Dt Obs Compliance Assistant

Unclassified Problems and Potential Major Incidents on CIFs

Finds Davis problems affecting CIFs that have no matching compliance.incident bizevent — i.e., problems not yet manually classified. The isNull(lookup.event.id) anti-join is the key pattern.

fetch dt.davis.problems, from: {{.from}}, to: {{.to}}
| expand affected_entity_ids
| join [
    smartscapeNodes "*"
  ], on: {left[affected_entity_ids] == right[id_classic]}, prefix: "entities."
| join [
    smartscapeEdges "*"
  ], on: {left[entities.id] == right[target_id]}, prefix: "edges."
| join [
    smartscapeNodes "BIZ_FLOW"
  ], on: {left[edges.source_id] == right[id]}, prefix: "nodes."
| lookup [
    fetch bizevents
    | filter event.provider == "dynatrace.compliance.assistant"
      and event.type == "compliance.incident"
  ], sourceField: `event.id`, lookupField: `problem.event.id`, executionOrder: auto
| filter isNull(lookup.event.id)
| fields display_id,
         name = event.name,
         status = event.status,
         cif = nodes.name,
         affectedEntity = entities.name,
         event.start,
         event.end,
         nodes.bizflow.id,
         category = event.category
| filter in(nodes.bizflow.id, {"{{.cif_id_1}}", "{{.cif_id_2}}"})
| summarize {
    status      = takeFirst(status),
    cifIds      = collectDistinct(nodes.bizflow.id),
    cifs        = collectDistinct(cif),
    start       = min(event.start),
    end         = max(event.end),
    duration    = max(coalesce(event.end, now()) - event.start),
    category    = takeFirst(category)
  }, by: { display_id, name }
| limit {{.max_entries:long}}

Notes:

• Source is dt.davis.problems, not bizevents
• filter isNull(lookup.event.id) identifies problems with no classified incident bizevent
• in(nodes.bizflow.id, {...}) restricts to problems whose Smartscape graph touches a configured CIF (BIZ_FLOW node)
• Replace {{.cif_id_1}}, {{.cif_id_2}} with actual Business Flow entity IDs from the DORA framework settings in Compliance Assistant
• For a single CIF, use | filter nodes.bizflow.id == "{{.cif_id}}"

CIF Health (Business Flow KPIs)

Fetches the latest KPI snapshot per CIF. KPI data is emitted by Business Flow (event.type == "bizflow.kpis"), not by Compliance Assistant directly.

fetch bizevents, from: now()-24h, to: now()
| filter event.type == "bizflow.kpis"
| filter bizflow.id == "{{.cif_id_1}}" or bizflow.id == "{{.cif_id_2}}"
| fieldsAdd timestamp, bizflowId = bizflow.id, bizflowName = bizflow.name
| sort timestamp asc
| summarize {
    fulfillment   = takeLast(bizflow.analysis.value),
    errors        = takeLast(bizflow.errors.value),
    timestamp     = takeLast(timestamp),
    timeframe     = takeLast(bizflow.query_timeframe.hours),
    frequency     = takeLast(bizflow.query_frequency.hours),
    bizflowName   = takeLast(bizflowName),
    analysisLabel = takeLast(bizflow.analysis.label)
  }, by: { bizflowId }

Notes:

• Returns one row per CIF; fulfillment and errors are the latest sampled KPI values
• analysisLabel describes what fulfillment means for that flow (e.g., "Successful logins")
• timeframe and frequency reflect the Business Flow's own configured query window
• For a single CIF use | filter bizflow.id == "<id>"; for multiple CIFs extend with additional or bizflow.id == "<id>" clauses
• If data is missing, check the Business Flow monitoring frequency and evaluation timeframe (see FAQ)

Common Workflows

Check the Compliance Score

1. Confirm the user is asking about DORA — currently the only supported framework
2. Explain the current tier using the score tier table in Core Concepts
3. Remind the user the score is an operational indicator, not a legal compliance determination
4. If the score is degraded, identify which signal types are contributing (incidents, security detection findings, vulnerabilities, misconfigurations)
5. Guide remediation using Improving the Compliance Score

Investigate an Incident

1. Confirm whether the user is asking about a classified incident (has a compliance.incident bizevent) or an unclassified/potential major problem
2. For classified incidents: run the classified incidents DQL query, filter by problem.event.id if a specific incident is referenced
3. For unclassified/potential major: run the unclassified problems query scoped to the relevant CIF IDs
4. Surface the materiality threshold breach status: compliance.incident.duration_criteria, compliance.incident.economic_impact_criteria, compliance.cifs_impacted.*
5. Do not classify an incident on behalf of the user — classification is a manual step performed in the Compliance Assistant app

Review CIF Health

1. Identify the CIF's Business Flow ID from the DORA framework settings in Compliance Assistant
2. Run the CIF health query with the relevant bizflow.id values
3. Surface fulfillment, errors, and analysisLabel per CIF
4. If data is missing or stale, check the Business Flow monitoring frequency — see FAQ

Improving the Compliance Score

The Dynatrace score reflects current ICT risk posture in real time. To improve it:

1. Address incidents promptly — resolve potential major incidents and unclassified problems affecting CIFs
2. Remediate security detection findings and vulnerabilities — see Gain insights and How do I fix detected vulnerabilities?
3. Fix ICT asset misconfigurations — see Stay compliant with Security Posture Management
4. Ensure monitoring coverage — confirm that real-time protection and monitoring are enabled across all CIFs

Improving the score reduces observable ICT risk. It does not constitute formal compliance or legal readiness.

FAQ

How often are CIF insights updated in Compliance Assistant?

CIF KPI insights (fulfillment and errors) are updated based on the configured generation frequency of KPI monitoring in Business Flow. The evaluation timeframe is also defined per business flow configuration.

To ensure reliable KPI evaluation and avoid missing data from long-running processes, set the evaluation timeframe to at least 3–4× the process's average duration. For example, if a CIF's average duration is 5 minutes, set the evaluation window to at least 15–20 minutes.

Why are configured CIFs not updating?

If you have recently edited or added business processes configured as entities and selected them as CIFs in Compliance Assistant, it may take up to the maximum defined monitoring frequency for those business processes to be updated. Adjust the monitoring frequency in the business flow configuration to reduce the delay.

References

• Compliance Assistant documentation
• Business Flow
• Security Posture Management
• Runtime Vulnerability Analytics
• Threat Observability concepts
• Compliance assistant incident event — Semantic Dictionary
• Dynatrace Hub — Compliance Assistant