Dynatrace Associate cheat sheet

Grail is the data lakehouse that stores metrics, logs, traces, events, and business events; DQL queries Grail records and supplies dashboards and notebooks.

Smartscape maintains a near-real-time topology of hosts, processes, services, applications, and Kubernetes entities, with dependencies derived from observed traffic and metadata.

OneAgent auto-instruments full-stack hosts and collects metrics, traces, logs, and topology; ActiveGate routes data and supports private-network connectivity.

Davis AI combines causal, predictive, and generative AI; problems aggregate related events and are correlated to a likely root-cause entity.

Management zones are rule-based filters that scope entities and data for access, analysis, and alerting; tags and entity properties commonly define membership.

IAM policies bind groups to permissions, while policy boundaries constrain which resources a policy can affect.

Every monitored object has a unique entity ID that links topology, metrics, traces, events, and problems across the platform.

Retention is configured per Grail bucket, so metrics, logs, traces, and events can have different retention periods.

A service is a logical grouping of requests from processes of the same technology; service detection rules define service boundaries and affect service-level metrics.

PurePath captures end-to-end distributed traces with method-level timing; spans represent timed operations and W3C trace context propagates trace IDs across calls.

Core service signals are throughput, failure rate, and response time; Apdex summarizes satisfaction against a response-time threshold T.

Apdex = (satisfied + tolerating/2) / total, where satisfied is at or below T, tolerating is above T through 4T, and frustrated is above 4T.

Request attributes extract values such as URL, method, or headers and enable multidimensional filtering, segmentation, and request naming.

Service-level objectives define targets such as availability or latency with an error budget; alerting profiles route problem notifications to recipients.

Business events are structured records for business transactions or outcomes, stored in Grail and queried with DQL alongside observability data.

OpenTelemetry metrics, logs, and traces can be ingested; OneAgent or a collector enriches them with topology and code-level context.

Full-stack host monitoring uses OneAgent; infrastructure monitoring mode captures OS CPU, memory, disk, and network without deep code instrumentation.

A process group aggregates identical processes across hosts; each process group instance represents the process running on a specific host.

Kubernetes monitoring combines the Dynatrace Operator, Kubernetes API metadata, and events to map clusters, nodes, workloads, pods, and containers.

Cloud integrations ingest AWS, Azure, or Google Cloud metrics and metadata; tags map cloud resources to Dynatrace entities.

ActiveGate acts as a network proxy and routing component and can host private synthetic locations, extensions, and network-zone traffic.

Host anomaly detection uses baselines, while static thresholds are used for known limits; maintenance windows suppress alerts during planned changes.

Network zones control which ActiveGates OneAgents use for traffic routing, supporting segmentation and private connectivity.

Extensions 2.0 collect third-party metrics through ActiveGate; Prometheus scraping is a supported ingestion pattern.

Real User Monitoring injects a JavaScript agent into web pages or uses a mobile agent to capture real user actions, sessions, errors, web vitals, and experience.

Synthetic monitors run browser clickpaths or HTTP/ICMP checks from public or private locations on a schedule to test availability and performance.

RUM reflects actual traffic and user behavior; synthetic monitoring provides controlled, repeatable checks independent of real-user volume.

A user action is a logical interaction such as a page load or click; an application is a set of user actions grouped for analysis.

RUM Apdex applies thresholds to user-action duration; Core Web Vitals include LCP, INP, and CLS for loading, responsiveness, and visual stability.

Session replay reconstructs user sessions; privacy settings mask sensitive content before capture.

Mobile RUM instruments Android and iOS apps and captures crashes, network requests, and user actions.

Private synthetic locations require an ActiveGate inside the private network to reach internal applications.

Application Security uses OneAgent runtime data; Runtime Vulnerability Analytics identifies third-party and code-level vulnerabilities in running processes.

Runtime Application Protection detects attempted attacks against running workloads and can block exploits when blocking mode is enabled.

A security problem aggregates related vulnerabilities or attacks on affected entities, with severity and remediation status for prioritization.

Attack detection mode records and alerts on attacks without blocking requests; blocking mode must be enabled to stop exploits.

Security settings can be scoped by management zone and enabled for selected process groups or technologies.

Security events are stored in Grail and can be queried with DQL and visualized in dashboards.

Vulnerability status includes open, resolved, and muted; muting suppresses accepted risks from active reporting.

Davis security score prioritizes risk using factors such as exposure, data sensitivity, and likelihood of exploitation.