topic Re: How to write DQL to get Vulnerability details for application or process in Open Q&A

How to write DQL to get Vulnerability details for application or process

heramb_sawant — Wed, 10 Dec 2025 09:20:01 GMT

Hi Team,
I w am building SRG for Security check/Vulnerabilities. Can someone help to to know how can I write DQL to fetch vulnerability details from grail.

Regards,
Heramb sawant

Re: How to write DQL to get Vulnerability details for application or process

AntonPineiro — Wed, 10 Dec 2025 13:28:43 GMT

Hi,

You can check DQL examples for security data.

Best regards

Re: How to write DQL to get Vulnerability details for application or process

sujit_k_singh — Wed, 10 Dec 2025 21:32:37 GMT

Hello @heramb_sawant

Vulnerability state reports are stored as security events in Grail. The recommended way is to query the security.events table for VULNERABILITY_STATE_REPORT_EVENT, deduplicate to the latest snapshot per affected entity, and (optionally) join to monitored entities (e.g., process or process group) to enrich with names, tags, ownership, etc.

As usggested by @AntonPineiro

that’s the perfect documentation for this topic—it provides ready-made DQL queries for vulnerability state reports, Management Zone scoping, and severity filters.
You can also refer to this doc that explains where vulnerability events live in Grail (security.events), including bucket details and retention:

Threat Observability concepts — Dynatrace Docs