How to write DQL to get Vulnerability details for application or process

[heramb_sawant]

Hi Team,
I w am building SRG for Security check/Vulnerabilities. Can someone help to to know how can I write DQL to fetch vulnerability details from grail.


Regards,
Heramb sawant

[AntonPineiro]

Hi,

You can check DQL examples for security data.

Best regards

[sujit_k_singh]

Hello @heramb_sawant 

Vulnerability state reports are stored as security events in Grail. The recommended way is to query the security.events table for VULNERABILITY_STATE_REPORT_EVENT, deduplicate to the latest snapshot per affected entity, and (optionally) join to monitored entities (e.g., process or process group) to enrich with names, tags, ownership, etc.

As usggested by @AntonPineiro

that’s the perfect documentation for this topic—it provides ready-made DQL queries for vulnerability state reports, Management Zone scoping, and severity filters.
You can also refer to this doc that explains where vulnerability events live in Grail (security.events), including bucket details and retention:

Threat Observability concepts — Dynatrace Docs