Agent skill

Dt Obs Log Semantic Mapping

by Dynatrace in Dynatrace/dynatrace-for-ai

Suggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events.

Apache-2.0Auto-check passedBackend & APIs

Install Dt Obs Log Semantic Mapping

skills CLI
$ npx skills add Dynatrace/dynatrace-for-ai --skill dt-obs-log-semantic-mapping -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install Dynatrace/dynatrace-for-ai dt-obs-log-semantic-mapping --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/Dynatrace/dynatrace-for-ai.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/dt-obs-log-semantic-mapping .claude/skills/dt-obs-log-semantic-mapping && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
dt-obs-log-semantic-mapping
GitHub stars
162
Token cost
~966 tokens
SKILL.md length
348 words
Files
9 (incl. references)
Skills in repo
33
Repo updated
First seen
Licence
Apache-2.0

At a glance

Suggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events.

  • : mapping a vendor audit log feed
  • SKILL.md covers Purpose, Log Classes, Workflows and Key Concepts, plus 1 more section
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Authentication logs

What it does

Dt Obs Log Semantic Mapping is an agent skill from Dynatrace/dynatrace-for-ai. Suggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events. Use when: mapping a vendor audit log feed, authentication logs, user activity logs to the Dynatrace SD; checking required semantic fields; proposing OpenPipeline processor extraction rules based on DQL; running runtime validation (fetches live logs by log.source, then applies static validation).

Its SKILL.md is about 970 tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including reference files (for example `references/data-model-notes.md`, `references/mapping-workflow.md` and `references/openpipeline-constraints.md`).

It sits in Backend & APIs. It works with Okta. The repository describes itself as: Skills, prompts, and instructions for building AI agents on top of Dynatrace production context. The licence is Apache-2.0.

When your agent uses it

  • : mapping a vendor audit log feed
  • Authentication logs
  • User activity logs to the Dynatrace SD
  • Checking required semantic fields

Example prompts

  • “/dt-obs-log-semantic-mapping”

What it can do on your machine

Read from SKILL.md and the folder at commit 4f9aa71. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • docs.dynatrace.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Dt Obs Log Semantic Mapping loads about 966 tokens when it runs, and up to ~13k if it reads all its reference files. Until then it costs about 115 tokens; SKILL.md has 348 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~115
When it runs · the whole SKILL.md, loaded when a task matches
~966
With references · SKILL.md plus every file in references/, read only if the agent opens them
~13k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from Dynatrace/dynatrace-for-ai at commit 4f9aa71, republished under its Apache-2.0 licence (© Dynatrace). 348 words, ~966 tokens.

Download SKILL.mdSave it as .claude/skills/dt-obs-log-semantic-mapping/SKILL.md (or your agent's skills folder). This skill also uses 8 other files; get the full folder from GitHub.
name
dt-obs-log-semantic-mapping
description
Suggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events. Use when: mapping a vendor audit log feed, authentication logs, user activity logs to the Dynatrace SD; checking required semantic fields; proposing OpenPipeline processor extraction rules based on DQL; running runtime validation (fetches live logs by log.source, then applies static validation).
license
Apache-2.0

dt-obs-log-semantic-mapping

Build and validate semantic-dictionary-aligned mappings for audit log integrations.

Purpose

Use this skill when a user wants to:

  • Suggest a mapping from a raw vendor audit log payload to Dynatrace fetch logs fields (Workflow A).
  • Validate a mapping against a pasted ingested log event (Workflow B1 — static).
  • Validate against live tenant data via live tenant access (Workflow B2 — runtime: fetches logs by log.source, then runs B1 on the result).

Log Classes

ClassDescriptionKey namespacesExample sources
authenticationLogin, logout, MFA, tokenaudit.*, actor.*, browser.*, device.*CyberArk, Okta, Azure SignInLogs
authorizationAccess decisions, permission changesaudit.*, actor.*, object.*CyberArk, Okta
user_actionCRUD on platform resourcesaudit.*, actor.*, object.*, product.*Okta, GitHub, Sonatype
httpHTTP request/response (WAF, network devices)http.*, url.*, server.*, geo.*, client.*Akamai SIEM, Cloudflare

Workflows

ModeInputSource
Workflow A — Suggest mappingRaw vendor log payloadreferences/mapping-workflow.md § Workflow A
Workflow B1 — Static validationPasted ingested log eventreferences/mapping-workflow.md § Workflow B1
Workflow B2 — Runtime validationlog.source value + live tenant accessreferences/runtime-validation.md — fetches logs, then runs B1

Key Concepts

Content field burial: The primary validation concern. Fields in content (the raw vendor payload) that could be promoted to top-level semantic attributes but are not. The skill always inventories buried vs promoted fields and proposes OpenPipeline extraction rules to fix gaps.

