Security problems API - GET a problem

Gets the details of the specified security problem.

The request produces an application/json payload.

Early Adopter

This request is an Early Adopter release and may be changed in non-compatible way.

GET	Managed	`https://{your-domain}/e/{your-environment-id}/api/v2/securityProblems/{id}`
	SaaS	`https://{your-environment-id}.live.dynatrace.com/api/v2/securityProblems/{id}`
	Environment ActiveGate	`https://{your-activegate-domain}/e/{your-environment-id}/api/v2/securityProblems/{id}`

Authentication

To execute this request, you need an access token with Read security problems (securityProblems.read) scope. To learn how to obtain and use it, see Tokens and authentication.

Parameters

Parameter Type Description In Required

string

Parameter	Type	Description	In	Required
id	string	The ID of the required security problem.	path	required
fields	string	A list of additional security problem properties you can add to the response. The following properties are available (all other properties are always included and you can't remove them from the response): `riskAssessment`: A risk assessment of the security problem. `managementZones`: The management zone where the security problem occurred. `description`: The description of the vulnerability. `events`: A list of events of the security problem. `vulnerableComponents`: A list of vulnerable components of the security problem. `affectedEntities`: A list of affected entities of the security problem. `exposedEntities`: A list of exposed entities of the security problem. `reachableDataAssets`: A list of data assets reachable by affected entities of the security problem. `relatedEntities`: A list of related entities of the security problem. `relatedContainerImages`: A list of related container images of the security problem. To add properties, specify them in a comma-separated list and prefix each property with a plus (for example, `+riskAssessment,+managementZones`).	query	optional

The ID of the required security problem.

path

required

fields

string

A list of additional security problem properties you can add to the response.

The following properties are available (all other properties are always included and you can't remove them from the response):

riskAssessment: A risk assessment of the security problem.
managementZones: The management zone where the security problem occurred.
description: The description of the vulnerability.
events: A list of events of the security problem.
vulnerableComponents: A list of vulnerable components of the security problem.
affectedEntities: A list of affected entities of the security problem.
exposedEntities: A list of exposed entities of the security problem.
reachableDataAssets: A list of data assets reachable by affected entities of the security problem.
relatedEntities: A list of related entities of the security problem.
relatedContainerImages: A list of related container images of the security problem.

To add properties, specify them in a comma-separated list and prefix each property with a plus (for example, +riskAssessment,+managementZones).

query

optional

Response

Response codes

Code	Type	Description
200	SecurityProblemDetails	Success. The response contains parameters of the security problem.

Response body objects

The `SecurityProblemDetails` object

Parameters of a security problem

Element	Type	Description
securityProblemId	string	The ID of the security problem. Can be `null`.
displayId	string	The display ID of the security problem. Can be `null`.
status	string	The status of the security problem. The element can hold these values `OPEN` `RESOLVED` Can be `null`.
muted	boolean	The security problem is (`true`) or is not (`false`) muted. Can be `null`.
externalVulnerabilityId	string	The external vulnerability ID of the security problem. Can be `null`.
vulnerabilityType	string	The type of the vulnerability. The element can hold these values `RUNTIME` `THIRD_PARTY` Can be `null`.
title	string	The title of the security problem. Can be `null`.
packageName	string	The package name of the security problem. Can be `null`.
url	string	The URL to the security problem details page. Can be `null`.
description	string	The description of the security problem. Can be `null`.
technology	string	The technology of the security problem. The element can hold these values `DOTNET` `JAVA` `KUBERNETES` `NODE_JS` `PHP` Can be `null`.
firstSeenTimestamp	integer	The timestamp of the first occurrence of the security problem. Can be `null`.
lastUpdatedTimestamp	integer	The timestamp of the most recent security problem change. Can be `null`.
riskAssessment	RiskAssessment	Risk assessment of a security problem. Can be `null`.
managementZones	ManagementZone[]	A list of management zones which the affected entities belong to. Can be `null`.
cveIds	string[]	A list of CVE IDs of the security problem. Can be `null`.
events	SecurityProblemEvent[]	An ordered (newest first) list of events of the security problem. Can be `null`.
vulnerableComponents	VulnerableComponent[]	A list of vulnerable components of the security problem. A vulnerable component is what causes the security problem. Can be `null`.
affectedEntities	string[]	A list of affected entities of the security problem. An affected entity is an entity where a vulnerable component runs. Can be `null`.
exposedEntities	string[]	A list of exposed entities of the security problem. An exposed entity is an affected entity that is exposed to the internet. Can be `null`.
reachableDataAssets	string[]	A list of data assets reachable by affected entities of the security problem. A data asset is a service that has database access. Can be `null`.
relatedEntities	RelatedEntitiesList	A list of related entities of the security problem. A related entity is a monitored entity that is directly or indirectly related to an affected entity (for example, it could be a host where an affected process runs). Each related entity contains a list of corresponding affected entities (for example, an affected process running on this host). Can be `null`.
relatedContainerImages	object[]	A list of related container images. Can be `null`.
muteStateChangeInProgress	boolean	If `true` a change of the mute state is in progress. Can be `null`.

