How This Briefing Works
This report opens with key findings, then maps the gaps between what Dynatrace discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Analysis pending. Findings will appear here once intelligence collection is complete.
Disclosure Gaps
Claims vs. Observed Behavior
1 gaps
pending
MEDIUM
They Claim
“Requires scanner verification of runtime behavior”
Observed Behavior
Analysis based on Dynatrace documentation, community forums, and court filings
Customer Impact
What This Means For You
Organizations using Dynatrace Session Replay face compound risk because the platform combines user behavioral data with full infrastructure telemetry. A data breach would expose not just session recordings but correlated backend data including server configurations, database query patterns, and application architecture. The wiretapping litigation creates precedent risk for organizations that deploy session replay without explicit opt-in consent. Additionally, Dynatrace's broad access across the organization (IT ops, dev, digital experience) means session recording data may be viewed by teams that were not contemplated in the original privacy impact assessment.
Recommended Actions
What To Do About It
Role-specific actions based on observed behavior
Recommended Actions for Dynatrace
- →- Configure Session Replay masking using Dynatrace's Allow List mode to explicitly define what content is captured rather than relying on blocklist masking. - Implement opt-in mode for session replay to ensure users provide informed consent before recordings begin. - Audit role-based access controls to restrict session replay viewing to authorized teams only. - Review data retention policies for session recordings separately from APM telemetry to minimize PII exposure windows. - Evaluate URL exclusion rules to prevent session recording on sensitive pages (payment, account settings, healthcare portals).
Negotiation Leverage
- →Leverage: Dynatrace's primary value is APM and infrastructure monitoring, not session replay. Use this to negotiate session replay as an add-on with specific data handling terms rather than accepting platform-wide data processing defaults. Key questions: Can session replay data be isolated from APM telemetry in terms of access controls and retention? What is the data residency for session recordings specifically? Does Dynatrace use session replay data for any internal purposes (model training, benchmarking)? Protections to require: Separate data processing addendum for session replay data. Contractual prohibition on using session recordings for purposes beyond the stated use case. Right to audit masking configuration. Data deletion SLA for session recordings upon contract termination or feature deactivation.
IOC Manifest
IOC Manifest
99 INDICATORS
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/_nuxt/app/5af0a03.modern.js*
Tracking script
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/_nuxt/chunk/062e371.modern.js*
Tracking script
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/_nuxt/chunk/7b*.modern.js*
Tracking script
TRACK
*www.dynatrace.com/customscripts/hedgehog-cp-edit.js*
Tracking script
TRACK
*www.dynatrace.com/customscripts/usersnap.js*
Tracking script
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/_nuxt/chunk/05f96dd.modern.js*
Tracking script
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/_nuxt/chunk/fc7aedc.modern.js*
Tracking script
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/_nuxt/chunk/18ddcc2.modern.js*
Tracking script
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/_nuxt/chunk/*.modern.js*
Tracking script
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/static/*/state.js*
Tracking script
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/_nuxt/chunk/e2d37b6.modern.js*
Tracking script
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/static/*/manifest.js*
Tracking script
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/static/*/payload.js*
Tracking script
TRACK
*www.dynatrace.com/_deployments/hedgehog/*-02-27T22:02:26-c36ec56/_nuxt/chunk/160aac6.modern.js*
Tracking script
TRACK
*www.dynatrace.com/static/common-components/footer/en.json*
Tracking script
TRACK
*www.dynatrace.com/static/common-components/navigation/en.json*
Tracking script
TRACK
*js-cdn.dynatrace.com/jstag/*/bf*vwq/*_complete.js*
Tracking script
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/_nuxt/app/5af0a03.modern.js
Auto-extracted from scan
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/_nuxt/chunk/062e371.modern.js
Auto-extracted from scan
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/_nuxt/chunk/fc7aedc.modern.js
Auto-extracted from scan
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/_nuxt/chunk/05f96dd.modern.js
Auto-extracted from scan
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/_nuxt/chunk/160aac6.modern.js
Auto-extracted from scan
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/_nuxt/chunk/7b88294.modern.js
Auto-extracted from scan
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/_nuxt/chunk/4502802.modern.js
Auto-extracted from scan
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/_nuxt/chunk/18ddcc2.modern.js
Auto-extracted from scan
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/_nuxt/chunk/e2d37b6.modern.js
Auto-extracted from scan
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/static/1772233131/state.js
Auto-extracted from scan
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/static/1772233131/payload.js
Auto-extracted from scan
TRACK
www.dynatrace.com/_deployments/hedgehog/2026-02-27T22:02:26-c36ec56/static/1772233131/manifest.js
Auto-extracted from scan
TRACK
www.dynatrace.com/customscripts/hedgehog-cp-edit.js
Auto-extracted from scan
TRACK
www.dynatrace.com/customscripts/usersnap.js
Auto-extracted from scan
TRACK
js-cdn.dynatrace.com/jstag/145e12d594f/bf25977vwq/EA7C4B59F27D43EB_complete.js
Auto-extracted from scan
Ecosystem
Ecosystem & Supply Chain
Dynatrace integrates with the entire enterprise IT stack. Session replay data exists within a platform that connects to cloud providers (AWS, Azure, GCP), CI/CD pipelines, ITSM tools (ServiceNow, PagerDuty), analytics platforms, and data warehouses. The Dynatrace API enables export of session data and metrics. Role-based access controls determine who can view session recordings, but the platform is typically accessible to IT operations, development, SRE, and digital experience teams. Dynatrace operates in a SaaS model with data hosted on Dynatrace infrastructure, though managed deployments are available for enterprises with strict data residency requirements.
Evidence
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
HAR Capture
Complete network capture with all requests and responses
IOC Manifest
99 detection signatures across scripts, domains, cookies, and network endpoints