Prerequisite: When proposing OpenPipeline processor extraction rules, load the dt-dql-essentials skill first. OpenPipeline processors use DQL functions (parse, fieldsAdd, splitString, etc.) — using non-DQL syntax produces invalid rules.

Sparse mappings are valid: Integrations like GitHub or Sonatype may only populate core fields. Minimum required: timestamp, log.source, content, loglevel, audit.action, audit.identity.

References

  • references/data-model-notes.md — Log SD field taxonomy, audit namespace, enums, sample-derived patterns and known discrepancies
  • references/mapping-workflow.md — Intake checklist, Workflow A and B1 procedures, content field analysis, field priority order
  • references/validation-rules.md — Required fields, content/enum/type rules, discrepancy severity
  • references/openpipeline-constraints.md — OpenPipeline processor command/function/operator/matcher restrictions; parseJson unavailability + parse→fieldsFlatten alternative; iterative operators for array casting
  • references/report-format.md — Mapping table, diff table, OpenPipeline sketch, Validation Summary templates
  • references/runtime-validation.md — Workflow B2: fetch live records, then run B1
  • samples/audit-logs.json — Mapped samples: CyberArk, Okta, Azure SignInLogs, Sonatype, GitHub
  • samples/http-logs.json — Mapped samples: Akamai SIEM (WAF/HTTP class)
  • Dynatrace Log Semantic Dictionary

© Dynatrace, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 8 other files (references) in skills/dt-obs-log-semantic-mapping of Dynatrace/dynatrace-for-ai.

  • SKILL.md
  • references/data-model-notes.md
  • references/mapping-workflow.md
  • references/openpipeline-constraints.md
  • references/report-format.md
  • references/runtime-validation.md
  • references/validation-rules.md
  • samples/audit-logs.json
  • samples/http-logs.json

Open the folder on GitHubat commit 4f9aa71

Compare with similar skills

Dt Obs Log Semantic Mapping next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Dt Obs Log Semantic Mapping compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Dt Obs Log Semantic Mapping this skillDynatrace/dynatrace-for-ai162—~966Automated safety check: PassApache-2.0
Frontmcp Authoritiesagentfront/frontmcp146—~7.1kAutomated safety check: PassApache-2.0
Implementing Device Posture Assessment In Zero Trustmukul975/Anthropic-Cybersecurity-Skills34k—~4.1kAutomated safety check: PassApache-2.0
Implementing Google Workspace Sso Configurationmukul975/Anthropic-Cybersecurity-Skills34k—~2kAutomated safety check: PassApache-2.0
Implementing Scim Provisioning With Oktamukul975/Anthropic-Cybersecurity-Skills34k—~2.3kAutomated safety check: PassApache-2.0
Identity Access Managementsickn33/agentic-awesome-skills47k1 repos~2.9kAutomated safety check: PassMIT

Similar skills

  • Frontmcp Authorities

    agentfront/frontmcp

    A skill your agent uses when implementing authorization and access control for FrontMCP tools, resources, prompts, or skills, deciding who may invoke what.

    146 GitHub stars~7.1k tokensUpdated 3 days ago
    Backend & APIsAuto-check passed
  • Implementing Device Posture Assessment In Zero Trust

    mukul975/Anthropic-Cybersecurity-Skills

    Implements device posture assessment as a zero trust access control by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies that…

    34k GitHub stars~4.1k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed
  • Implementing Google Workspace Sso Configuration

    mukul975/Anthropic-Cybersecurity-Skills

    Configures SAML 2.0 single sign-on for Google Workspace against a third-party identity provider (Okta, Azure AD/Entra ID, ADFS), with Workspace as the Service Provider, to centralize authentication…

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed
  • Implementing Scim Provisioning With Okta

    mukul975/Anthropic-Cybersecurity-Skills

    Implement automated user lifecycle provisioning and deprovisioning using the SCIM 2.0 protocol with Okta as the identity provider.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed
  • Identity Access Management

    sickn33/agentic-awesome-skills

    Set up and manage SSO, SCIM provisioning, and MFA for startup teams using Google Workspace, Okta, or Azure AD.

    47k GitHub starsUsed in 1 repo~2.9k tokens
    Backend & APIsAuto-check passed
  • Managing Cloud Identity With Okta

    mukul975/Anthropic-Cybersecurity-Skills

    Implement Okta as a centralized cloud identity provider: configure SSO with AWS, Azure, and GCP, deploy phishing-resistant MFA with Okta FastPass, automate user provisioning/deprovisioning, and…

    34k GitHub stars~3.1k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed

More from Dynatrace/dynatrace-for-ai

All 33 skills in this repo
  • Dt Obs Analytics

    Dynatrace/dynatrace-for-ai

    Analyze dashboards and notebooks using Davis analyzers — anomaly detection, novelty scoring, and correlation.

