• Home
  • API
  • Environment
  • Application Security
  • Vulnerabilities
  • GET vulnerability details

Vulnerabilities API - GET vulnerability details

Lists the details of a specific vulnerability.

The request produces an application/json payload.

GETManagedDynatrace for Governmenthttps://{your-domain}/e/{your-environment-id}/api/v2/securityProblems/{id}
SaaShttps://{your-environment-id}.live.dynatrace.com/api/v2/securityProblems/{id}
Environment ActiveGatehttps://{your-activegate-domain}/e/{your-environment-id}/api/v2/securityProblems/{id}

Authentication

To execute this request, you need an access token with securityProblems.read scope.

To learn how to obtain and use it, see Tokens and authentication.

Parameters

ParameterTypeDescriptionInRequired
idstring

The ID of the required security problem.

pathrequired
fieldsstring

A list of additional security problem properties you can add to the response.

The following properties are available (all other properties are always included and you can't remove them from the response):

  • riskAssessment: A risk assessment of the security problem.
  • managementZones: The management zone where the security problem occurred.
  • codeLevelVulnerabilityDetails: Details of the code-level vulnerability.
  • globalCounts: Globally calculated statistics about the security problem. No management zone information is taken into account.
  • filteredCounts: Statistics about the security problem, filtered by the management zone and timeframe start ('from') query parameters.
  • description: The description of the vulnerability.
  • events: The security problem's last 10 events within the last 365 days, sorted from newest to oldest.
  • vulnerableComponents: A list of vulnerable components of the security problem within the provided filter range.
  • affectedEntities: A list of affected entities of the security problem within the provided filter range.
  • exposedEntities: A list of exposed entities of the security problem within the provided filter range.
  • reachableDataAssets: A list of data assets reachable by affected entities of the security problem within the provided filter range.
  • relatedEntities: A list of related entities of the security problem within the provided filter range.
  • relatedContainerImages: A list of related container images of the security problem within the provided filter range.
  • relatedAttacks: A list of attacks detected on the exposed security problem.
  • entryPoints: A list of entry points and a flag which indicates whether this list was truncated or not.

To add properties, specify them in a comma-separated list and prefix each property with a plus (for example, +riskAssessment,+managementZones).

queryoptional
fromstring

Based on the timeframe start the affected-, related- and vulnerable entities are being calculated. You can use one of the following formats:

  • Timestamp in UTC milliseconds.
  • Human-readable format of 2021-01-25T05:57:01.123+01:00. If no time zone is specified, UTC is used. You can use a space character instead of the T. Seconds and fractions of a second are optional.
  • Relative timeframe, back from now. The format is now-NU/A, where N is the amount of time, U is the unit of time, and A is an alignment. The alignment rounds all the smaller values to the nearest zero in the past. For example, now-1y/w is one year back, aligned by a week. You can also specify relative timeframe without an alignment: now-NU. Supported time units for the relative timeframe are:
    • m: minutes
    • h: hours
    • d: days
    • w: weeks
    • M: months
    • y: years

If not set, the default timeframe start of 24 hours in the past is used (now-24h).

The timeframe start must not be older than 365 days.

queryoptional

Response

Response codes

CodeTypeDescription
200SecurityProblemDetails

Success. The response contains parameters of the security problem.

Response body objects

The SecurityProblemDetails object

Parameters of a security problem

ElementTypeDescription
affectedEntitiesstring[]

A list of affected entities of the security problem.

An affected entity is an entity where a vulnerable component runs.

codeLevelVulnerabilityDetailsCodeLevelVulnerabilityDetails

The details of a code-level vulnerability.

cveIdsstring[]

A list of CVE IDs of the security problem.

descriptionstring

The description of the security problem.

displayIdstring

The display ID of the security problem.

entryPointsEntryPoints

A list of entry points and a flag which indicates whether this list was truncated or not.

eventsSecurityProblemEvent[]

An ordered (newest first) list of events of the security problem.

exposedEntitiesstring[]

A list of exposed entities of the security problem.

