes.name,
         affectedEntity = entities.name,
         event.start,
         event.end,
         nodes.bizflow.id,
         category = event.category
| filter in(nodes.bizflow.id, {"{{.cif_id_1}}", "{{.cif_id_2}}"})
| summarize {
    status      = takeFirst(status),
    cifIds      = collectDistinct(nodes.bizflow.id),
    cifs        = collectDistinct(cif),
    start       = min(event.start),
    end         = max(event.end),
    duration    = max(coalesce(event.end, now()) - event.start),
    category    = takeFirst(category)
  }, by: { display_id, name }
| limit {{.max_entries:long}}

Notes:

Source is
```
dt.davis.problems
```
, not
```
bizevents
```
```
filter isNull(lookup.event.id)
```
identifies problems with no classified incident bizevent
```
in(nodes.bizflow.id, {...})
```
restricts to problems whose Smartscape graph touches a configured CIF (
```
BIZ_FLOW
```
node)
Replace
```
{{.cif_id_1}}
```
,
```
{{.cif_id_2}}
```
with actual Business Flow entity IDs from the DORA framework settings in Compliance Assistant

For a single CIF, use

| filter nodes.bizflow.id == "{{.cif_id}}"

CIF Health (Business Flow KPIs)

Fetches the latest KPI snapshot per CIF. KPI data is emitted by Business Flow (

event.type == "bizflow.kpis"

), not by Compliance Assistant directly.

dql

fetch bizevents, from: now()-24h, to: now()
| filter event.type == "bizflow.kpis"
| filter bizflow.id == "{{.cif_id_1}}" or bizflow.id == "{{.cif_id_2}}"
| fieldsAdd timestamp, bizflowId = bizflow.id, bizflowName = bizflow.name
| sort timestamp asc
| summarize {
    fulfillment   = takeLast(bizflow.analysis.value),
    errors        = takeLast(bizflow.errors.value),
    timestamp     = takeLast(timestamp),
    timeframe     = takeLast(bizflow.query_timeframe.hours),
    frequency     = takeLast(bizflow.query_frequency.hours),
    bizflowName   = takeLast(bizflowName),
    analysisLabel = takeLast(bizflow.analysis.label)
  }, by: { bizflowId }

Notes:

Returns one row per CIF;
```
fulfillment
```
and
```
errors
```
are the latest sampled KPI values
```
analysisLabel
```
describes what
```
fulfillment
```
means for that flow (e.g., "Successful logins")
```
timeframe
```
and
```
frequency
```
reflect the Business Flow's own configured query window
For a single CIF use
```
| filter bizflow.id == "<id>"
```
; for multiple CIFs extend with additional
```
or bizflow.id == "<id>"
```
clauses
If data is missing, check the Business Flow monitoring frequency and evaluation timeframe (see FAQ)

Common Workflows

Check the Compliance Score

Confirm the user is asking about DORA — currently the only supported framework
Explain the current tier using the score tier table in Core Concepts
Remind the user the score is an operational indicator, not a legal compliance determination
If the score is degraded, identify which signal types are contributing (incidents, security detection findings, vulnerabilities, misconfigurations)
Guide remediation using Improving the Compliance Score

Investigate an Incident

Confirm whether the user is asking about a classified incident (has a
```
compliance.incident
```
bizevent) or an unclassified/potential major problem
For classified incidents: run the classified incidents DQL query, filter by
```
problem.event.id
```
if a specific incident is referenced
For unclassified/potential major: run the unclassified problems query scoped to the relevant CIF IDs

Surface the materiality threshold breach status:

compliance.incident.duration_criteria

compliance.incident.economic_impact_criteria

compliance.cifs_impacted.*

Do not classify an incident on behalf of the user — classification is a manual step performed in the Compliance Assistant app

Review CIF Health

Identify the CIF's Business Flow ID from the DORA framework settings in Compliance Assistant
Run the CIF health query with the relevant
```
bizflow.id
```
values
Surface
```
fulfillment
```
,
```
errors
```
, and
```
analysisLabel
```
per CIF
If data is missing or stale, check the Business Flow monitoring frequency — see FAQ

Improving the Compliance Score

The Dynatrace score reflects current ICT risk posture in real time. To improve it:

Address incidents promptly — resolve potential major incidents and unclassified problems affecting CIFs
Remediate security detection findings and vulnerabilities — see Gain insights and How do I fix detected vulnerabilities?
Fix ICT asset misconfigurations — see Stay compliant with Security Posture Management
Ensure monitoring coverage — confirm that real-time protection and monitoring are enabled across all CIFs

Improving the score reduces observable ICT risk. It does not constitute formal compliance or legal readiness.

FAQ

How often are CIF insights updated in Compliance Assistant?

CIF KPI insights (fulfillment and errors) are updated based on the configured generation frequency of KPI monitoring in Business Flow. The evaluation timeframe is also defined per business flow configuration.

To ensure reliable KPI evaluation and avoid missing data from long-running processes, set the evaluation timeframe to at least 3–4× the process's average duration. For example, if a CIF's average duration is 5 minutes, set the evaluation window to at least 15–20 minutes.

Why are configured CIFs not updating?

If you have recently edited or added business processes configured as entities and selected them as CIFs in Compliance Assistant, it may take up to the maximum defined monitoring frequency for those business processes to be updated. Adjust the monitoring frequency in the business flow configuration to reduce the delay.

dt-obs-compliance-assistant

NPX Install

Tags

SKILL.md Content