    162 GitHub stars~3.9k tokensUpdated 8 days ago
    Auto-check passed
  • Dt Setup iOS

    Dynatrace/dynatrace-for-ai

    Set up the Dynatrace iOS SDK (OneAgent) in an iOS project using Swift Package Manager.

    162 GitHub stars~3.3k tokensUpdated 8 days ago
    Auto-check passed
  • Dt Alerting

    Dynatrace/dynatrace-for-ai

    End-to-end Dynatrace alerting lifecycle — anomaly detector setup and model selection (static threshold, adaptive baseline, seasonal baseline), alert event storage in Grail, problem grouping and…

    162 GitHub stars~3.3k tokensUpdated 8 days ago
    Auto-check passed
  • Dt Obs AWS

    Dynatrace/dynatrace-for-ai

    AWS cloud resource monitoring including EC2, RDS, Lambda, ECS/EKS, VPC networking, load balancers, S3, DynamoDB, SQS/SNS, and cost optimization.

    162 GitHub stars~4.2k tokensUpdated 8 days ago
    Auto-check passed
  • Dt Obs Ext Monitors

    Dynatrace/dynatrace-for-ai

    3rd-party test and monitor result ingestion into Dynatrace Grail via the platform events ingest API (platform/ingest/custom/events/).

    162 GitHub stars~1.5k tokensUpdated 8 days ago
    Auto-check passed
  • Dt Obs Problems

    Dynatrace/dynatrace-for-ai

    DAVIS problem analysis including root cause identification, impact assessment, and correlation with other telemetry.

    162 GitHub stars~4.6k tokensUpdated 8 days ago
    Auto-check passed

Works with

Categories

Questions about Dt Obs Log Semantic Mapping

What does Dt Obs Log Semantic Mapping do?

Suggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events. Dt Obs Log Semantic Mapping is an agent skill from Dynatrace/dynatrace-for-ai. Suggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events.

When should I use Dt Obs Log Semantic Mapping?

Dt Obs Log Semantic Mapping fits situations like: : mapping a vendor audit log feed; authentication logs; user activity logs to the Dynatrace SD; checking required semantic fields.

How do I install Dt Obs Log Semantic Mapping in Claude Code?

Run `npx skills add Dynatrace/dynatrace-for-ai --skill dt-obs-log-semantic-mapping -a claude-code`. Or copy the skill folder (skills/dt-obs-log-semantic-mapping in Dynatrace/dynatrace-for-ai) into .claude/skills/dt-obs-log-semantic-mapping in your project. Claude Code loads it when a task matches its description.

How do I install Dt Obs Log Semantic Mapping in Codex?

Run `npx skills add Dynatrace/dynatrace-for-ai --skill dt-obs-log-semantic-mapping -a codex`. Or copy the skill folder (skills/dt-obs-log-semantic-mapping in Dynatrace/dynatrace-for-ai) into .agents/skills/dt-obs-log-semantic-mapping in your project. Codex loads it when a task matches its description.

Can I use Dt Obs Log Semantic Mapping in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Dynatrace/dynatrace-for-ai --skill dt-obs-log-semantic-mapping -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/dt-obs-log-semantic-mapping, .gemini/skills/dt-obs-log-semantic-mapping, .github/skills/dt-obs-log-semantic-mapping and .opencode/skills/dt-obs-log-semantic-mapping in your project.

What does Dt Obs Log Semantic Mapping need to run?

SKILL.md names no scripts, command-line tools or credentials: Dt Obs Log Semantic Mapping is instructions for the agent only.

Does Dt Obs Log Semantic Mapping access the network?

SKILL.md names 1 domain. As links in the text: docs.dynatrace.com. This is read from the text; nothing was executed.

Is Dt Obs Log Semantic Mapping safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Dt Obs Log Semantic Mapping use?

Dt Obs Log Semantic Mapping is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Dt Obs Log Semantic Mapping use?

About 966 tokens (SKILL.md is roughly 3.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 12k tokens, read only when the agent opens those files.

What are the alternatives to Dt Obs Log Semantic Mapping?

Skills that share tags, products or a category with Dt Obs Log Semantic Mapping: Frontmcp Authorities (agentfront/frontmcp, 146 stars), Implementing Device Posture Assessment In Zero Trust (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Implementing Google Workspace Sso Configuration (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Implementing Scim Provisioning With Okta (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Dt Obs Log Semantic Mapping?

Dynatrace (a GitHub organization) maintains it in Dynatrace/dynatrace-for-ai, which has 162 GitHub stars. The repository holds 33 skills in this directory. The repository was last updated on October 1, 2026.

Source: Dynatrace/dynatrace-for-ai on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.