feat(dynatrace): add the write and configuration surfaces - #6398
Conversation
Takes the block from 22 operations to 47. The original PR shipped the read paths plus a few ingests; this closes the gaps that made those reads dead-end. The one that was a real defect: security was read-only. The audit-vulnerabilities skill promised "a remediation queue" and then gave you no way to act on it, even though muting is the single most common triage action. Adds mute and unmute, singly and in bulk, plus the remediation items behind a third-party finding, plus the Attacks API so an exploited vulnerability can be traced to the request that exploited it. The rest, by how much they unblock: - Custom tags (read/add/delete). Entity tags already drive every selector in the block; being able to write them closes a loop that was half open. - Settings objects (schemas, list, get, create, update, delete). This is how maintenance windows, alerting profiles, and management zones are configured in modern Dynatrace, so "open a maintenance window before the deploy" was simply unreachable before. The value is a schema-defined blob, so the tool is honestly opaque rather than falsely typed; the docs tell you to mirror an existing object. Update and delete carry the updateToken so a concurrent change fails instead of being overwritten. - Synthetic monitors and on-demand batch execution, which pairs with the deploy-marker tool to gate a release on a smoke test. - Problem comment get/update/delete, and SLO create/update/delete, completing CRUD that was previously half-built. Two structural notes. Synthetic monitors are the only endpoints still on Environment API v1, so `buildDynatraceUrl` grew a v1 sibling and the shared base-URL normalizer now strips either version; the query builder also learned to repeat a param per value, which Synthetic's `tag` needs. And creating an SLO returns 201 with an empty body and the new ID in the Location header, so that tool reads the header rather than parsing nothing. Deliberately excluded: the Grail/DQL query API. It is the long-term successor to the deprecated logs/search endpoint, but it authenticates with a platform token rather than an Api-Token, so it is a second auth path and belongs in its own change.
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryMedium Risk Overview Application Security adds mute/unmute (single and bulk), remediation items, and list/get attacks so vulnerabilities can be triaged and tied to runtime exploitation. Entity tags gain list, add, and delete so selectors and management zones can be updated from workflows. Settings adds full lifecycle for schema-backed objects (maintenance windows, alerting profiles, etc.), including Synthetic adds list monitors (Environment API v1), on-demand batch execution, and batch polling for deploy smoke tests. Problems and SLOs complete comment CRUD and SLO create/update/delete; SLO create reads the new ID from the The Dynatrace block, docs, integration catalog, and 40 unit tests are updated; shared URL helpers now support v1 routing, repeated query params, and tri-state synthetic Reviewed by Cursor Bugbot for commit f830da9. Configure here. |
Greptile SummaryThe PR expands the Dynatrace integration from read-oriented operations to comprehensive write and configuration support.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| apps/sim/blocks/blocks/dynatrace.ts | Adds the new operation surfaces and parameter mappings, while correctly extending the required entity-selector condition to all three tag operations. |
| apps/sim/tools/dynatrace/utils.ts | Extends shared URL and query construction to support Environment API v1 and repeated query parameters. |
| apps/sim/tools/dynatrace/dynatrace.test.ts | Adds broad coverage for routing, request normalization, response contracts, concurrency tokens, and operation registration. |
| apps/sim/tools/dynatrace/types.ts | Expands Dynatrace parameter and response types for the newly supported API surfaces. |
| apps/sim/tools/registry.ts | Registers the new Dynatrace tools for runtime dispatch. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
B[Dynatrace Block] --> P[Parameter mapping]
P --> T[Dynatrace tool registry]
T --> V2[Environment API v2]
T --> V1[Environment API v1]
V2 --> S[Security, tags, settings, SLOs, comments]
V1 --> Y[Synthetic monitors and batch execution]
Reviews (3): Last reviewed commit: "fix(dynatrace): make the synthetic enabl..." | Re-trigger Greptile
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
… selector Two problems, one found in review and one worth more than it was given. The tag operations could run without an entity selector. All three tag tools declare `entitySelector` required, but the shared block field was only marked required for List Entities, so the block let a workflow reach those tools with an invalid configuration and let Dynatrace do the rejecting. My own structural auditor missed it because it only checked that *some* visible subBlock existed for a required param, not that the specific one was required — that check is now precise, and it confirms these three were the only instances across all 47 operations. The larger one: outputs were declaring `type: 'json'` for shapes the API reference documents in full. Thirty-five of them. The top-level entities were mapped properly, but nested payloads — a problem's evidence and impact analysis, a vulnerability's risk assessment and global counts, an attack's attacker, request, entry point and exploited vulnerability, a remediation item's assessment and mute state, the synthetic execution and failure records, the metric ingest error envelope, the DQL translation — were passed through as anonymous blobs. A downstream block could not reference `attacker.sourceIp` without knowing to guess it. All of those now carry their fields. What stays opaque is now only what genuinely is, and each says why in its description: a settings object's schema-defined value, an entity's type-dependent property bag and relationship keys, caller-supplied synthetic metadata, an audit log's JSON patch, the undocumented partial-success body of log ingestion, and the handful of security-detail shapes the reference names without expanding.