An exposed entity is an affected entity that is exposed to the internet.

externalVulnerabilityIdstring

The external vulnerability ID of the security problem.

filteredCountsFilteredCountsDto

Statistics about the security problem, filtered by the management zone and timeframe start ('from') query parameters.

firstSeenTimestampinteger

The timestamp of the first occurrence of the security problem.

globalCountsGlobalCountsDto

Globally calculated statistics about the security problem. No management zone information is taken into account.

lastOpenedTimestampinteger

The timestamp when the security problem was last opened.

lastResolvedTimestampinteger

The timestamp when the security problem was last resolved.

lastUpdatedTimestampinteger

The timestamp of the most recent security problem change.

managementZonesManagementZone[]

A list of management zones which the affected entities belong to.

muteStateChangeInProgressboolean

If true a change of the mute state is in progress.

mutedboolean

The security problem is (true) or is not (false) muted.

packageNamestring

The package name of the security problem.

reachableDataAssetsstring[]

A list of data assets reachable by affected entities of the security problem.

A data asset is a service that has database access.

relatedAttacksRelatedAttacksList

A list of related attacks of the security problem.

Related attacks are attacks on the exposed security problem.

relatedContainerImagesobject[]

A list of related container images.

relatedEntitiesRelatedEntitiesList

A list of related entities of the security problem.

A related entity is a monitored entity that is directly or indirectly related to an affected entity (for example, it could be a host where an affected process runs).

Each related entity contains a list of corresponding affected entities (for example, an affected process running on this host).

riskAssessmentRiskAssessment

Risk assessment of a security problem.

securityProblemIdstring

The ID of the security problem.

statusstring

The status of the security problem.

The element can hold these values
  • OPEN
  • RESOLVED
technologystring

The technology of the security problem.

The element can hold these values
  • DOTNET
  • GO
  • JAVA
  • KUBERNETES
  • NODE_JS
  • PHP
titlestring

The title of the security problem.

urlstring

The URL to the security problem details page.

vulnerabilityTypestring

The type of the vulnerability.

The element can hold these values
  • CODE_LEVEL
  • RUNTIME
  • THIRD_PARTY
vulnerableComponentsVulnerableComponent[]

A list of vulnerable components of the security problem.

A vulnerable component is what causes the security problem.

The CodeLevelVulnerabilityDetails object

The details of a code-level vulnerability.

ElementTypeDescription
processGroupIdsstring[]

The list of encoded MEIdentifier of the process groups.

processGroupsstring[]

The list of affected process groups.

shortVulnerabilityLocationstring

The code location of the vulnerability without package and parameter.

typestring

The type of code level vulnerability.

The element can hold these values
  • CMD_INJECTION
  • IMPROPER_INPUT_VALIDATION
  • SQL_INJECTION
vulnerabilityLocationstring

The code location of the vulnerability.

vulnerableFunctionstring

The vulnerable function of the vulnerability.

vulnerableFunctionInputVulnerableFunctionInput

Describes what got passed into the code level vulnerability.

The VulnerableFunctionInput object

Describes what got passed into the code level vulnerability.

ElementTypeDescription
inputSegmentsVulnerableFunctionInputSegment[]

A list of input segments.

typestring

The type of the input.

The element can hold these values
  • COMMAND
  • JNDI
  • SQL_STATEMENT

The VulnerableFunctionInputSegment object

Describes one segment that was passed into a vulnerable function.

ElementTypeDescription
typestring

The type of the input segment.

The element can hold these values
  • MALICIOUS_INPUT
  • REGULAR_INPUT
  • TAINTED_INPUT
valuestring

The value of the input segment.

The EntryPoints object

A list of entry points and a flag which indicates whether this list was truncated or not.

