dt-obs-azure

Distributed traces, spans, service dependencies, and request flow analysis. Use when investigating span-level details, failures, performance bottlenecks, or trace correlation. Trigger: "trace analysis", "slow requests", "failed spans", "service dependencies", "distributed trace", "span details", "HTTP status codes in traces", "database query spans", "messaging spans", "gRPC calls", "Lambda cold starts", "trace ID lookup", "exception analysis", "correlate logs and traces", "request attributes". Do NOT use for explaining existing queries, product documentation or configuration questions, service-level RED metrics (use dt-obs-services), log searching (use dt-obs-logs), or problem analysis (use dt-obs-problems).

Hunt threat-intelligence indicators of compromise (IoCs) across Dynatrace logs and spans and produce a 0-100 threat-exposure score. Extracts and normalizes IoCs — IPs, Domains (hostnames included), URLs, Emails, CVEs, File hashes (md5/sha1/sha256), MITRE TTPs — from unstructured reports, advisories, advisory URLs, pasted text, or STIX, then hunts them in fetch logs and fetch spans. Trigger: hunt these IoCs, am I exposed to this threat or ingested reports, check these indicators in my logs and traces, threat exposure report, extract IoCs from this advisory URL, search these hashes/domains/IPs in my environment. Also investigates repeated detections: same source IP across many targets, same rule re-firing on one object. Do NOT use for: generic security.events retrieval (vulnerabilities, detections, compliance, THREAT_REPORT — use dt-sec-insights); general log queries not tied to an IoC hunt (use dt-obs-logs); general span/trace analysis (use dt-obs-tracing); explaining DQL syntax (use dt-dql-essentials).

Query Dynatrace security.events with DQL: vulnerabilities, threat detections, compliance posture. Covers Dynatrace-native Runtime Vulnerability Analytics (RVA — CVEs, reachability, exploit), Runtime Application Protection (RAP), Automated Detections, Security Posture Management (KSPM/CSPM), Dynatrace vulnerability feed, external tools. Trigger: "open critical vulnerabilities", "vulnerable functions in use and exposed", "top vulnerable libraries / K8s workloads", "vulnerabilities on this host", "CIS/DORA compliance pass rate", "SQL injection detections", "does Dynatrace know CVE-X / how is it fixed", "what is DTV-…", "new in the feed", "exploited in the wild (KEV)". Do NOT use for scan coverage, mapping external findings to workloads / entity mapping, or RVA verification of external findings (use dt-sec-contextualization), explaining DQL (dt-dql-essentials), Davis problems (dt-obs-problems), logs (dt-obs-logs), tracing (dt-obs-tracing), service metrics (dt-obs-services), platform audit (dt-platform).

Resolve security signals, IoC matches, or Smartscape nodes to runtime entities, connect findings across entity levels, verify external findings against RVA on the same entity, and measure scan coverage against a Smartscape denominator. Covers identity mapping, RVA id resolution, K8s pod vs. node CVE topology, AI-service vulnerabilities, coverage counts. Trigger: "map these findings to workloads/hosts", "which workload does this image run as", "is this scanner finding also detected by RVA on a running workload", "which AI services have vulnerabilities", "enrich this IoC match", "which report mentions this IoC", "hosts not covered by scanning". Queries security.events only for THREAT_REPORT IoC enrichment, coverage numerators, joining supplied findings, RVA verification, and AI-service findings. Do NOT use for broad posture, rankings, or an entity's vulnerabilities (dt-sec-insights), general DQL (dt-dql-essentials), IoC hunting in logs/spans (dt-sec-ioc-hunting), K8s observability (dt-obs-kubernetes).

Query and analyze a Dynatrace tenant's ACTUAL billing and usage data with DQL on dt.system.events — DPS consumption breakdown, cost-normalized spend ranking, included volume deduction, chargeback/showback, cost drivers, spending trends, cost investigation, log import cost, metrics ingest optimization, drop/remove a metric or dimension from ingestion, reduce metric cardinality, metric usage, query cost attribution, workflow total cost, entity cost drill-down (RUM, hosts, synthetic, K8s), AI/LLM cost (AI Units, AI Function Standard Calls). Directs licensing/entitlement questions (am I entitled to use X?) to docs (not via DQL). USE ONLY for the tenant's actual consumption. Do NOT use for conceptual 'explain' questions about how DPS billing/pricing works or what units/weights/the rate card mean — see Dynatrace docs. Do NOT use for tuning DQL queries to be faster or cheaper to run (query optimization, reducing scanned data/consumption per run, filter-early best practices) — that belongs to dt-dql-essentials.

