diff --git a/dictionary.json b/dictionary.json
index 1a9476673..4a20fb0c2 100644
--- a/dictionary.json
+++ b/dictionary.json
@@ -3315,6 +3315,11 @@
"description": "The parent process of this process object. It is recommended to only populate this field for the first process object, to prevent deep nesting.",
"type": "process"
},
+ "parent_span": {
+ "caption": "Parent Span",
+ "description": "The parent span of this span object. It is recommended to only populate this field for the first process object, to prevent deep nesting.",
+ "type": "span"
+ },
"parent_uid": {
"caption": "Parent Unique ID",
"description": "The unique identifier of an object's parent object. See specific usage.",
@@ -4342,6 +4347,11 @@
"description": " The Server Name Indication (SNI) extension sent by the client.",
"type": "string_t"
},
+ "span": {
+ "caption": "Span",
+ "description": "The information about the span. See specific usage.",
+ "type": "span"
+ },
"sp_name": {
"caption": "OS Service Pack",
"description": "The name of the latest Service Pack.",
@@ -4744,6 +4754,11 @@
"description": "The event transmission time from one device to another. See specific usage.",
"type": "timestamp_t"
},
+ "trace": {
+ "caption": "Trace",
+ "description": "The information about the trace. See specific usage.",
+ "type": "trace"
+ },
"tree_uid": {
"caption": "Tree UID",
"description": "The tree id is a unique SMB identifier which represents an open connection to a share.",
@@ -5202,4 +5217,4 @@
}
}
}
-}
\ No newline at end of file
+}
diff --git a/events/application/api_activity.json b/events/application/api_activity.json
index 91432f222..e9c2b9442 100644
--- a/events/application/api_activity.json
+++ b/events/application/api_activity.json
@@ -5,6 +5,9 @@
"extends": "application",
"name": "api_activity",
"attributes": {
+ "$include": [
+ "profiles/trace.json"
+ ],
"activity_id": {
"enum": {
"1": {
@@ -58,5 +61,8 @@
"group": "primary",
"requirement": "required"
}
- }
-}
\ No newline at end of file
+ },
+ "profiles": [
+ "trace"
+ ]
+}
diff --git a/events/network/http_activity.json b/events/network/http_activity.json
index f4ac0878d..8d4f6bbdd 100644
--- a/events/network/http_activity.json
+++ b/events/network/http_activity.json
@@ -5,6 +5,9 @@
"extends": "network",
"name": "http_activity",
"attributes": {
+ "$include": [
+ "profiles/trace.json"
+ ],
"activity_id": {
"enum": {
"1": {
@@ -62,5 +65,8 @@
"group": "primary",
"requirement": "recommended"
}
- }
-}
\ No newline at end of file
+ },
+ "profiles": [
+ "trace"
+ ]
+}
diff --git a/objects/span.json b/objects/span.json
new file mode 100644
index 000000000..f2be9f9d3
--- /dev/null
+++ b/objects/span.json
@@ -0,0 +1,41 @@
+{
+ "caption": "Span",
+ "description": "The attributes associated with an event containing span data.",
+ "extends": "object",
+ "name": "span",
+ "attributes": {
+ "uid": {
+ "description": "The unique identifier of the span used in distributed systems and microservices architecture to track and correlate requests across various components of an application.",
+ "requirement": "required"
+ },
+ "service": {
+ "description": "Identifies the service or component creating the span, which helps track its path through a distributed system.",
+ "requirement": "optional"
+ },
+ "operation": {
+ "description": "Describes an actions performed in a span, such as API requests, database queries, or computations.",
+ "requirement": "optional",
+ "is_array": true
+ },
+ "parent_span": {
+ "description": "The parent span of this span object. It is recommended to only populate this field for the first process object, to prevent deep nesting.",
+ "requirement": "optional"
+ },
+ "start_time": {
+ "description": "The start timestamp of the span, essential for identifying latency and performance bottlenecks.",
+ "requirement": "optional"
+ },
+ "end_time": {
+ "description": "The end timestamp of the span, essential for identifying latency and performance bottlenecks.",
+ "requirement": "optional"
+ },
+ "duration": {
+ "description": "The span duration, the amount of time the trace covers from start_time
to end_time
in milliseconds.",
+ "requirement": "optional"
+ },
+ "status_code": {
+ "description": "Indicates whether the operations in the span were successful, failed, or had an error, aiding in pinpointing issues.",
+ "requirement": "optional"
+ }
+ }
+}
diff --git a/objects/trace.json b/objects/trace.json
new file mode 100644
index 000000000..30441ca6b
--- /dev/null
+++ b/objects/trace.json
@@ -0,0 +1,36 @@
+{
+ "caption": "Trace",
+ "description": "The trace object contains information about distruibuted traces which are critical to observability and describe how requests move through a system, capturing each step's timing and status.",
+ "extends": "object",
+ "name": "trace",
+ "attributes": {
+ "uid": {
+ "description": "The unique identifier of the trace used in distributed systems and microservices architecture to track and correlate requests across various components of an application.",
+ "requirement": "required"
+ },
+ "span": {
+ "description": "The attributes associated with a span within a distributed trace.",
+ "requirement": "optional"
+ },
+ "service": {
+ "description": "Identifies the service or component generating the trace.",
+ "requirement": "optional"
+ },
+ "status_code": {
+ "description": "Indicates whether the operations in the trace were successful, failed, or had an error, aiding in pinpointing issues.",
+ "requirement": "optional"
+ },
+ "start_time": {
+ "description": "The start timestamp of the trace, essential for identifying latency and performance bottlenecks.",
+ "requirement": "optional"
+ },
+ "end_time": {
+ "description": "The end timestamp of the trace, essential for identifying latency and performance bottlenecks.",
+ "requirement": "optional"
+ },
+ "duration": {
+ "description": "The trace duration, the amount of time the trace covers from start_time
to end_time
in milliseconds.",
+ "requirement": "optional"
+ }
+ }
+}
diff --git a/profiles/trace.json b/profiles/trace.json
new file mode 100644
index 000000000..aad8ce67d
--- /dev/null
+++ b/profiles/trace.json
@@ -0,0 +1,15 @@
+{
+ "description": "The Trace Profile extends the OCSF framework to capture and standardize observability events, specifically targeting trace-level data. This profile enables integration and normalization of distributed tracing information, allowing OCSF events to retain essential trace context such as trace IDs, span relationships, and service dependencies.",
+ "meta": "profile",
+ "caption": "Trace",
+ "name": "trace",
+ "annotations": {
+ "group": "primary"
+ },
+ "attributes": {
+ "trace": {
+ "description": "The trace object contains information about distruibuted traces which are critical to observability and describe how requests move through a system, capturing each step's timing and status.",
+ "requirement": "recommended"
+ }
+ }
+}
diff --git a/profiles/traces.json b/profiles/traces.json
deleted file mode 100644
index 2172dd8d5..000000000
--- a/profiles/traces.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
- "description": "The attributes that identify trace attributes.",
- "meta": "profile",
- "caption": "Traces",
- "name": "traces",
- "annotations": {
- "group": "primary"
- },
- "attributes": {
- "trace": {
- "requirement": "recommended"
- }
- }
-}