security_context via host tags - documentation wrong?

r_weber — Fri, 10 Jul 2026 06:10:28 GMT

As per the documentation it should be possible to set the security_context of a host via automated tagging rules:

And then, in combination with the topology configuration rules set the security context according to this tag value:

However, this is not working. I guess tagging rules do not work for that, only custom host properties or when set via oneagentctl?

Re: security_context via host tags - documentation wrong?

sujit_k_singh — Wed, 15 Jul 2026 04:22:08 GMT

Hi @r_weber

automated tagging rules may not reliably propagate the dt.security_context to all signal types (logs, spans, metrics, events). This is because dt.security_context is a primary Grail field that needs to be enriched at the source (OneAgent level) before telemetry is sent to Dynatrace. Enrich OneAgent telemetry with primary Grail fields and tags — Dynatrace Docs

Tagging Rules Don't Work Here - Primary Grail fields/tags (like dt.security_context) must be set at the source via OneAgent before data is sent to Dynatrace.
Automated tagging rules are evaluated server-side after data arrives — too late for security context assignment.

Thanks,

Sujit

topic Re: security_context via host tags - documentation wrong? in Open Q&A

security_context via host tags - documentation wrong?

Re: security_context via host tags - documentation wrong?