No data showing for code-level vulnerabilities (.NET 4.5)

[NicoleMT]

Hi everyone,

I'm trying to see code-level vulnerabilities in Dynatrace, but no data is being displayed.
I'm using .NET 4.5 and I have already enabled the Application Security feature both from the main settings and manually under OneAgent features

Does anyone know if there is any additional configuration required or specific prerequisites for it to work with .NET 4.5?

Thanks in advance for your help!

[AntonPineiro]

Hi,

Not sure which technologies are supported, but first, is OneAgent is fullstack mode?

Best regards

[NicoleMT]

Hi,

Yes, is fullstack mode

[dylan_taelemans]

A couple of things to verify:

1. Is deep monitoring enabled for the process?
   Go to:
   Settings (Process) > Deep Monitoring

2. Are the following OneAgent features ".NET code-level vulnerability evaluation", ".NET ASP.NET" and "NET ASP.NET Sensor V2" enabled?
   Go to:
   Settings (classic) > Preferences > Oneagent Features (Note: those features Require restart after enabling​)
   

3. Is Code-level Vulnerability Analytics enabled for .NET?
   Go to:
   Settings (classic) > Application Security > General settings
   Ensure it’s enabled and monitoring your .NET environment.

[AntonPineiro]

Hi,

I would check which version of .NET is supported in documentation.

Or raising a support ticket.

Best regards

[marco_irmer]

Another thing to keep in mind: Detection of code-level vulnerabilities works differently from third-party vulnerabilities. Third-party vulnerabilities are detected whenever the process loads, whereas code-level vulnerabilities require execution of the vulnerable code. In other words, there has to be load placed on the service so that Dynatrace can observe execution of the vulnerable code.

[c_schwarzbauer]

and in addition to that: do you know if there are actual code-level vulnerabilities in the .NET application, which Dynatrace should detect?
if yes, then which ones would that be and in which way is untrusted input propagated there?

[BalajiMurali]

Does your account have vulnerability detection enabled? Or on the tenant level?

If not, you won't see anything related to vulnerabilities.

Please check with your Dynatrace Customer Success Manager for more details.

Sometimes, vulnerabilities section is enabled for a specific group of users only, like pentest team. Please check you're part of the group who has access to vulnerabilities report.