The `RiskAssessment` object

Risk assessment of a security problem.

Element	Type	Description
riskLevel	string	The Davis risk level. It is calculated by Dynatrace on the basis of CVSS score. The element can hold these values `CRITICAL` `HIGH` `LOW` `MEDIUM` `NONE` Can be `null`.
riskScore	number	The Davis risk score (1-10). It is calculated by Dynatrace on the basis of CVSS score. Can be `null`.
riskVector	string	The attack vector calculated by Dynatrace based on the CVSS attack vector. Can be `null`.
baseRiskLevel	string	The risk level from the CVSS score. The element can hold these values `CRITICAL` `HIGH` `LOW` `MEDIUM` `NONE` Can be `null`.
baseRiskScore	number	The risk score (1-10) from the CVSS score. Can be `null`.
baseRiskVector	string	The original attack vector of the CVSS assessment. Can be `null`.
exposure	string	The level of exposure of affected entities. The element can hold these values `NOT_AVAILABLE` `NOT_DETECTED` `PUBLIC_NETWORK` Can be `null`.
dataAssets	string	The reachability of related data assets by affected entities. The element can hold these values `NOT_AVAILABLE` `NOT_DETECTED` `REACHABLE` Can be `null`.
publicExploit	string	The availability status of public exploits. The element can hold these values `AVAILABLE` `NOT_AVAILABLE` Can be `null`.
vulnerableFunctionUsage	string	The state of vulnerable code execution. The element can hold these values `IN_USE` `NOT_AVAILABLE` `NOT_IN_USE` Can be `null`.

The `ManagementZone` object

A short representation of a management zone.

Element Type Description

name

string

Element	Type	Description
name	string	The name of the management zone. Can be `null`.
id	string	The ID of the management zone. Can be `null`.

The name of the management zone.

Can be null.

string

The ID of the management zone.

Can be null.

The `SecurityProblemEvent` object

The event of a security problem.

Element	Type	Description
timestamp	integer	The timestamp when the event occurred. Can be `null`.
reason	string	The reason of the event creation. The element can hold these values `SECURITY_PROBLEM_CREATED` `SECURITY_PROBLEM_MUTED` `SECURITY_PROBLEM_REOPENED` `SECURITY_PROBLEM_RESOLVED` `SECURITY_PROBLEM_UNMUTED` Can be `null`.
riskAssessmentSnapshot	RiskAssessmentSnapshot	A snapshot of the risk assessment of a security problem. Can be `null`.
muteState	MuteState	Metadata of the muted state of a security problem in relation to an event. Can be `null`.

The `RiskAssessmentSnapshot` object

A snapshot of the risk assessment of a security problem.

Element	Type	Description
numberOfAffectedEntities	integer	The number of currently affected entities. Can be `null`.
numberOfReachableDataAssets	integer	The number of data assets that are currently reachable by affected entities. Can be `null`.
publicExploit	string	The availability status of public exploits. The element can hold these values `AVAILABLE` `NOT_AVAILABLE` Can be `null`.
exposure	string	The level of exposure of affected entities. The element can hold these values `NOT_AVAILABLE` `NOT_DETECTED` `PUBLIC_NETWORK` Can be `null`.
vulnerableFunctionUsage	string	The state of vulnerable code execution. The element can hold these values `IN_USE` `NOT_AVAILABLE` `NOT_IN_USE` Can be `null`.

The `MuteState` object

Metadata of the muted state of a security problem in relation to an event.

Element Type Description

user

string

Element	Type	Description
user	string	The user who has muted or unmuted the problem. Can be `null`.
reason	string	The reason for the mute state change. The element can hold these values `AFFECTED` `CONFIGURATION_NOT_AFFECTED` `FALSE_POSITIVE` `IGNORE` `INITIAL_STATE` `OTHER` `VULNERABLE_CODE_NOT_IN_USE` Can be `null`.
comment	string	A user's comment. Can be `null`.

The user who has muted or unmuted the problem.

Can be null.

reason

string

The reason for the mute state change.

The element can hold these values

AFFECTED
CONFIGURATION_NOT_AFFECTED
FALSE_POSITIVE
IGNORE
INITIAL_STATE
OTHER
VULNERABLE_CODE_NOT_IN_USE

Can be null.

comment

string

A user's comment.

Can be null.

The `VulnerableComponent` object

Vulnerable component of a security problem.

Element	Type	Description
id	string	The Dynatrace entity ID of the vulnerable component. Can be `null`.
displayName	string	The display name of the vulnerable component. Can be `null`.
fileName	string	The file name of the vulnerable component. Can be `null`.
numberOfAffectedEntities	integer	The number of affected entities. Can be `null`.
affectedEntities	string[]	A list of affected entities. Can be `null`.

The `RelatedEntitiesList` object

A list of related entities of the security problem.

A related entity is a monitored entity that is directly or indirectly related to an affected entity (for example, it could be a host where an affected process runs).

Each related entity contains a list of corresponding affected entities (for example, an affected process running on this host).