ElementTypeDescription
itemsEntryPoint[]

A list of entry points.

truncatedboolean

Indicates whether the list of entry points was truncated or not.

The EntryPoint object

Information about an entry point of a code-level vulnerability.

ElementTypeDescription
sourceHttpPathstring

Source HTTP path of entry points.

usageSegmentsEntryPointUsageSegment[]

List of entry point usage segments.

The EntryPointUsageSegment object

Describes one segment that was passed into a usage and the associated source name and type.

ElementTypeDescription
segmentTypestring

The type of this input segment.

The element can hold these values
  • MALICIOUS_INPUT
  • REGULAR_INPUT
  • TAINTED_INPUT
segmentValuestring

The value of this input segment.

sourceArgumentNamestring

The name used in the source for this segment.

sourceTypestring

The type of the HTTP request part that contains the value that was used in this segment.

The element can hold these values
  • HTTP_BODY
  • HTTP_COOKIE
  • HTTP_HEADER_NAME
  • HTTP_HEADER_VALUE
  • HTTP_OTHER
  • HTTP_PARAMETER_NAME
  • HTTP_PARAMETER_VALUE
  • HTTP_URL
  • UNKNOWN

The SecurityProblemEvent object

The event of a security problem.

ElementTypeDescription
muteStateMuteState

Metadata of the muted state of a security problem in relation to an event.

reasonstring

The reason of the event creation.

The element can hold these values
  • ASSESSMENT_CHANGED
  • SECURITY_PROBLEM_CREATED
  • SECURITY_PROBLEM_MUTED
  • SECURITY_PROBLEM_REOPENED
  • SECURITY_PROBLEM_RESOLVED
  • SECURITY_PROBLEM_UNMUTED
riskAssessmentSnapshotRiskAssessmentSnapshot

A snapshot of the risk assessment of a security problem.

timestampinteger

The timestamp when the event occurred.

The MuteState object

Metadata of the muted state of a security problem in relation to an event.

ElementTypeDescription
commentstring

A user's comment.

reasonstring

The reason for the mute state change.

The element can hold these values
  • AFFECTED
  • CONFIGURATION_NOT_AFFECTED
  • FALSE_POSITIVE
  • IGNORE
  • INITIAL_STATE
  • OTHER
  • VULNERABLE_CODE_NOT_IN_USE
userstring

The user who has muted or unmuted the problem.

The RiskAssessmentSnapshot object

A snapshot of the risk assessment of a security problem.

ElementTypeDescription
baseRiskScorenumber

The risk score (1-10) from the CVSS score.

changesRiskAssessmentChanges

All changes of the risk assessment.

exposurestring

The level of exposure of affected entities.

The element can hold these values
  • NOT_AVAILABLE
  • NOT_DETECTED
  • PUBLIC_NETWORK
numberOfAffectedEntitiesinteger

The number of currently affected entities.

numberOfAffectedNodesinteger

The number of currently affected nodes.

numberOfAffectedProcessGroupsinteger

The number of currently affected process groups.

numberOfReachableDataAssetsinteger

The number of data assets that are currently reachable by affected entities.

numberOfRelatedAttacksinteger

The number of related attacks.

publicExploitstring

The availability status of public exploits.

The element can hold these values
  • AVAILABLE
  • NOT_AVAILABLE
riskLevelstring

The Davis risk level.

It is calculated by Dynatrace on the basis of CVSS score.

The element can hold these values
  • CRITICAL
  • HIGH
  • LOW
  • MEDIUM
  • NONE
riskScorenumber

The Davis risk score (1-10).

It is calculated by Dynatrace on the basis of CVSS score.

vulnerableFunctionUsagestring

The state of vulnerable code execution.

The element can hold these values
  • IN_USE
  • NOT_AVAILABLE
  • NOT_IN_USE

The RiskAssessmentChanges object

All changes of the risk assessment.

