# Dt Obs Azure > Azure cloud resources including VMs, VMSS, SQL Database, Storage, AKS, App Service, Functions, VNet networking, load balancers, Event Hubs, Container Apps, and Key Vault. Monitor Azure infrastructure, analyze resource usage, audit security posture, and manage organizational hierarchy across subscriptions and resource groups. - **Type:** Skill - **Install:** `agentstack add skill-dynatrace-dynatrace-for-ai-dt-obs-azure` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [Dynatrace](https://agentstack.voostack.com/s/dynatrace) - **Installs:** 0 - **Category:** [Databases](https://agentstack.voostack.com/c/databases) - **Latest version:** 0.1.0 - **License:** Apache-2.0 - **Upstream author:** [Dynatrace](https://github.com/Dynatrace) - **Source:** https://github.com/Dynatrace/dynatrace-for-ai/tree/main/skills/dt-obs-azure - **Website:** https://www.dynatrace.com ## Install ```sh agentstack add skill-dynatrace-dynatrace-for-ai-dt-obs-azure ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Azure Cloud Infrastructure Monitor and analyze Azure resources using Dynatrace Smartscape and DQL. Query Azure services, audit security, manage organizational hierarchy, and plan capacity across your Azure infrastructure. ## When to Use This Skill Use this skill when the user needs to work with Azure resources in Dynatrace. Load the reference file for the task type: | Task | File to load | |---|---| | Inventory and topology queries | (no additional file — use core patterns below) | | Query Azure metric timeseries (CPU, latency, throughput) | Load `references/metrics-performance.md` | | VNet topology, subnets, NSGs, public IPs, VPN, peering | Load `references/vnet-networking-security.md` | | Azure SQL, Cosmos DB, PostgreSQL, Redis investigation | Load `references/database-monitoring.md` | | Functions, App Service, AKS infrastructure, Container Apps | Load `references/serverless-containers.md` | | Azure LB, Application Gateway, Front Door, API Management | Load `references/load-balancing-api.md` | | WAF rule analysis, false-positive investigation | Load `references/load-balancing-api.md` | | Event Hubs, Service Bus, Event Grid | Load `references/messaging-integration.md` | | Storage Accounts, Blob, File, Queue, Table | Load `references/storage-monitoring.md` | | Unattached resources, tag compliance, lifecycle | Load `references/resource-management.md` | | Cost savings, unused resources, SKU analysis | Load `references/cost-optimization.md` | | Capacity headroom, VMSS scaling, quotas | Load `references/capacity-planning.md` | | Security audit, encryption, public access, Key Vault | Load `references/security-compliance.md` | | NSG rule analysis (0.0.0.0/0, open ports) | Load `references/security-compliance.md` | | Storage account encryption/public access audit | Load `references/security-compliance.md` | | Cost allocation, chargeback, ownership | Load `references/resource-ownership.md` | | Determine orchestration context (AKS, VMSS, standalone) | Load `references/workload-detection.md` | --- ## Core Concepts ### Entity Types Azure resources use the `AZURE_*` prefix and can be queried using the `smartscapeNodes` function. All Azure entities are automatically discovered and modeled in Dynatrace Smartscape. Entity type names are derived from the ARM resource provider path: `/Microsoft.Compute/virtualMachines` becomes `AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES`. Sub-resources append with underscores: `/Microsoft.Sql/servers/databases` becomes `AZURE_MICROSOFT_SQL_SERVERS_DATABASES`. **Compute:** `AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES`, `AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS`, `AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS_VIRTUALMACHINES`, `AZURE_MICROSOFT_COMPUTE_DISKS`, `AZURE_MICROSOFT_COMPUTE_SSHPUBLICKEYS`, `AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES_EXTENSIONS` **Networking:** `AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS`, `AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS_SUBNETS`, `AZURE_MICROSOFT_NETWORK_NETWORKSECURITYGROUPS`, `AZURE_MICROSOFT_NETWORK_PUBLICIPADDRESSES`, `AZURE_MICROSOFT_NETWORK_NETWORKINTERFACES`, `AZURE_MICROSOFT_NETWORK_LOADBALANCERS`, `AZURE_MICROSOFT_NETWORK_APPLICATIONGATEWAYS`, `AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKGATEWAYS`, `AZURE_MICROSOFT_NETWORK_CONNECTIONS`, `AZURE_MICROSOFT_NETWORK_EXPRESSROUTECIRCUITS` **Database:** `AZURE_MICROSOFT_SQL_SERVERS`, `AZURE_MICROSOFT_SQL_SERVERS_DATABASES`, `AZURE_MICROSOFT_CACHE_REDIS`, `AZURE_MICROSOFT_CACHE_REDISENTERPRISE`, `AZURE_MICROSOFT_DOCUMENTDB_DATABASEACCOUNTS` **Storage:** `AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS`, `AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_BLOBSERVICES_CONTAINERS`, `AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_FILESERVICES_SHARES`, `AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_QUEUESERVICES_QUEUES`, `AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_TABLESERVICES_TABLES` **Kubernetes/Containers:** `AZURE_MICROSOFT_CONTAINERSERVICE_MANAGEDCLUSTERS`, `AZURE_MICROSOFT_CONTAINERSERVICE_MANAGEDCLUSTERS_AGENTPOOLS`, `AZURE_MICROSOFT_CONTAINERREGISTRY_REGISTRIES`, `AZURE_MICROSOFT_APP_CONTAINERAPPS`, `AZURE_MICROSOFT_APP_MANAGEDENVIRONMENTS`, `AZURE_MICROSOFT_APP_JOBS` **App Service:** `AZURE_MICROSOFT_WEB_SITES`, `AZURE_MICROSOFT_WEB_SERVERFARMS`, `AZURE_MICROSOFT_WEB_SITES_FUNCTIONS` **Messaging:** `AZURE_MICROSOFT_EVENTHUB_NAMESPACES`, `AZURE_MICROSOFT_EVENTHUB_NAMESPACES_EVENTHUBS`, `AZURE_MICROSOFT_SERVICEBUS_NAMESPACES`, `AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_QUEUES`, `AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_TOPICS`, `AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_TOPICS_SUBSCRIPTIONS` **Security/Identity:** `AZURE_MICROSOFT_KEYVAULT_VAULTS`, `AZURE_MICROSOFT_MANAGEDIDENTITY_USERASSIGNEDIDENTITIES` **Monitoring:** `AZURE_MICROSOFT_OPERATIONALINSIGHTS_WORKSPACES`, `AZURE_MICROSOFT_INSIGHTS_COMPONENTS` **API Management:** `AZURE_MICROSOFT_APIMANAGEMENT_SERVICE` ### Azure Organizational Hierarchy Azure organizes resources in a three-level hierarchy: **Tenant > Subscription > Resource Group**. Every resource belongs to exactly one resource group within one subscription. Use these fields to scope queries: ```dql-snippet filter azure.subscription == "08b9810e-..." ``` ```dql-snippet filter azure.resource.group == "my-rg" ``` ```dql-snippet filter azure.location == "eastus" ``` Combine these filters for precise scoping: ```dql-template smartscapeNodes "AZURE_*" | filter azure.subscription == "" and azure.resource.group == "" and azure.location == "" | summarize count = count(), by: {type} | sort count desc ``` To see the organizational breakdown across your environment: ```dql smartscapeNodes "AZURE_*" | summarize resource_count = count(), by: {azure.subscription, azure.resource.group} | sort resource_count desc ``` ### Common Azure Fields All Azure entities include: - `azure.subscription` — Azure subscription GUID - `azure.resource.group` — Resource group name - `azure.location` — Azure region (e.g., `eastus`, `polandcentral`) - `azure.resourceType` — ARM resource type (e.g., `microsoft.compute/virtualmachines`) - `azure.provisioning_state` — Provisioning state (e.g., `Succeeded`) - `azure.object` — Full ARM resource JSON (see [Configuration Parsing](#configuration-parsing-with-azureobject)) - `cloud.provider` — Always `azure` - `tags` — Resource tags (use `` tags[`key`] ``) Some entity types also have: - `azure.resourceId` — Full ARM resource ID (VMs and some others) - `azure.resourceName` — Resource name (VMs and some others) - `azure.availabilityZones` — Availability zone list (VMs) ### Relationship Types Azure entity relationships can be traversed using `traverse`. The `dt.traverse.relationship` field is **not populated** for Azure entities, so you must use `"*"` as the relationship name in all traversal commands. Key traversal pairs: - **VM → Disks:** `traverse "*", "AZURE_MICROSOFT_COMPUTE_DISKS"` - **VM → NICs:** `traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKINTERFACES"` - **VM → VMSS:** `traverse "*", "AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS"` - **VM → Availability Zones:** `traverse "*", "AZURE_MICROSOFT_RESOURCES_LOCATIONS_AVAILABILITYZONES"` - **VM ← Extensions:** `traverse "*", "AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES_EXTENSIONS", direction:backward` - **VMSS → AKS Clusters:** `traverse "*", "AZURE_MICROSOFT_CONTAINERSERVICE_MANAGEDCLUSTERS"` - **VMSS → Subnets:** `traverse "*", "AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS_SUBNETS"` - **VMSS → NSGs:** `traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKSECURITYGROUPS"` - **VMSS → LB Backend Pools:** `traverse "*", "AZURE_MICROSOFT_NETWORK_LOADBALANCERS_BACKENDADDRESSPOOLS"` - **Subnet → VNet:** `traverse "*", "AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS"` - **Subnet → NSG:** `traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKSECURITYGROUPS"` - **Subnet ← VMSS:** `traverse "*", "AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS", direction:backward` - **NSG ← NICs:** `traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKINTERFACES", direction:backward` - **NSG ← Subnets:** `traverse "*", "AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS_SUBNETS", direction:backward` - **LB → Backend Pools:** `traverse "*", "AZURE_MICROSOFT_NETWORK_LOADBALANCERS_BACKENDADDRESSPOOLS"` - **LB → Frontend IPs:** `traverse "*", "AZURE_MICROSOFT_NETWORK_LOADBALANCERS_FRONTENDIPCONFIGURATIONS"` - **LB → LB Rules:** `traverse "*", "AZURE_MICROSOFT_NETWORK_LOADBALANCERS_LOADBALANCINGRULES"` - **SQL Server ← SQL Databases:** `traverse "*", "AZURE_MICROSOFT_SQL_SERVERS_DATABASES", direction:backward` - **Storage Account ← Blob Containers:** `traverse "*", "AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_BLOBSERVICES_CONTAINERS", direction:backward` - **Storage Account ← File Shares:** `traverse "*", "AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_FILESERVICES_SHARES", direction:backward` - **AKS ← VMSS:** `traverse "*", "AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS", direction:backward` - **AKS ← Agent Pools:** `traverse "*", "AZURE_MICROSOFT_CONTAINERSERVICE_MANAGEDCLUSTERS_AGENTPOOLS", direction:backward` - **AKS ← NSGs:** `traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKSECURITYGROUPS", direction:backward` - **AKS ← Public IPs:** `traverse "*", "AZURE_MICROSOFT_NETWORK_PUBLICIPADDRESSES", direction:backward` - **AKS → Public IPs:** `traverse "*", "AZURE_MICROSOFT_NETWORK_PUBLICIPADDRESSES"` - **Web Site → App Service Plan:** `traverse "*", "AZURE_MICROSOFT_WEB_SERVERFARMS"` - **Web Site ← Functions:** `traverse "*", "AZURE_MICROSOFT_WEB_SITES_FUNCTIONS", direction:backward` - **Container App → Managed Environment:** `traverse "*", "AZURE_MICROSOFT_APP_MANAGEDENVIRONMENTS"` - **EventHub Namespace ← Event Hubs:** `traverse "*", "AZURE_MICROSOFT_EVENTHUB_NAMESPACES_EVENTHUBS", direction:backward` - **ServiceBus Namespace ← Queues:** `traverse "*", "AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_QUEUES", direction:backward` - **ServiceBus Namespace ← Topics:** `traverse "*", "AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_TOPICS", direction:backward` - **ServiceBus Topic ← Subscriptions:** `traverse "*", "AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_TOPICS_SUBSCRIPTIONS", direction:backward` - Use `fieldsKeep:{field1, field2}` to carry fields through multi-hop traversals - After a **single-hop** traverse, use `dt.traverse.history[0][id]` to get the source entity ID, then `lookup` to resolve the source entity name: ```dql-snippet | fieldsAdd sourceId = dt.traverse.history[0][id] | lookup [smartscapeNodes "SOURCE_TYPE" | fields name, id], sourceField: sourceId, lookupField: id, prefix: "src." ``` - After **multi-hop** traversals, `dt.traverse.history[-N]` works for fields carried via `fieldsKeep` ### Azure Metric Naming Convention Dynatrace ingests Azure Monitor metrics and exposes them using this naming pattern: ``` cloud.azure... ``` The `` uses underscores within the namespace (e.g., `microsoft_compute`) and `` is lowercase (e.g., `virtualmachines`). Hierarchy levels are dot-separated: `microsoft_sql.servers.databases`. `` is the Azure Monitor metric name. **Examples:** | Azure Monitor metric | Dynatrace metric key | |---|---| | VM `Percentage CPU` | `cloud.azure.microsoft_compute.virtualmachines.PercentageCPU` | | SQL DB `cpu_percent` | `cloud.azure.microsoft_sql.servers.databases.cpu_percent` | | Storage `Ingress` | `cloud.azure.microsoft_storage.storageaccounts.Ingress` | | Event Hub `IncomingMessages` | `cloud.azure.microsoft_eventhub.namespaces.IncomingMessages` | | Service Bus `IncomingMessages` | `cloud.azure.microsoft_servicebus.namespaces.IncomingMessages` | | App Service `HttpResponseTime` | `cloud.azure.microsoft_web.sites.HttpResponseTime` | | Load Balancer `ByteCount` | `cloud.azure.microsoft_network.loadbalancers.ByteCount` | | AKS `node_cpu_usage_percentage` | `cloud.azure.microsoft_containerservice.managedclusters.node_cpu_usage_percentage` | | Cosmos DB `TotalRequestUnits` | `cloud.azure.microsoft_documentdb.databaseaccounts.TotalRequestUnits` | | Redis `serverLoad` | `cloud.azure.microsoft_cache.redis.serverLoad` | | App Gateway `TotalRequests` | `cloud.azure.microsoft_network.applicationgateways.TotalRequests` | To query a metric: ```dql-template timeseries cpu = avg(cloud.azure.microsoft_compute.virtualmachines.PercentageCPU), by: {dt.smartscape_source.id}, from: now()-1h | limit 10 ``` **Important:** Never refer to these as "Azure Monitor alerts" or "Azure Monitor metrics" in output. Dynatrace monitors Azure resources natively through its Azure integration — these are **Dynatrace metrics** ingested from Azure. ### Configuration Parsing with azure.object The `azure.object` field contains the full ARM resource JSON. Parse it with the `azjson` alias: ```dql-snippet parse azure.object, "JSON:azjson" ``` The JSON is wrapped in a `configuration` key: ```json { "configuration": { "id": "", "name": "", "type": "", "location": "", "sku": { ... }, "properties": { ... }, "zones": [...] }, "tags": { ... } } ``` Access