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
1 issue from previous review remains unresolved.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 637b056. Configure here.
Review catch. `enabled` on List Synthetic Monitors is a three-way filter — enabled, disabled, or either — and I had it as a switch. The URL builder deliberately serializes `false` (there is a test pinning that `evaluate=false` survives), so leaving "Enabled Only" unchecked sent `enabled=false` and returned only the disabled monitors: exactly backwards. Made it a dropdown with Any / Enabled only / Disabled only, matching the monitorType field directly above it, which had the same shape and already used an empty-id "Any" option. The params mapper sends nothing for "Any". Checked the other nine switches rather than assuming. None share the bug: for each of them off genuinely means false, and false is Dynatrace's own default, so serializing it is correct. A test now pins that list so the trap cannot be re-introduced by converting one of them, alongside a test covering all three states of the filter.
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit f830da9. Configure here.
1 participant
Summary
Takes the Dynatrace block from 22 operations to 47, following up #6393. That PR shipped the read paths plus a few ingests; this closes the gaps that made those reads dead-end.
The one that was a real defect: security was read-only. The
audit-vulnerabilitiesskill promised "a remediation queue" and then gave you no way to act on it, even though muting is the single most common triage action. Adds mute/unmute (single and bulk), the remediation items behind a third-party finding, and the Attacks API so an exploited vulnerability can be traced to the request that exploited it.The rest, by how much they unblock:
valueis a schema-defined blob, so the tool is honestly opaque rather than falsely typed; the docs tell you to mirror an existing object. Update and delete carry theupdateTokenso a concurrent change fails instead of being silently overwritten.Two structural notes:
buildDynatraceUrlgrew a v1 sibling, the shared base-URL normalizer strips either version, and the query builder learned to repeat a param per value (Synthetic'stagneeds it).Locationheader, so that tool reads the header rather than parsing nothing.Deliberately excluded: the Grail/DQL query API. It is the long-term successor to the deprecated
logs/searchendpoint, but it authenticates with a platform token rather than an Api-Token — a second auth path that belongs in its own change.Type of Change
Testing
40 unit tests. New coverage: v1-vs-v2 routing for Synthetic, repeated
tagparams, bulk IDs accepted as list/JSON/comma-string, empty-batch rejection, the settings-create array wrapper,updateTokenpassthrough, create/update SLO producing identical bodies, the SLOLocation-header read, 204-means-already-muted, and the documented top-level response key of every new list endpoint.Full audit suite passes (
tool-metadata:check,integration-catalog:check,check:api-validation:strict, both tool-boundary checks). Type-check and lint clean. A structural auditor verifies all 47 tools align three ways across dropdown,tools.access, and the registry, with no duplicate subBlock IDs and every required param reachable.Not yet exercised against a live Dynatrace tenant — mappings are verified against the published API reference, not live payloads.
Checklist