diff --git a/dictionary.json b/dictionary.json index 1a9476673..4a20fb0c2 100644 --- a/dictionary.json +++ b/dictionary.json @@ -3315,6 +3315,11 @@ "description": "The parent process of this process object. It is recommended to only populate this field for the first process object, to prevent deep nesting.", "type": "process" }, + "parent_span": { + "caption": "Parent Span", + "description": "The parent span of this span object. It is recommended to only populate this field for the first process object, to prevent deep nesting.", + "type": "span" + }, "parent_uid": { "caption": "Parent Unique ID", "description": "The unique identifier of an object's parent object. See specific usage.", @@ -4342,6 +4347,11 @@ "description": " The Server Name Indication (SNI) extension sent by the client.", "type": "string_t" }, + "span": { + "caption": "Span", + "description": "The information about the span. See specific usage.", + "type": "span" + }, "sp_name": { "caption": "OS Service Pack", "description": "The name of the latest Service Pack.", @@ -4744,6 +4754,11 @@ "description": "The event transmission time from one device to another. See specific usage.", "type": "timestamp_t" }, + "trace": { + "caption": "Trace", + "description": "The information about the trace. See specific usage.", + "type": "trace" + }, "tree_uid": { "caption": "Tree UID", "description": "The tree id is a unique SMB identifier which represents an open connection to a share.", @@ -5202,4 +5217,4 @@ } } } -} \ No newline at end of file +} diff --git a/events/application/api_activity.json b/events/application/api_activity.json index 91432f222..e9c2b9442 100644 --- a/events/application/api_activity.json +++ b/events/application/api_activity.json @@ -5,6 +5,9 @@ "extends": "application", "name": "api_activity", "attributes": { + "$include": [ + "profiles/trace.json" + ], "activity_id": { "enum": { "1": { @@ -58,5 +61,8 @@ "group": "primary", "requirement": "required" } - } -} \ No newline at end of file + }, + "profiles": [ + "trace" + ] +} diff --git a/events/network/http_activity.json b/events/network/http_activity.json index f4ac0878d..8d4f6bbdd 100644 --- a/events/network/http_activity.json +++ b/events/network/http_activity.json @@ -5,6 +5,9 @@ "extends": "network", "name": "http_activity", "attributes": { + "$include": [ + "profiles/trace.json" + ], "activity_id": { "enum": { "1": { @@ -62,5 +65,8 @@ "group": "primary", "requirement": "recommended" } - } -} \ No newline at end of file + }, + "profiles": [ + "trace" + ] +} diff --git a/objects/span.json b/objects/span.json new file mode 100644 index 000000000..f2be9f9d3 --- /dev/null +++ b/objects/span.json @@ -0,0 +1,41 @@ +{ + "caption": "Span", + "description": "The attributes associated with an event containing span data.", + "extends": "object", + "name": "span", + "attributes": { + "uid": { + "description": "The unique identifier of the span used in distributed systems and microservices architecture to track and correlate requests across various components of an application.", + "requirement": "required" + }, + "service": { + "description": "Identifies the service or component creating the span, which helps track its path through a distributed system.", + "requirement": "optional" + }, + "operation": { + "description": "Describes an actions performed in a span, such as API requests, database queries, or computations.", + "requirement": "optional", + "is_array": true + }, + "parent_span": { + "description": "The parent span of this span object. It is recommended to only populate this field for the first process object, to prevent deep nesting.", + "requirement": "optional" + }, + "start_time": { + "description": "The start timestamp of the span, essential for identifying latency and performance bottlenecks.", + "requirement": "optional" + }, + "end_time": { + "description": "The end timestamp of the span, essential for identifying latency and performance bottlenecks.", + "requirement": "optional" + }, + "duration": { + "description": "The span duration, the amount of time the trace covers from start_time to end_time in milliseconds.", + "requirement": "optional" + }, + "status_code": { + "description": "Indicates whether the operations in the span were successful, failed, or had an error, aiding in pinpointing issues.", + "requirement": "optional" + } + } +} diff --git a/objects/trace.json b/objects/trace.json new file mode 100644 index 000000000..30441ca6b --- /dev/null +++ b/objects/trace.json @@ -0,0 +1,36 @@ +{ + "caption": "Trace", + "description": "The trace object contains information about distruibuted traces which are critical to observability and describe how requests move through a system, capturing each step's timing and status.", + "extends": "object", + "name": "trace", + "attributes": { + "uid": { + "description": "The unique identifier of the trace used in distributed systems and microservices architecture to track and correlate requests across various components of an application.", + "requirement": "required" + }, + "span": { + "description": "The attributes associated with a span within a distributed trace.", + "requirement": "optional" + }, + "service": { + "description": "Identifies the service or component generating the trace.", + "requirement": "optional" + }, + "status_code": { + "description": "Indicates whether the operations in the trace were successful, failed, or had an error, aiding in pinpointing issues.", + "requirement": "optional" + }, + "start_time": { + "description": "The start timestamp of the trace, essential for identifying latency and performance bottlenecks.", + "requirement": "optional" + }, + "end_time": { + "description": "The end timestamp of the trace, essential for identifying latency and performance bottlenecks.", + "requirement": "optional" + }, + "duration": { + "description": "The trace duration, the amount of time the trace covers from start_time to end_time in milliseconds.", + "requirement": "optional" + } + } +} diff --git a/profiles/trace.json b/profiles/trace.json new file mode 100644 index 000000000..aad8ce67d --- /dev/null +++ b/profiles/trace.json @@ -0,0 +1,15 @@ +{ + "description": "The Trace Profile extends the OCSF framework to capture and standardize observability events, specifically targeting trace-level data. This profile enables integration and normalization of distributed tracing information, allowing OCSF events to retain essential trace context such as trace IDs, span relationships, and service dependencies.", + "meta": "profile", + "caption": "Trace", + "name": "trace", + "annotations": { + "group": "primary" + }, + "attributes": { + "trace": { + "description": "The trace object contains information about distruibuted traces which are critical to observability and describe how requests move through a system, capturing each step's timing and status.", + "requirement": "recommended" + } + } +} diff --git a/profiles/traces.json b/profiles/traces.json deleted file mode 100644 index 2172dd8d5..000000000 --- a/profiles/traces.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "description": "The attributes that identify trace attributes.", - "meta": "profile", - "caption": "Traces", - "name": "traces", - "annotations": { - "group": "primary" - }, - "attributes": { - "trace": { - "requirement": "recommended" - } - } -}