dt-obs-log-semantic-mapping

Purpose

• Suggest a mapping from a raw vendor audit log payload to Dynatrace

  fetch logs

  fields (Workflow A).
• Validate a mapping against a pasted ingested log event (Workflow B1 — static).
• Validate against live tenant data via live tenant access (Workflow B2 — runtime: fetches logs by

  log.source

  , then runs B1 on the result).

Log Classes

authentication

audit.*

actor.*

browser.*

device.*

authorization

audit.*

actor.*

object.*

user_action

audit.*

actor.*

object.*

product.*

http

http.*

url.*

server.*

geo.*

client.*

Workflows

references/mapping-workflow.md § Workflow A

references/mapping-workflow.md § Workflow B1

log.source

references/runtime-validation.md

Key Concepts

content

Prerequisite: When proposing OpenPipeline processor extraction rules, load the

dt-dql-essentials

skill first. OpenPipeline processors use DQL functions (

parse

,

fieldsAdd

,

splitString

, etc.) — using non-DQL syntax produces invalid rules.

timestamp

log.source

content

loglevel

audit.action

audit.identity

References

• references/data-model-notes.md

  — Log SD field taxonomy, audit namespace, enums, sample-derived patterns and known discrepancies

• references/mapping-workflow.md

  — Intake checklist, Workflow A and B1 procedures, content field analysis, field priority order

• references/validation-rules.md

  — Required fields, content/enum/type rules, discrepancy severity

• references/openpipeline-constraints.md

  — OpenPipeline processor command/function/operator/matcher restrictions;

  parseJson

  unavailability +

  parse

  →

  fieldsFlatten

  alternative; iterative operators for array casting

• references/report-format.md

  — Mapping table, diff table, OpenPipeline sketch, Validation Summary templates

• references/runtime-validation.md

  — Workflow B2: fetch live records, then run B1

• samples/audit-logs.json

  — Mapped samples: CyberArk, Okta, Azure SignInLogs, Sonatype, GitHub

• samples/http-logs.json

  — Mapped samples: Akamai SIEM (WAF/HTTP class)
• Dynatrace Log Semantic Dictionary