Dt Obs Log Semantic Mapping

dt-obs-log-semantic-mapping

Build and validate semantic-dictionary-aligned mappings for audit log integrations.

Purpose

Use this skill when a user wants to:

• Suggest a mapping from a raw vendor audit log payload to Dynatrace fetch logs fields (Workflow A).
• Validate a mapping against a pasted ingested log event (Workflow B1 — static).
• Validate against live tenant data via live tenant access (Workflow B2 — runtime: fetches logs by log.source, then runs B1 on the result).

Log Classes

| Class | Description | Key namespaces | Example sources |

|---|---|---|---|

| authentication | Login, logout, MFA, token | audit.*, actor.*, browser.*, device.* | CyberArk, Okta, Azure SignInLogs |

| authorization | Access decisions, permission changes | audit.*, actor.*, object.* | CyberArk, Okta |

| user_action | CRUD on platform resources | audit.*, actor.*, object.*, product.* | Okta, GitHub, Sonatype |

| http | HTTP request/response (WAF, network devices) | http.*, url.*, server.*, geo.*, client.* | Akamai SIEM, Cloudflare |

Workflows

| Mode | Input | Source |

|---|---|---|

| Workflow A — Suggest mapping | Raw vendor log payload | references/mapping-workflow.md § Workflow A |

| Workflow B1 — Static validation | Pasted ingested log event | references/mapping-workflow.md § Workflow B1 |

| Workflow B2 — Runtime validation | log.source value + live tenant access | references/runtime-validation.md — fetches logs, then runs B1 |

Key Concepts

Content field burial: The primary validation concern. Fields in content (the raw vendor payload) that could be promoted to top-level semantic attributes but are not. The skill always inventories buried vs promoted fields and proposes OpenPipeline extraction rules to fix gaps.

> Prerequisite: When proposing OpenPipeline processor extraction rules, load the dt-dql-essentials skill first. OpenPipeline processors use DQL functions (parse, fieldsAdd, splitString, etc.) — using non-DQL syntax produces invalid rules.

Sparse mappings are valid: Integrations like GitHub or Sonatype may only populate core fields. Minimum required: timestamp, log.source, content, loglevel, audit.action, audit.identity.

References

• references/data-model-notes.md — Log SD field taxonomy, audit namespace, enums, sample-derived patterns and known discrepancies
• references/mapping-workflow.md — Intake checklist, Workflow A and B1 procedures, content field analysis, field priority order
• references/validation-rules.md — Required fields, content/enum/type rules, discrepancy severity
• references/openpipeline-constraints.md — OpenPipeline processor command/function/operator/matcher restrictions; parseJson unavailability + parse→fieldsFlatten alternative; iterative operators for array casting
• references/report-format.md — Mapping table, diff table, OpenPipeline sketch, Validation Summary templates
• references/runtime-validation.md — Workflow B2: fetch live records, then run B1
• samples/audit-logs.json — Mapped samples: CyberArk, Okta, Azure SignInLogs, Sonatype, GitHub
• samples/http-logs.json — Mapped samples: Akamai SIEM (WAF/HTTP class)
• Dynatrace Log Semantic Dictionary