dt-sec-semantic-mapping

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

dt-sec-semantic-mapping

Build and validate semantic-dictionary-aligned mappings for new security integrations.

构建并验证符合语义字典的新安全集成映射。

Purpose

用途

Use this skill when a user wants to:

Suggest a mapping from vendor API output to Dynatrace
```
security.events
```
fields (Workflow A).
Validate an existing mapping for completeness and quality against:
- Local baseline samples and semantic dictionary (Workflow B1 — static, offline validation), or
- Live tenant data via live tenant access (Workflow B2 — runtime validation)
Highlight discrepancies vs. the Semantic Dictionary and local references.
Get actionable mapping improvements.

当用户需要以下操作时，可使用本技能：

建议从供应商API输出到Dynatrace
```
security.events
```
字段的映射（工作流A）。
验证现有映射的完整性和质量，验证依据包括：
- 本地基准样本和语义字典（工作流B1 —— 静态离线验证），或
- 通过租户实时访问获取的租户实时数据（工作流B2 —— 运行时验证）
突出显示与语义字典和本地参考资料的差异。
获取可执行的映射改进建议。

Semantic Dictionary

语义字典

The Semantic Dictionary (SD) defines the canonical field set for

security.events

. See

references/semantic-reference.md

for the canonical reference: local-vs-live sources, queryable Grail tables, when-to-query decision matrix, and the authority rule (live SD wins on disagreement).

语义字典（SD）定义了

security.events

的标准字段集。标准参考请参见

references/semantic-reference.md

：本地与实时数据源、可查询的Grail表、查询决策矩阵，以及权威规则（当存在分歧时，以实时SD为准）。

Required Inputs

必填输入

Always run the intake checklist in

references/intake-and-constraints.md

before generating or validating a mapping. If inputs are incomplete, continue with a partial draft but explicitly list missing evidence and confidence limits.

在生成或验证映射之前，务必运行

references/intake-and-constraints.md

中的接收检查清单。如果输入不完整，可继续生成部分草稿，但需明确列出缺失的证据和置信度限制。

Baseline Sources (self-contained)

基准数据源（自包含）

All baseline material lives inside this skill:

```
samples/
```
— real integration payloads covering all finding types and providers. Consulted as a fallback when primary references (SD, data-model-notes, known-discrepancies, validation-rules, object-type-expectations) leave a specific question unresolved — not as a routine step on every workflow run.
```
references/semantic-reference.md
```
— SD reference, field taxonomy, event types, provider taxonomy, and entity scoping
```
references/validation-policy-and-reporting.md
```
— validation rules, acceptable discrepancies, and report templates
```
references/intake-and-constraints.md
```
— intake checklist, output contract,
```
object.type
```
expectations, and OpenPipeline constraints

所有基准材料均包含在本技能中：

```
samples/
```
—— 涵盖所有发现类型和供应商的真实集成负载。当主要参考资料（SD、数据模型说明、已知差异、验证规则、对象类型预期）无法解决特定问题时，可将其作为备选参考，而非每次运行工作流的常规步骤。
```
references/semantic-reference.md
```
—— SD参考资料、字段分类、事件类型、供应商分类和实体范围
```
references/validation-policy-and-reporting.md
```
—— 验证规则、可接受的差异以及报告模板
```
references/intake-and-constraints.md
```
—— 接收检查清单、输出约定、
```
object.type
```
预期以及OpenPipeline约束

Event-Type Coverage Requirements

事件类型覆盖要求

The mapping MUST address the correct set of

event.type

values per finding class. Detection integrations are push-based and do not use scan cycles — never require scan events for detection.

See validation-policy-and-reporting.md § Event-Type Coverage for the full table, severity rules, and the alternative-classification path when a detection-class mapping incorrectly emits

*_SCAN

events.

映射必须针对每个发现类别处理正确的

event.type

值集。检测集成是基于推送的，不使用扫描周期——切勿要求扫描事件用于检测。

有关完整表格、严重性规则，以及当检测类映射错误生成

*_SCAN

事件时的替代分类路径，请参见validation-policy-and-reporting.md中的“事件类型覆盖”章节。

Workflows

工作流

This skill operates in three modes. Detect the mode from context:

Mode	Input	Procedural source
Workflow A — Suggest a new mapping	Raw vendor API payloads only	`references/mapping-workflow.md § Workflow A` (Phase 1 mapping table → user approval → Phase 2 sample JSON)
Workflow B1 — Static validation	Existing mapping + vendor API samples	`references/mapping-workflow.md § Workflow B` — classify input mode (final ingested / theoretical), apply rules, produce diff-highlighted table
Workflow B2 — Runtime validation	Existing mapping + live tenant access	`references/runtime-validation.md` — load the security (AppSec) events supporting skill first (REQUIRED Step 0), then run the query pack, produce a Validation Summary table

