• EU DORA compliance posture, compliance score, compliance snapshot, score tier
• Critical or Important Functions (CIFs): health, KPI monitoring, impact analysis, setup questions
• Incident lifecycle under DORA: unclassified problems, potential major incidents, classified major incidents
• ICT risk inputs: vulnerabilities, security detection findings, misconfigurations (ICT asset configuration results)
• Incident classification under EU DORA: materiality thresholds, duration criteria, economic impact
• DQL queries for

  compliance.incident

  bizevents, CIF health, or unclassified problems on CIFs
• Onboarding, permissions, and settings for Compliance Assistant

• Regulatory frameworks other than EU DORA — SOC2, PCI-DSS, HIPAA, ISO 27001 are not supported by this app
• Generic Davis problems with no DORA, CIF, or compliance context → use

  dt-obs-problems

• Generic vulnerability or security finding queries not scoped to compliance or DORA → use application security skills
• Generic "score" queries without "compliance" or "DORA" — Dynatrace has many scores
• Configuring Business Flow or defining business process steps → see Business Flow documentation
• Configuring Security Posture Management rules → see SPM documentation
• General DQL syntax help → use

  dt-dql-essentials

This score is a high-level operational indicator. It does not confirm regulatory compliance or legal status.

compliance.incident

isNull(lookup.event.id)

fetch dt.davis.problems, from: {{.from}}, to: {{.to}}
| expand affected_entity_ids
| join [
    smartscapeNodes "*"
  ], on: {left[affected_entity_ids] == right[id_classic]}, prefix: "entities."
| join [
    smartscapeEdges "*"
  ], on: {left[entities.id] == right[target_id]}, prefix: "edges."
| join [
    smartscapeNodes "BIZ_FLOW"
  ], on: {left[edges.source_id] == right[id]}, prefix: "nodes."
| lookup [
    fetch bizevents
    | filter event.provider == "dynatrace.compliance.assistant"
      and event.type == "compliance.incident"
  ], sourceField: `event.id`, lookupField: `problem.event.id`, executionOrder: auto
| filter isNull(lookup.event.id)
| fields display_id,
         name = event.name,
         status = event.status,
         cif = nodes.name,
         affectedEntity = entities.name,
         event.start,
         event.end,
         nodes.bizflow.id,
         category = event.category
| filter in(nodes.bizflow.id, {"{{.cif_id_1}}", "{{.cif_id_2}}"})
| summarize {
    status      = takeFirst(status),
    cifIds      = collectDistinct(nodes.bizflow.id),
    cifs        = collectDistinct(cif),
    start       = min(event.start),
    end         = max(event.end),
    duration    = max(coalesce(event.end, now()) - event.start),
    category    = takeFirst(category)
  }, by: { display_id, name }
| limit {{.max_entries:long}}

• Source is

  dt.davis.problems

  , not

  bizevents

• filter isNull(lookup.event.id)

  identifies problems with no classified incident bizevent

• in(nodes.bizflow.id, {...})

  restricts to problems whose Smartscape graph touches a configured CIF (

  BIZ_FLOW

  node)
• Replace

  {{.cif_id_1}}

  ,

  {{.cif_id_2}}

  with actual Business Flow entity IDs from the DORA framework settings in Compliance Assistant
• For a single CIF, use

  | filter nodes.bizflow.id == "{{.cif_id}}"

event.type == "bizflow.kpis"

fetch bizevents, from: now()-24h, to: now()
| filter event.type == "bizflow.kpis"
| filter bizflow.id == "{{.cif_id_1}}" or bizflow.id == "{{.cif_id_2}}"
| fieldsAdd timestamp, bizflowId = bizflow.id, bizflowName = bizflow.name
| sort timestamp asc
| summarize {
    fulfillment   = takeLast(bizflow.analysis.value),
    errors        = takeLast(bizflow.errors.value),
    timestamp     = takeLast(timestamp),
    timeframe     = takeLast(bizflow.query_timeframe.hours),
    frequency     = takeLast(bizflow.query_frequency.hours),
    bizflowName   = takeLast(bizflowName),
    analysisLabel = takeLast(bizflow.analysis.label)
  }, by: { bizflowId }

• Returns one row per CIF;

  fulfillment

  and

  errors

  are the latest sampled KPI values

• analysisLabel

  describes what

  fulfillment

  means for that flow (e.g., "Successful logins")

• timeframe

  and

  frequency

  reflect the Business Flow's own configured query window
• For a single CIF use

  | filter bizflow.id == "<id>"

  ; for multiple CIFs extend with additional

  or bizflow.id == "<id>"

  clauses
• If data is missing, check the Business Flow monitoring frequency and evaluation timeframe (see FAQ)

1. Confirm the user is asking about DORA — currently the only supported framework
2. Explain the current tier using the score tier table in Core Concepts
3. Remind the user the score is an operational indicator, not a legal compliance determination
4. If the score is degraded, identify which signal types are contributing (incidents, security detection findings, vulnerabilities, misconfigurations)
5. Guide remediation using Improving the Compliance Score

1. Confirm whether the user is asking about a classified incident (has a

   compliance.incident

   bizevent) or an unclassified/potential major problem
2. For classified incidents: run the classified incidents DQL query, filter by

   problem.event.id

   if a specific incident is referenced
3. For unclassified/potential major: run the unclassified problems query scoped to the relevant CIF IDs
4. Surface the materiality threshold breach status:

   compliance.incident.duration_criteria

   ,

   compliance.incident.economic_impact_criteria

   ,

   compliance.cifs_impacted.*

5. Do not classify an incident on behalf of the user — classification is a manual step performed in the Compliance Assistant app

1. Identify the CIF's Business Flow ID from the DORA framework settings in Compliance Assistant
2. Run the CIF health query with the relevant

   bizflow.id

   values
3. Surface

   fulfillment

   ,

   errors

   , and

   analysisLabel

   per CIF
4. If data is missing or stale, check the Business Flow monitoring frequency — see FAQ

1. Address incidents promptly — resolve potential major incidents and unclassified problems affecting CIFs
2. Remediate security detection findings and vulnerabilities — see Gain insights and How do I fix detected vulnerabilities?
3. Fix ICT asset misconfigurations — see Stay compliant with Security Posture Management
4. Ensure monitoring coverage — confirm that real-time protection and monitoring are enabled across all CIFs

Improving the score reduces observable ICT risk. It does not constitute formal compliance or legal readiness.

• Compliance Assistant documentation
• Business Flow
• Security Posture Management
• Runtime Vulnerability Analytics
• Threat Observability concepts
• Compliance assistant incident event — Semantic Dictionary
• Dynatrace Hub — Compliance Assistant