ElementTypeDescription
deltaBaseRiskScorenumber

The delta of the risk score.

deltaNumberOfAffectedNodesinteger

The delta of the number of currently affected nodes.

deltaNumberOfAffectedProcessGroupsinteger

The delta of the number of currently affected process groups.

deltaNumberOfReachableDataAssetsinteger

The delta of the number of data assets that are currently reachable by affected entities.

deltaNumberOfRelatedAttacksinteger

The delta of the number of related attacks.

deltaRiskScorenumber

The delta of the Davis risk score.

previousExposurestring

The previous level of exposure of affected entities.

The element can hold these values
  • NOT_AVAILABLE
  • NOT_DETECTED
  • PUBLIC_NETWORK
previousPublicExploitstring

The previous availability status of public exploits.

The element can hold these values
  • AVAILABLE
  • NOT_AVAILABLE
previousVulnerableFunctionUsagestring

The previous state of vulnerable code execution.

The element can hold these values
  • IN_USE
  • NOT_AVAILABLE
  • NOT_IN_USE

The FilteredCountsDto object

Statistics about the security problem, filtered by the management zone and timeframe start ('from') query parameters.

ElementTypeDescription
affectedNodesinteger

Number of affected nodes

affectedProcessGroupInstancesinteger

Number of affected processes

affectedProcessGroupsinteger

Number of affected process groups

exposedProcessGroupsinteger

Number of exposed process groups

reachableDataAssetsinteger

Number of reachable data assets

relatedApplicationsinteger

Number of related applications

relatedAttacksinteger

Number of related attacks

relatedDatabasesinteger

Number of related databases

relatedHostsinteger

Number of related hosts

relatedKubernetesClustersinteger

Number of related Kubernetes clusters

relatedKubernetesWorkloadsinteger

Number of related Kubernetes workloads

relatedServicesinteger

Number of related services

vulnerableComponentsinteger

Number of vulnerable components

The GlobalCountsDto object

Globally calculated statistics about the security problem. No management zone information is taken into account.

ElementTypeDescription
affectedNodesinteger

Number of affected nodes

affectedProcessGroupInstancesinteger

Number of affected process group instances

affectedProcessGroupsinteger

Number of affected process groups

exposedProcessGroupsinteger

Number of exposed process groups

reachableDataAssetsinteger

Number of reachable data assets exposed

relatedApplicationsinteger

Number of related applications

relatedAttacksinteger

Number of attacks on the exposed security problem

relatedHostsinteger

Number of related hosts

relatedKubernetesClustersinteger

Number of related kubernetes cluster

relatedKubernetesWorkloadsinteger

Number of related kubernetes workloads

relatedServicesinteger

Number of related services

vulnerableComponentsinteger

Number of vulnerable components

The ManagementZone object

A short representation of a management zone.

ElementTypeDescription
idstring

The ID of the management zone.

namestring

The name of the management zone.

The RelatedAttacksList object

A list of related attacks of the security problem.

Related attacks are attacks on the exposed security problem.

ElementTypeDescription
attacksstring[]

A list of related attack ids.

The RelatedContainerImage object

Related container image of a security problem.

ElementTypeDescription
affectedEntitiesstring[]

A list of affected entities.

imageIdstring

The image ID of the related container image.

imageNamestring

The image name of the related container image.

numberOfAffectedEntitiesinteger

The number of affected entities.

The RelatedEntitiesList object

A list of related entities of the security problem.

A related entity is a monitored entity that is directly or indirectly related to an affected entity (for example, it could be a host where an affected process runs).

Each related entity contains a list of corresponding affected entities (for example, an affected process running on this host).

ElementTypeDescription
applicationsRelatedEntity[]

A list of related applications.

databasesstring[]

A list of related databases.

hostsRelatedEntity[]

A list of related hosts.

kubernetesClustersRelatedEntity[]

A list of related Kubernetes clusters.

kubernetesWorkloadsRelatedEntity[]

A list of related Kubernetes workloads.

servicesRelatedService[]

A list of related services.

