Agent skill · dynatrace
dt-obs-network-flows
Network flow analysis in Dynatrace across three sources: OneAgent flows (host/process/pod-to-peer connections in the `default_network_flows` Grail bucket), NetFlow/IPFIX/sFlow (via an OpenTelemetry Collector), and cloud flow logs (AWS VPC / Transit Gateway; Azure and GCP planned). Use to analyze traffic between entities, find top talkers by bandwidth, map communication dependencies, investigate connection health (resets, timeouts, retransmissions, RTT), and resolve peers to monitored entities. Routes each question to the right source; source-specific DQL lives in the reference files. Trigger: "network flows", "top talkers", "traffic between hosts", "connection resets", "TCP retransmissions", "RTT", "pod connections", "network dependencies", "NetFlow", "IPFIX", "sFlow", "VPC flow logs", "cloud network traffic". Do NOT use for host NIC throughput or packet drops (use dt-obs-hosts), service request rate or latency (use dt-obs-services), or synthetic/uptime monitoring (use dt-obs-ext-monitors).
What it needs
About 4k tokens when loaded.
What this skill does
Network Flows Skill Analyze network traffic in Dynatrace across three flow data sources. This skill covers the use cases network flows enable and routes each question to the right source and reference file. The detailed, source-specific DQL lives in the reference files. What Network Flows Tell You Network flow data answers questions that metrics and traces cannot: Who talks to whom — communication dependencies between hosts, processes, pods, services, and external endpoints Top talkers — which entities generate the most traffic, by bytes or connection count Connection health — resets, timeouts, retransmissions, and round-trip time (RTT) per conversation Traffic composition — protocol (TCP/UDP), destination ports, direction (client vs server) Peer resolution — mapping raw IP:port peers back to monitored entities (host, process, pod, service) or flagging them as external --- The Three Flow Sources Choose the source based on where the traffic is and what is capturing it. When more than one applies, prefer the source with the richest entity context (usually OneAgent). Source Captured by Data location Entity context Use when --- --- --- --- --- OneAgent flows OneAgent network agent on the host events in the defaultnetworkflows Grail bucket Rich — the capturing entity (client or server) resolved to host / process / pod smartscape IDs; the remote peer as IP:port Traffic to/from OneAgent-monitored hosts, processes, or Kubernetes pods. The default and most detailed source. NetFlow / IPFIX / sFlow Network devices (switches, routers), ingested via an OpenTelemetry Collector logs (otel.scope.name == "otelcol/netflowreceiver"; recommend routing to a dedicated bucket) Device/interface level — raw IPs, exporter, interfaces; no smartscape entities Traffic seen by network hardware. Covers east-west and north-south flows at the network layer. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills dynatrace/dt-obs-network-flows