
Dynatrace
External Program
Submit bugs directly to this organization
To get your testing environment, follow these steps:
In connection with your participation in this program, you agree to comply with all applicable laws and regulations.
You may not participate in this program if you are subject to sanctions by the United States, European Union, or United Kingdom. You also may not participate if you are a resident or an individual located in a country that is subject to comprehensive or near-comprehensive sanctions (Cuba, Iran, North Korea, Syria, Russia, Belarus, Venezuela, and the Crimea, Donetsk People’s Republic, and Luhansk People’s Republic regions of Ukraine).
We will only reward the first person to responsibly report a vulnerability to us. Any vulnerabilities that are publicly disclosed without providing a reasonable amount of time for Dynatrace to respond will not be rewarded. You must report a qualifying vulnerability through the HackerOne reporting tool to be eligible for a reward.
Please make sure to have read HackerOne’s vulnerability disclosure guidelines before you start participating in the Dynatrace bug bounty program.
Do not engage in the following:
Reports that solely indicate a lack of possible security defenses are excluded from this program. This includes:
In connection with your participation in this program, you agree to comply with all applicable laws and regulations.
You may not participate in this program if you are subject to sanctions by the United States, the United Kingdom, or the European Union. You also may not participate if you are a resident or an individual located in a country that is subject to comprehensive or near-comprehensive sanctions (Cuba, Iran, North Korea, Syria, Russia, Belarus, Venezuela, and the Crimea, Donetsk People’s Republic, and Luhansk People’s Republic regions of Ukraine).
You may not adversely impact confidentiality, integrity, or availability of data or services belonging to Dynatrace, its customers, or suppliers. This includes: (i) disrupting or degrading Dynatrace’s products and service to its customers; (ii) modifying or corrupting Dynatrace programs or data to extract and publish information; and (iii) extracting or publishing data belonging to Dynatrace customers.
Vulnerabilities obtained by exploiting Dynatrace employees, customers, or suppliers, or by otherwise violating these guidelines, are not eligible for a bounty and will result in immediate disqualification from the program.
Dynatrace reserves the right to discontinue this reward program and to change its terms at any time without prior notification. All decisions regarding reward payments are final. The rules of this reward program or any communication related there do not provide or imply any obligations to Dynatrace of any kind.
Dynatrace’s collection, processing, and use of your information is described in Dynatrace Privacy Notice.
Thank you for helping keep Dynatrace and our customers safe!
Here is some documentation that we also provide to our external penetration testers. The following PDF files are intended to give you a brief overview of our product and help you get started. Additionally, we’ve included several attack scenarios that we believe are particularly relevant and worth exploring.
To test all functions of Dynatrace we recommend that you install a Dynatrace OneAgent on a test environment. OneAgent is responsible for collecting all monitoring data within your monitored environment. This way you can see some data in your environment.
You can find further installation instructions on our support page.
EasyTravel & EasyTrade are demo applications which can help you to generate test data. Install it on the environment where you installed the OneAgent.
Here are some links that contain more detailed instructions & download links:
Please keep in mind that EasyTravel & EasyTrade are out of scope of this program!
ActiveGate is a secure proxy that connects Dynatrace OneAgents to Dynatrace Clusters or other ActiveGates. It simplifies network interactions, reduces complexity and cost, and performs monitoring tasks for different technologies.
In case you want to read more about our ActiveGates you can have a look at our support page. Detailed instructions on how to install and use an AG you can find here.
If you haven't requested your testing environment yet, please do so. You can find detailed instructions at the top of our Policy page. Once you have requested your testing environment, you will be redirected to the latest version of our product, the Dynatrace Platform (3rd gen). This serves as your default testing environment. While we continue to support the older 2nd gen version with regular updates and patches, new customers will be onboarded to the Dynatrace Platform.
If the following steps are not done, you will be automatically redirected from your 2nd to your 3rd gen environment. With the following steps this redirection will be disabled:
{F2960757}
If you have any questions or this doesn't work for you, please reach out to [email protected]
With Dynatrace, it is also possible to monitor mobile applications for Android and iOS. The setup process is different as it involves compiling, packaging and shipping a monitoring library together with your own mobile application package.
You can find information on how to do this on our support page: