SonarQube & Dynatrace Integration: Enrich Security Findings

on YouTube ↗14m

" summary

Dynatrace ingests SonarQube findings via a SonarQube extension, maps them into a semantic dictionary, and runs workflows that trigger on new critical/high issues. Vulnerabilities are correlated to production Kubernetes containers through Smartscape using repo and service names, then enriched with exposure and data-access signals from runtime vulnerability analytics. The pipeline creates consolidated Jira tickets, visualizes mapped entities on dashboards, and can block or roll back deployments when enriched findings indicate real production risk.

AI-written summary · about

" chapters (24)

1. 0:00Introduction
2. 0:30Dynatrace Platform Overview: Data Intelligence & Monitoring
3. 1:13Smartscape Overview: Kubernetes, Containers, Runtime Entities
4. 1:54Connecting Code, Build, and Runtime with SonarQube
5. 2:31Semantic Mapping for Vulnerability Prioritization
6. 2:48Security Dashboard: Explore Risks and Link to SonarQube
7. 3:30Posture Overview: Security, Reliability, Maintainability
8. 4:01Automating Vulnerability Workflows with Dynatrace
9. 4:40Runtime Context: Prioritizing Production Risks
10. 5:20Trigger Workflow for Critical SonarQube Vulnerabilities
11. 5:56Mapping Vulnerabilities to Kubernetes via Smartscape
12. 6:19Mapping Repositories to Deployed Services
13. 7:26Runtime Vulnerability Analytics and Data Context
14. 8:08Ingesting Enriched Vulnerability Events into Dynatrace
15. 8:21Creating Jira Tickets for Production Vulnerabilities
16. 9:06Jira Ticket Example with Runtime Mapping
17. 9:38Investigating Kubernetes Workloads and Production Tags
18. 10:03Ticket Details: Internet Exposure and Data Signals
19. 10:18Finding Additional Runtime Vulnerabilities
20. 10:51Visualizing Enriched Vulnerabilities in the Dashboard
21. 11:12Runtime Entity Mapping: Containers with Critical Issues
22. 12:02Runtime Security Gates from Staging to Production
23. 12:55Deployment Gate Failure and Optional Rollback
24. 13:24Wrap-Up: Connecting Code Vulnerabilities to Runtime Risk

" related talks

• 36mHarnessing Dynatrace Application Security with Microsoft Sentinel for Advanced ThreatGareth Emslie · DevDays Europe 2024
• 47mRollercoaster of Security AutomationArtem Rozumenko · Selenium Camp 2019
• 01h 21mFirst Steps to Full Lifecycle Security with Open Source ToolsAnais Urlichs, Rory McCune · Cloud Native SecurityCon Europe 2022
• 42mIt's a trap; we are vulnerableAndres Damian Sacco · JCON WORLD ONLINE 2023
• 42mContinuous Security: Integrate security tools into your DevOps PipelineBill Dinger · Build Stuff 2020
• 14mAutomating Security and Compliance with AI-Based AnalyzersVaibhav Pagar · DevConf.CZ 2025
• 43mBuilding a Secure DevOps PipelineAaron Weaver · AppSec USA 2017
• 32mHow to implement a DevSecOps pipeline with zero-trustEvan Gertis · Conf42 DevSecOps 2022