Skip to content

Dynatrace Token

Service Name: Dynatrace

Service Description: Dynatrace is an all-in-one software intelligence platform that provides application performance monitoring (APM), infrastructure monitoring, digital experience monitoring, and AI-powered analytics for cloud environments.

Service Address: https://www.dynatrace.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the account level through Dynatrace's access management settings.

Secret Access Scope: Dynatrace API tokens grant programmatic access to Dynatrace APIs based on the specific scopes assigned to the token. Tokens can be configured with different permission levels for reading metrics, creating configurations, managing environments, and more.

Secret Revokement URL: https://www.dynatrace.com/support/help/dynatrace-api/basics/dynatrace-api-authentication#manage-api-tokens

Secret Example: dt0c01.ST2EY72KQINMH574WMNVI7YN.G3DFPBEJYMODIDAEX454M7YWBUVEFOWKPRVMWFASS64NFH52PX6BNDVFFM572RZM

Suspicious Activity Investigation Instructions:

  • Review the Dynatrace audit logs for unusual API calls or configuration changes.
  • Check for unexpected changes to monitoring configurations or alerting rules.
  • Monitor for unauthorized access to sensitive monitoring data.
  • Review token usage patterns for anomalies in the Dynatrace interface.
  • Check for unexpected data exports or unusual query patterns.

Mitigation Instructions:

  • Sign in to your Dynatrace environment.
  • Go to Settings > Integration > Dynatrace API.
  • Locate the compromised token in the list of API tokens.
  • Select the Delete icon next to the token.
  • Create a new token with appropriate scopes if needed.
  • Update any legitimate applications or scripts that were using the revoked token.
  • Review the audit logs to understand the scope of potential compromise.
  • Consider implementing more restrictive token scopes for future tokens.