Security Semantic Conventions

Description

The purpose of this project is to bring in the security domain for the OpenTelemetry community.

As outlined in the ECS OTEP, the Elastic Common Schema (ECS) is currently being contributed to the semantic conventions schema. Given the significance of security within ECS, establishing this SIG is crucial as it will expedite the donation of ECS fields tailored to security use cases. Beyond expanding the schema, our aim is to craft a clear vision for the instrumentation required.

Deliverables

• Our current focus is on defining essential semantic conventions for security use cases.

  • This includes but is not limited to the following namespaces:
    • Code signature
    • DLL
    • DNS
    • File
    • Group
    • Hash
    • Host
    • Network
    • Operating System
    • Package
    • Process
    • Registry
    • Risk information
    • Rule
    • Threat
    • TLS
    • User
    • Vulnerability
  • Please note that some of the above-mentioned namespaces are already a part of the Semantic Conventions schema. The goal is to expand these namespaces to include additional fields that are relevant to security use cases.

• As new use cases and namespaces are introduced to the semantic conventions, there may be a need for additional instrumentation to accommodate them. It is anticipated that this aspect will expand through an iterative process.

Staffing / Help Wanted

We are seeking security experts to collaborate with us in expanding the security domain within the community.

Required staffing

There is an open PR to create a semconv-security-approver group for all PRs related to security fields.

• project lead: @trisch-me (Elastic)

• domain expert: @mjwolf (Elastic)

• domain expert: @raesene (Datadog)

• domain expert: @lambdanis (Isovalent)

• domain expert: @mdelfabro (Dynatrace)

• domain expert: @kelnage (Grafana Labs)

• domain expert: @alexvanboxel (Collibra)

• TC sponsor: @reyang

• TC sponsor: @jsuereth

Need more

• domain experts
• potentially, maintainers of language-specific instrumentation may be needed if the need arises.

Meeting Times

There is an allocated time in the Semantic Conventions SIG for this project.

• Mondays at 8 AM PST

For async conversation please use #otel-semconv-security slack channel from official CNCF slack workspace.

Security dashboard

Main dashboard with all the issues and PRs related to the project.

Timeline

The goal is to have the security semantic conventions implemented by the end of 2024.

The timeline for this project is as follows: December 2023: Initial Draft April 2024: Review and Refinement May 2024-December 2024: Introducing the Security Semantic Conventions

Labels

• security

Linked Issues and PRs

• Donating ECS to OpenTelemetry
• Creation of semconv-security-approver group