GUpdate span.json

Update span.json

Signed-off-by: Adam Gregory <[email protected]>

dictionary.json

@@ -3315,6 +3315,11 @@
       "description": "The parent process of this process object. It is recommended to only populate this field for the first process object, to prevent deep nesting.",
       "type": "process"
     },
+    "parent_span": {
+      "caption": "Parent Span",
+      "description": "The parent span of this span object. It is recommended to only populate this field for the first process object, to prevent deep nesting.",
+      "type": "span"
+    },
     "parent_uid": {
       "caption": "Parent Unique ID",
       "description": "The unique identifier of an object's parent object. See specific usage.",
@@ -4342,6 +4347,11 @@
       "description": " The Server Name Indication (SNI) extension sent by the client.",
       "type": "string_t"
     },
+    "span": {
+      "caption": "Span",
+      "description": "The information about the span. See specific usage.",
+      "type": "span"
+    },
     "sp_name": {
       "caption": "OS Service Pack",
       "description": "The name of the latest Service Pack.",
@@ -4744,6 +4754,11 @@
       "description": "The event transmission time from one device to another.  See specific usage.",
       "type": "timestamp_t"
     },
+    "trace": {
+      "caption": "Trace",
+      "description": "The information about the trace. See specific usage.",
+      "type": "trace"
+    },
     "tree_uid": {
       "caption": "Tree UID",
       "description": "The tree id is a unique SMB identifier which represents an open connection to a share.",
@@ -5202,4 +5217,4 @@
       }
     }
   }
-}
+}

events/application/api_activity.json

@@ -5,6 +5,9 @@
     "extends": "application",
     "name": "api_activity",
     "attributes": {
+        "$include": [
+          "profiles/trace.json"
+        ],
         "activity_id": {
             "enum": {
                 "1": {
@@ -58,5 +61,8 @@
             "group": "primary",
             "requirement": "required"
         }
-    }
-}
+    },
+    "profiles": [
+      "trace"
+  ]
+}

events/network/http_activity.json

@@ -5,6 +5,9 @@
   "extends": "network",
   "name": "http_activity",
   "attributes": {
+    "$include": [
+      "profiles/trace.json"
+    ],
     "activity_id": {
       "enum": {
         "1": {
@@ -62,5 +65,8 @@
       "group": "primary",
       "requirement": "recommended"
     }
-  }
-}
+  },
+  "profiles": [
+    "trace"
+  ]
+}

objects/span.json

@@ -0,0 +1,41 @@
+{
+  "caption": "Span",
+  "description": "The attributes associated with an event containing span data.",
+  "extends": "object",
+  "name": "span",
+  "attributes": {
+    "uid": {
+      "description": "The unique identifier of the span used in distributed systems and microservices architecture to track and correlate requests across various components of an application.",
+      "requirement": "required"
+    },
+    "service": {
+      "description": "Identifies the service or component creating the span, which helps track its path through a distributed system.",
+      "requirement": "optional"
+    },
+    "operation": {
+      "description": "Describes an actions performed in a span, such as API requests, database queries, or computations.",
+      "requirement": "optional",
+      "is_array": true
+    },
+    "parent_span": {
+      "description": "The parent span of this span object. It is recommended to only populate this field for the first process object, to prevent deep nesting.",
+      "requirement": "optional"
+    },
+    "start_time": {
+      "description": "The start timestamp of the span, essential for identifying latency and performance bottlenecks.",
+      "requirement": "optional"
+    },
+    "end_time": {
+      "description": "The end timestamp of the span, essential for identifying latency and performance bottlenecks.",
+      "requirement": "optional"
+    },
+    "duration": {
+      "description": "The span duration, the amount of time the trace covers from <code>start_time</code> to <code>end_time</code> in milliseconds.",
+      "requirement": "optional"
+    },
+    "status_code": {
+      "description": "Indicates whether the operations in the span were successful, failed, or had an error, aiding in pinpointing issues.",
+      "requirement": "optional"
+    }
+  }
+}

objects/trace.json

@@ -0,0 +1,36 @@
+{
+  "caption": "Trace",
+  "description": "The trace object contains information about distruibuted traces which are critical to observability and describe how requests move through a system, capturing each step's timing and status.",
+  "extends": "object",
+  "name": "trace",
+  "attributes": {
+    "uid": {
+      "description": "The unique identifier of the trace used in distributed systems and microservices architecture to track and correlate requests across various components of an application.",
+      "requirement": "required"
+    },
+    "span": {
+      "description": "The attributes associated with a span within a distributed trace.",
+      "requirement": "optional"
+    },
+    "service": {
+      "description": "Identifies the service or component generating the trace.",
+      "requirement": "optional"
+    },
+    "status_code": {
+      "description": "Indicates whether the operations in the trace were successful, failed, or had an error, aiding in pinpointing issues.",
+      "requirement": "optional"
+    },
+    "start_time": {
+      "description": "The start timestamp of the trace, essential for identifying latency and performance bottlenecks.",
+      "requirement": "optional"
+    },
+    "end_time": {
+      "description": "The end timestamp of the trace, essential for identifying latency and performance bottlenecks.",
+      "requirement": "optional"
+    },
+    "duration": {
+      "description": "The trace duration, the amount of time the trace covers from <code>start_time</code> to <code>end_time</code> in milliseconds.",
+      "requirement": "optional"
+    }
+  }
+}

profiles/trace.json

@@ -0,0 +1,15 @@
+{
+  "description": "The Trace Profile extends the OCSF framework to capture and standardize observability events, specifically targeting trace-level data. This profile enables integration and normalization of distributed tracing information, allowing OCSF events to retain essential trace context such as trace IDs, span relationships, and service dependencies.",
+  "meta": "profile",
+  "caption": "Trace",
+  "name": "trace",
+  "annotations": {
+    "group": "primary"
+  },
+  "attributes": {
+    "trace": {
+      "description": "The trace object contains information about distruibuted traces which are critical to observability and describe how requests move through a system, capturing each step's timing and status.",
+      "requirement": "recommended"
+    }
+  }
+}