All workflows follow the output contracts in

references/intake-and-constraints.md

and the report templates in

references/validation-policy-and-reporting.md

. Validation rules (event-type coverage, required fields, scan references, namespace requirements, value/type checks, vendor-namespace duplication) live in

references/validation-policy-and-reporting.md

本技能以三种模式运行，可根据上下文检测模式：

模式	输入	流程来源
工作流A —— 建议新映射	仅原始供应商API负载	`references/mapping-workflow.md § 工作流A` （阶段1映射表 → 用户审批 → 阶段2样本JSON）
工作流B1 —— 静态验证	现有映射 + 供应商API样本	`references/mapping-workflow.md § 工作流B` —— 分类输入模式（最终已摄入/理论），应用规则，生成差异高亮表格
工作流B2 —— 运行时验证	现有映射 + 租户实时访问权限	`references/runtime-validation.md` —— 首先加载支持安全（AppSec）事件的技能（必填步骤0），然后运行查询包，生成验证摘要表格

所有工作流均遵循

references/intake-and-constraints.md

中的输出约定，以及

references/validation-policy-and-reporting.md

中的报告模板。验证规则（事件类型覆盖、必填字段、扫描参考、命名空间要求、值/类型检查、供应商命名空间重复）位于

references/validation-policy-and-reporting.md

中。

Acceptable Discrepancy Policy

可接受差异政策

See

references/validation-policy-and-reporting.md

for the canonical list of acceptable SD deviations and vendor-namespace patterns. Do NOT raise critical/major issues for fields on that list. Genuinely unknown fields (not in local refs AND not in the live SD — see

references/semantic-reference.md

) must be questioned per

references/validation-policy-and-reporting.md

有关可接受的SD偏差和供应商命名空间模式的标准列表，请参见

references/validation-policy-and-reporting.md

。请勿对该列表中的字段提出严重/重大问题。对于真正未知的字段（不在本地参考资料中且不在实时SD中——参见

references/semantic-reference.md

），必须按照

references/validation-policy-and-reporting.md

中的要求进行质疑。

Scope

范围

This skill covers:

Mapping suggestion and refinement (Workflow A).
Static validation against local baseline examples and semantic dictionary (Workflow B1).
Runtime validation via live tenant access against live tenant data (Workflow B2).
Semantic-dictionary conformance checks.
Gap analysis and improvement recommendations.

This skill does not cover:

Live ingestion pipeline deployment.
Runtime DQL performance benchmarking.
Tenant-side ingestion troubleshooting.

本技能涵盖：

映射建议与优化（工作流A）。
针对本地基准示例和语义字典的静态验证（工作流B1）。
通过租户实时访问针对租户实时数据的运行时验证（工作流B2）。
语义字典一致性检查。
差距分析和改进建议。

本技能不涵盖：

实时摄入管道部署。
运行时DQL性能基准测试。
租户端摄入故障排除。

References

参考资料

```
references/semantic-reference.md
```
— SD reference plus data-model notes: local sources, live (queryable) sources, DQL patterns, when-to-query decision matrix, authority rule, field taxonomy
A skill covering full SD access patterns and Grail-table documentation — for DQL query patterns against
```
security.events
```
and Grail tables
Semantic Dictionary (public docs)
```
references/intake-and-constraints.md
```
— intake checklist, output contract, OpenPipeline constraints, and
```
object.type
```
namespace expectations
```
references/mapping-workflow.md
```
— how to build and refine a mapping candidate
```
references/validation-policy-and-reporting.md
```
— full validation rule set, known discrepancies, and discrepancy report templates
```
references/runtime-validation.md
```
— optional real-environment query validation pack

```
references/semantic-reference.md
```
—— SD参考资料及数据模型说明：本地数据源、实时（可查询）数据源、DQL模式、查询决策矩阵、权威规则、字段分类
涵盖完整SD访问模式和Grail表文档的技能——用于针对
```
security.events
```
和Grail表的DQL查询模式
语义字典（公开文档）
```
references/intake-and-constraints.md
```
—— 接收检查清单、输出约定、OpenPipeline约束以及
```
object.type
```
命名空间预期
```
references/mapping-workflow.md
```
—— 如何构建和优化映射候选方案
```
references/validation-policy-and-reporting.md
```
—— 完整验证规则集、已知差异以及差异报告模板
```
references/runtime-validation.md
```
—— 可选的真实环境查询验证包