patterns: - Properties: `azjson[configuration][properties][field]` - SKU: `azjson[configuration][sku][name]` - Kind: `azjson[configuration][kind]` - Zones: `azjson[configuration][zones]` Common configuration fields by service: - **VM:** `properties.hardwareProfile.vmSize`, `properties.storageProfile.imageReference.offer`, `properties.storageProfile.osDisk.osType`, `properties.extended.instanceView.powerState.displayStatus` - **VMSS:** `sku.name` (VM size), `sku.capacity` (instance count), `tags.aks-managed-poolName` - **NSG:** `properties.securityRules[]` (custom rules array), `properties.securityRules[].properties.direction`, `properties.securityRules[].properties.access`, `properties.securityRules[].properties.sourceAddressPrefix` - **Storage Account:** `kind` (e.g., StorageV2), `sku.name`, `properties.accessTier`, `properties.supportsHttpsTrafficOnly`, `properties.allowBlobPublicAccess`, `properties.encryption.keySource` - **SQL Server:** `properties.fullyQualifiedDomainName`, `properties.publicNetworkAccess`, `properties.minimalTlsVersion` - **SQL Database:** `sku.name` (tier), `sku.capacity` (DTU/vCore), `properties.status`, `properties.zoneRedundant` - **AKS:** `properties.kubernetesVersion`, `properties.powerState.code`, `properties.networkProfile.networkPlugin`, `properties.enableRBAC` - **Web Site:** `kind` (e.g., `functionapp,linux`), `properties.state`, `properties.defaultHostName`, `properties.siteConfig.linuxFxVersion` - **Container App:** `properties.runningStatus`, `properties.template.containers[].image`, `properties.template.scale.minReplicas`, `properties.template.scale.maxReplicas` - **Event Hub Namespace:** `sku.name`, `properties.kafkaEnabled`, `properties.zoneRedundant` - **Service Bus Namespace:** `sku.name` (Basic/Standard/Premium), `properties.zoneRedundant`, `properties.minimumTlsVersion`, `properties.publicNetworkAccess`, `properties.disableLocalAuth`, `properties.status` - **Service Bus Queue:** `properties.maxSizeInMegabytes`, `properties.enablePartitioning`, `properties.deadLetteringOnMessageExpiration`, `properties.maxDeliveryCount`, `properties.lockDuration`, `properties.requiresDuplicateDetection`, `properties.status` - **Key Vault:** `properties.enableRbacAuthorization`, `properties.enableSoftDelete`, `properties.publicNetworkAccess` - **Redis:** `properties.sku.name`, `properties.hostName`, `properties.redisVersion`, `properties.enableNonSslPort` - **Cosmos DB:** `kind` (e.g., GlobalDocumentDB), `properties.EnabledApiTypes`, `properties.consistencyPolicy.defaultConsistencyLevel` - **Load Balancer:** `sku.name`, `tags.aks-managed-cluster-name` - **App Gateway:** `properties.sku.name`, `properties.sku.tier`, `properties.operationalState`, `properties.webApplicationFirewallConfiguration.enabled`, `properties.webApplicationFirewallConfiguration.firewallMode` (Detection/Prevention), `properties.webApplicationFirewallConfiguration.ruleSetType`, `properties.webApplicationFirewallConfiguration.ruleSetVersion`, `properties.webApplicationFirewallConfiguration.disabledRuleGroups[]`, `properties.webApplicationFirewallConfigu … ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [Dynatrace](https://github.com/Dynatrace) - **Source:** [Dynatrace/dynatrace-for-ai](https://github.com/Dynatrace/dynatrace-for-ai) - **License:** Apache-2.0 - **Homepage:** https://www.dynatrace.com Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-dynatrace-dynatrace-for-ai-dt-obs-azure - Seller: https://agentstack.voostack.com/s/dynatrace - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.