Conversation
hilmarf
force-pushed
the
auditing
branch
4 times, most recently
from
June 3, 2026 10:11
555387c to
2c9f015
Compare
Introduces a new `audit.*` attribute namespace and accompanying
documentation for the OpenTelemetry Audit Logging signal.
The audit signal is a dedicated, lossless pipeline separate from the
standard log/observability pipeline, required by compliance frameworks
such as ISO 27001, SOC 2, PCI-DSS, and HIPAA.
Files added:
- model/audit/registry.yaml — all audit.* attribute definitions
- model/audit/logs.yaml — audit.record attribute group with
requirement levels
- docs/audit/audit-logs.md — full documentation page incl. examples,
SDK invariants, and compliance mapping
- docs/registry/attributes/audit.md — registry attribute reference page
Attribute groups defined:
audit.record (record.id, schema.version)
audit.actor (actor.id, actor.type, actor.name)
audit.action (action, outcome)
audit.target (target.id, target.type, target.name)
audit.source (source.id, source.type)
audit.integrity (integrity.value, integrity.algorithm, integrity.certificate)
audit.sequence (sequence.number, prev.hash)
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Both audit.integrity.algorithm and audit.integrity.certificate are constants for the lifetime of a service instance — a resource uses one signing key throughout its life. Clarify in registry note, logs.yaml requirement level (conditionally_required as Resource attr), registry reference doc, and audit-logs.md integrity section + attribute table. Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
…nventions
audit.prev.hash violated the dot-namespacing rule: 'prev' is not a
standalone object namespace, it is a property qualifier for 'hash'.
Moving it under audit.sequence.* groups it with audit.sequence.number
where the rest of the hash-chain mechanics live, consistent with the
{object}.{property} pattern (e.g. http.response.status_code).
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Project Proposal: Audit Logging SIG #2409
Summary
audit.*attribute namespace implementing the OTEP 0267 Audit Logging signal designregistry.yaml,logs.yaml) defining all attribute groups with stability markers and requirement levelsdocs/audit/audit-logs.md) covering motivation, signal separation, attribute tables, SDK invariants, compliance mapping, and worked examplesdocs/registry/attributes/audit.md)Motivation
Compliance frameworks (ISO 27001, SOC 2, PCI-DSS, HIPAA) require that security-relevant events are captured completely, without loss, and in a tamper-evident form. The standard OTel Log signal allows sampling, back-pressure shedding, and record transformation — all incompatible with these requirements. This PR establishes the semantic conventions layer for the dedicated audit signal.
Attribute groups
audit.recordaudit.record.id(auto-generated UUID v4),audit.schema.versionaudit.actoraudit.actor.id✱,audit.actor.type✱ (user/service/system),audit.actor.nameaudit.actionaudit.action✱,audit.outcome✱ (success/failure/unknown)audit.targetaudit.target.id,audit.target.type,audit.target.nameaudit.sourceaudit.source.id,audit.source.typeaudit.integrityaudit.integrity.value(Base64url MAC/sig),audit.integrity.algorithm(JWA/IANA id),audit.integrity.certificateaudit.sequenceaudit.sequence.number(monotonic counter),audit.prev.hash(SHA-256 hash-chain)✱ mandatory on every audit record
Compliance mapping
audit.records.droppedmetric + alert invariantaudit.source.idfor IP captureaudit.integrity.value+audit.prev.hashhash chainaudit.actor.*+audit.target.*for ePHI access loggingTest plan
make build)model/audit/logs.yamlref:entries resolve againstmodel/audit/registry.yamldocs/audit/audit-logs.mdagainst OTEP 0267