topic Re: dt.security.context for serverless components in Open Q&A

dt.security.context for serverless components

michiel_otten — Wed, 24 Dec 2025 10:00:55 GMT

Hi community

I'm trying to figure out what is the best way to set a dt.security.context on spans send by a server less feature like an Azure App Service. Are there any best practices around this?

Although they have the Dynatrace OneAgent capabilities in them, we simply can't add it on host level.
Hopefully I won't need to use the open pipeline for this.

KR.
Michiel

Re: dt.security.context for serverless components

AntonPineiro — Wed, 24 Dec 2025 11:35:30 GMT

Hi,

Since Dynatrace is already working in New Cloud Platform Monitoring for Azure. I guess you can configure "dt.security.context " during configuration.

Best regards

Re: dt.security.context for serverless components

michiel_otten — Wed, 24 Dec 2025 13:42:22 GMT

Thanks, i did not see this one yet 🙂
Any thoughts on how to control it now? I'm a bit confused by "the best practise" to set access rights in Grail. When to start with buckets, when to use security context etcetera.

Re: dt.security.context for serverless components

AntonPineiro — Fri, 26 Dec 2025 12:44:27 GMT

Hi,

You can see "dt.security.context" as a "tag" to be attached of any piece of information ingested in Grail, metric, trace, log... And you can apply policies/rules on top of that, for filtering purposes.

And buckets is more for data retention. These specific log lines, these metrics... will have X data retention time.

Best regards

Re: dt.security.context for serverless components

michiel_otten — Tue, 30 Dec 2025 10:53:13 GMT

Thanks for this answer. Last question: any suggestions how to proceed at this moment for metrics / traces coming out of Clouds?
We need to solve a use case where a particular party can solely see metrics, logs and traces for themselves.

Best regards,
Michiel

Re: dt.security.context for serverless components

AntonPineiro — Wed, 31 Dec 2025 11:03:24 GMT

Hi,

Do you have some use case? As team A only can see X.

Since you are talking about Grail data, I would say working with policies and boundaries.

Best regards

Re: dt.security.context for serverless components

michiel_otten — Thu, 15 Jan 2026 13:13:44 GMT

Hi Anton,

Sorry for the late response, we have vendor A which is only allowed to see stuff within their management. This would also apply to traces and etcetera.
We would like to know how to best split the entities, metrics and stuff for cloud components. Most of the metrics do not have a security context or whatsoever for server less features 🙂

Kind regards,
Michiel

Re: dt.security.context for serverless components

AntonPineiro — Tue, 20 Jan 2026 09:21:45 GMT

Hi,

Maybe this recent video about Dynatrace IAM might be helpful.

Best regards