The RelatedEntity object

An entity related to a security problem.

ElementTypeDescription
affectedEntitiesstring[]

A list of affected entities related to the entity.

idstring

The Dynatrace entity ID of the entity.

numberOfAffectedEntitiesinteger

The number of affected entities related to the entity.

The RelatedService object

A service related to a security problem.

ElementTypeDescription
affectedEntitiesstring[]

A list of affected entities related to the entity.

exposurestring

The level of exposure of the service.

The element can hold these values
  • NOT_AVAILABLE
  • NOT_DETECTED
  • PUBLIC_NETWORK
idstring

The Dynatrace entity ID of the entity.

numberOfAffectedEntitiesinteger

The number of affected entities related to the entity.

The RiskAssessment object

Risk assessment of a security problem.

ElementTypeDescription
assessmentAccuracystring

The level of available information on which this assessment has been done.

The element can hold these values
  • FULL
  • NOT_AVAILABLE
  • REDUCED
baseRiskLevelstring

The risk level from the CVSS score.

The element can hold these values
  • CRITICAL
  • HIGH
  • LOW
  • MEDIUM
  • NONE
baseRiskScorenumber

The risk score (1-10) from the CVSS score.

baseRiskVectorstring

The original attack vector of the CVSS assessment.

dataAssetsstring

The reachability of related data assets by affected entities.

The element can hold these values
  • NOT_AVAILABLE
  • NOT_DETECTED
  • REACHABLE
exposurestring

The level of exposure of affected entities.

The element can hold these values
  • NOT_AVAILABLE
  • NOT_DETECTED
  • PUBLIC_NETWORK
publicExploitstring

The availability status of public exploits.

The element can hold these values
  • AVAILABLE
  • NOT_AVAILABLE
riskLevelstring

The Davis risk level.

It is calculated by Dynatrace on the basis of CVSS score.

The element can hold these values
  • CRITICAL
  • HIGH
  • LOW
  • MEDIUM
  • NONE
riskScorenumber

The Davis risk score (1-10).

It is calculated by Dynatrace on the basis of CVSS score.

riskVectorstring

The attack vector calculated by Dynatrace based on the CVSS attack vector.

vulnerableFunctionUsagestring

The state of vulnerable code execution.

The element can hold these values
  • IN_USE
  • NOT_AVAILABLE
  • NOT_IN_USE

The VulnerableComponent object

Vulnerable component of a security problem.

ElementTypeDescription
affectedEntitiesstring[]

A list of affected entities.

displayNamestring

The display name of the vulnerable component.

fileNamestring

The file name of the vulnerable component.

idstring

The Dynatrace entity ID of the vulnerable component.

numberOfAffectedEntitiesinteger

The number of affected entities.

shortNamestring

The short, component-only name of the vulnerable component.