DAVIS problem analysis including root cause identification, impact assessment, and correlation with other telemetry. Use when querying or investigating detected problems. Trigger: "active problems", "root cause analysis", "problem impact", "affected users", "list problems", "P-12345 details", "recurring problems", "problem history", "problem trending", "blast radius", "which entity caused the problem", "problems affecting Kubernetes", "problems by service". Do NOT use for explaining existing queries, product documentation questions, generic log searching, distributed tracing, or host-level resource monitoring.

Network flow analysis in Dynatrace across three sources: OneAgent flows (host/process/pod-to-peer connections in the `default_network_flows` Grail bucket), NetFlow/IPFIX/sFlow (via an OpenTelemetry Collector), and cloud flow logs (AWS VPC / Transit Gateway; Azure and GCP planned). Use to analyze traffic between entities, find top talkers by bandwidth, map communication dependencies, investigate connection health (resets, timeouts, retransmissions, RTT), and resolve peers to monitored entities. Routes each question to the right source; source-specific DQL lives in the reference files. Trigger: "network flows", "top talkers", "traffic between hosts", "connection resets", "TCP retransmissions", "RTT", "pod connections", "network dependencies", "NetFlow", "IPFIX", "sFlow", "VPC flow logs", "cloud network traffic". Do NOT use for host NIC throughput or packet drops (use dt-obs-hosts), service request rate or latency (use dt-obs-services), or synthetic/uptime monitoring (use dt-obs-ext-monitors).

Predictive analytics for Dynatrace — time series forecasting with the timeseries-forecast tool, capacity saturation planning, trend and anomaly detection across hosts, services, and infrastructure.

The HyperFrames CLI by job - scaffold, check, look at frames, edit the timeline, preview, render locally or in the cloud, publish, project history - plus reading its JSON and recovering from build or render failures.

Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.

This skill should be used when the user wants to "deploy an agent", "deploy my ADK agent", "set up CI/CD", "configure secrets", "troubleshoot a deployment", or needs guidance on Agent Runtime, Cloud Run, or GKE deployment targets, or binding an agent to an Agent Gateway. Covers deployment workflows, service accounts, rollback, and production infrastructure. Applies to any framework agents-cli deploys (ADK, LangChain, ...). Part of the agents-cli skills suite. Do NOT use for agent API code patterns (ADK: use google-agents-cli-adk-code), evaluation (use google-agents-cli-eval), or project scaffolding (use google-agents-cli-scaffold).

This skill should be used when the user wants to "create an agent project", "start a new ADK project", "build me a new agent", "add CI/CD to my project", "add deployment", "enhance my project", or "upgrade my project". Part of the agents-cli skills suite. Covers `agents-cli scaffold create`, `scaffold enhance`, and `scaffold upgrade` commands, template options, deployment targets, and the prototype-first workflow. Do NOT use for writing agent code (ADK projects: use google-agents-cli-adk-code) or deployment operations (use google-agents-cli-deploy).

This skill should be used when the user wants to "set up tracing", "monitor my agent", "configure logging", "add observability", "debug production traffic", or needs guidance on monitoring deployed agents, including ADK (Agent Development Kit) agents. Covers Cloud Trace, prompt-response logging, BigQuery Agent Analytics, third-party integrations (AgentOps, Phoenix, MLflow, etc.), and troubleshooting. Part of the agents-cli skills suite. Do NOT use for deployment setup (use google-agents-cli-deploy) or API code patterns (use google-agents-cli-adk-code).

Deploy and operate apps on Prisma Compute with the Prisma 8 CLI. Use whenever the user mentions Prisma Compute, deploying or hosting a Prisma app, `prisma deploy`, `prisma dev module.ts`, Prisma Composer apps (`module.ts`, `compute()`, the `composer` section of `prisma.config.ts`), preview stages, deploy on push (`prisma git connect`, `prisma/cloud-deploy-action`), `prisma service` logs, versions, rollback, or custom domains, `project env`, `PRISMA_SERVICE_TOKEN`, regions, 504s, sleeping instances, or `waitUntil`; also when a project still uses the removed `@prisma/cli app deploy`, `prisma.compute.ts`, `defineComputeConfig`, `compute:deploy`, or `build logs` surface.

Deploy applications and websites to Vercel. Use when the user requests deployment actions like "deploy my app", "deploy and give me the link", "push this live", or "create a preview deployment".

Provides foundational Firebase CLI setup, CLI installation, version checks (`firebase-tools@latest --version`), CLI login (including --no-localhost), project creation, project selection (`firebase use`), and app config file downloads (`google-services.json`, `GoogleService-Info.plist`). Use ONLY for CLI login, project creation/switching, or downloading app config files. Don't use for Firebase Hosting deploy, Firestore, Auth, App Hosting, Data Connect, Crashlytics, or Remote Config.