Element	Type	Description
applications	RelatedEntity[]	A list of related applications. Can be `null`.
services	RelatedService[]	A list of related services. Can be `null`.
hosts	RelatedEntity[]	A list of related hosts. Can be `null`.
databases	string[]	A list of related databases. Can be `null`.
kubernetesWorkloads	RelatedEntity[]	A list of related Kubernetes workloads. Can be `null`.
kubernetesClusters	RelatedEntity[]	A list of related Kubernetes clusters. Can be `null`.

The `RelatedEntity` object

An entity related to a security problem.

Element Type Description

string

The Dynatrace entity ID of the entity.

Can be null.

numberOfAffectedEntities

integer

The number of affected entities related to the entity.

Can be null.

affectedEntities

string[]

A list of affected entities related to the entity.

Can be null.

The `RelatedService` object

A service related to a security problem.

Element	Type	Description
id	string	The Dynatrace entity ID of the entity. Can be `null`.
numberOfAffectedEntities	integer	The number of affected entities related to the entity. Can be `null`.
affectedEntities	string[]	A list of affected entities related to the entity. Can be `null`.
exposure	string	The level of exposure of the service. The element can hold these values `NOT_AVAILABLE` `NOT_DETECTED` `PUBLIC_NETWORK` Can be `null`.

The `RelatedContainerImage` object

Related container image of a security problem.

Element	Type	Description
imageId	string	The image ID of the related container image. Can be `null`.
imageName	string	The image name of the related container image. Can be `null`.
numberOfAffectedEntities	integer	The number of affected entities. Can be `null`.
affectedEntities	string[]	A list of affected entities. Can be `null`.

Response body JSON model

json
{
  "securityProblemId": "string",
  "displayId": "string",
  "status": "OPEN",
  "muted": true,
  "externalVulnerabilityId": "string",
  "vulnerabilityType": "RUNTIME",
  "title": "string",
  "packageName": "string",
  "url": "string",
  "description": "string",
  "technology": "DOTNET",
  "firstSeenTimestamp": 1,
  "lastUpdatedTimestamp": 1,
  "riskAssessment": {
    "riskLevel": "CRITICAL",
    "riskScore": 1,
    "riskVector": "string",
    "baseRiskLevel": "CRITICAL",
    "baseRiskScore": 1,
    "baseRiskVector": "string",
    "exposure": "NOT_AVAILABLE",
    "dataAssets": "NOT_AVAILABLE",
    "publicExploit": "AVAILABLE",
    "vulnerableFunctionUsage": "IN_USE"
  },
  "managementZones": [
    {
      "name": "string",
      "id": "string"
    }
  ],
  "cveIds": [
    "string"
  ],
  "events": [
    {
      "timestamp": 1,
      "reason": "SECURITY_PROBLEM_CREATED",
      "riskAssessmentSnapshot": {
        "numberOfAffectedEntities": 1,
        "numberOfReachableDataAssets": 1,
        "publicExploit": "AVAILABLE",
        "exposure": "NOT_AVAILABLE",
        "vulnerableFunctionUsage": "IN_USE"
      },
      "muteState": {
        "user": "string",
        "reason": "AFFECTED",
        "comment": "string"
      }
    }
  ],
  "vulnerableComponents": [
    {
      "id": "string",
      "displayName": "string",
      "fileName": "string",
      "numberOfAffectedEntities": 1,
      "affectedEntities": [
        "string"
      ]
    }
  ],
  "affectedEntities": [
    "string"
  ],
  "exposedEntities": [
    "string"
  ],
  "reachableDataAssets": [
    "string"
  ],
  "relatedEntities": {
    "applications": [
      {
        "id": "string",
        "numberOfAffectedEntities": 1,
        "affectedEntities": [
          "string"
        ]
      }
    ],
    "services": [
      {
        "id": "string",
        "numberOfAffectedEntities": 1,
        "affectedEntities": [
          "string"
        ],
        "exposure": "NOT_AVAILABLE"
      }
    ],
    "hosts": [
      {}
    ],
    "databases": [
      "string"
    ],
    "kubernetesWorkloads": [
      {}
    ],
    "kubernetesClusters": [
      {}
    ]
  },
  "relatedContainerImages": [
    {
      "containerImages": [
        {
          "imageId": "string",
          "imageName": "string",
          "numberOfAffectedEntities": 1,
          "affectedEntities": [
            "string"
          ]
        }
      ]
    }
  ],
  "muteStateChangeInProgress": true
}

Security problems API - GET a problem

Authentication

Parameters

Response

Response codes

Response body objects

The SecurityProblemDetails object

The RiskAssessment object

The ManagementZone object

The SecurityProblemEvent object

The RiskAssessmentSnapshot object

The MuteState object

The VulnerableComponent object

The RelatedEntitiesList object

The RelatedEntity object

The RelatedService object

The RelatedContainerImage object

Response body JSON model

The `SecurityProblemDetails` object

The `RiskAssessment` object

The `ManagementZone` object

The `SecurityProblemEvent` object

The `RiskAssessmentSnapshot` object

The `MuteState` object

The `VulnerableComponent` object

The `RelatedEntitiesList` object

The `RelatedEntity` object

The `RelatedService` object

The `RelatedContainerImage` object