Response body JSON model

json
{ "affectedEntities": [ "string" ], "codeLevelVulnerabilityDetails": { "processGroupIds": [ "string" ], "processGroups": [ "string" ], "shortVulnerabilityLocation": "string", "type": "CMD_INJECTION", "vulnerabilityLocation": "string", "vulnerableFunction": "string", "vulnerableFunctionInput": { "inputSegments": [ { "type": "MALICIOUS_INPUT", "value": "string" } ], "type": "COMMAND" } }, "cveIds": [ "string" ], "description": "string", "displayId": "string", "entryPoints": { "items": [ { "sourceHttpPath": "string", "usageSegments": [ { "segmentType": "MALICIOUS_INPUT", "segmentValue": "string", "sourceArgumentName": "string", "sourceType": "HTTP_BODY" } ] } ], "truncated": true }, "events": [ { "muteState": { "comment": "string", "reason": "AFFECTED", "user": "string" }, "reason": "ASSESSMENT_CHANGED", "riskAssessmentSnapshot": { "baseRiskScore": 1, "changes": { "deltaBaseRiskScore": 1, "deltaNumberOfAffectedNodes": 1, "deltaNumberOfAffectedProcessGroups": 1, "deltaNumberOfReachableDataAssets": 1, "deltaNumberOfRelatedAttacks": 1, "deltaRiskScore": 1, "previousExposure": "NOT_AVAILABLE", "previousPublicExploit": "AVAILABLE", "previousVulnerableFunctionUsage": "IN_USE" }, "exposure": "NOT_AVAILABLE", "numberOfAffectedEntities": 1, "numberOfAffectedNodes": 1, "numberOfAffectedProcessGroups": 1, "numberOfReachableDataAssets": 1, "numberOfRelatedAttacks": 1, "publicExploit": "AVAILABLE", "riskLevel": "CRITICAL", "riskScore": 1, "vulnerableFunctionUsage": "IN_USE" }, "timestamp": 1 } ], "exposedEntities": [ "string" ], "externalVulnerabilityId": "string", "filteredCounts": { "affectedNodes": 1, "affectedProcessGroupInstances": 1, "affectedProcessGroups": 1, "exposedProcessGroups": 1, "reachableDataAssets": 1, "relatedApplications": 1, "relatedAttacks": 1, "relatedDatabases": 1, "relatedHosts": 1, "relatedKubernetesClusters": 1, "relatedKubernetesWorkloads": 1, "relatedServices": 1, "vulnerableComponents": 1 }, "firstSeenTimestamp": 1, "globalCounts": { "affectedNodes": 1, "affectedProcessGroupInstances": 1, "affectedProcessGroups": 1, "exposedProcessGroups": 1, "reachableDataAssets": 1, "relatedApplications": 1, "relatedAttacks": 1, "relatedHosts": 1, "relatedKubernetesClusters": 1, "relatedKubernetesWorkloads": 1, "relatedServices": 1, "vulnerableComponents": 1 }, "lastOpenedTimestamp": 1, "lastResolvedTimestamp": 1, "lastUpdatedTimestamp": 1, "managementZones": [ { "id": "string", "name": "string" } ], "muteStateChangeInProgress": true, "muted": true, "packageName": "string", "reachableDataAssets": [ "string" ], "relatedAttacks": { "attacks": [ "string" ] }, "relatedContainerImages": [ { "containerImages": [ { "affectedEntities": [ "string" ], "imageId": "string", "imageName": "string", "numberOfAffectedEntities": 1 } ] } ], "relatedEntities": { "applications": [ { "affectedEntities": [ "string" ], "id": "string", "numberOfAffectedEntities": 1 } ], "databases": [ "string" ], "hosts": [ {} ], "kubernetesClusters": [ {} ], "kubernetesWorkloads": [ {} ], "services": [ { "affectedEntities": [ "string" ], "exposure": "NOT_AVAILABLE", "id": "string", "numberOfAffectedEntities": 1 } ] }, "riskAssessment": { "assessmentAccuracy": "FULL", "baseRiskLevel": "CRITICAL", "baseRiskScore": 1, "baseRiskVector": "string", "dataAssets": "NOT_AVAILABLE", "exposure": "NOT_AVAILABLE", "publicExploit": "AVAILABLE", "riskLevel": "CRITICAL", "riskScore": 1, "riskVector": "string", "vulnerableFunctionUsage": "IN_USE" }, "securityProblemId": "string", "status": "OPEN", "technology": "DOTNET", "title": "string", "url": "string", "vulnerabilityType": "CODE_LEVEL", "vulnerableComponents": [ { "affectedEntities": [ "string" ], "displayName": "string", "fileName": "string", "id": "string", "numberOfAffectedEntities": 1, "shortName": "string" } ] }
Related topics
  • Application Security

    Detect, monitor, remediate vulnerabilities at runtime, and block attacks on your applications.

  • Davis Security Advisor API

    View the Davis Security Advisor recommendations via Dynatrace API.