Class: Span

name: Span
description: 'Represents a single unit of work or operation within a distributed trace.
  A

  span typically tracks the execution of a request across a service, capturing

  important details such as the operation, timestamps, and status. Spans help

  break down the overall trace into smaller, manageable parts, enabling detailed

  analysis of the performance and behavior of specific operations within the

  system. They are crucial for understanding latency, dependencies, and

  bottlenecks in complex distributed systems.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Span
is_a: Object
slots:
- duration
- end_time
- message
- operation
- parent_uid
- service
- start_time
- status_code
- uid
slot_usage:
  duration:
    name: duration
    description: 'The total time, in milliseconds, that the span represents, calculated
      as the

      difference between start_time and end_time. It reflects the operation''s

      performance and latency, independent of event timestamps, and accounts for

      normalized times used by observability tools to ensure consistency across

      distributed systems.'
  end_time:
    name: end_time
    description: 'The end timestamp of the span, essential for identifying latency
      and

      performance bottlenecks. Like the start time, this timestamp is normalized

      across the observability system to ensure consistency, even when events are

      recorded across distributed services with unsynchronized clocks. Normalized

      time allows for accurate duration calculations and helps observability tools

      track performance across services, regardless of the individual system time

      settings.'
    required: true
  message:
    name: message
    description: 'The message in a span (often referred to as a span event) serves
      as a way to

      record significant moments or occurrences during the span''s lifecycle. This

      content typically manifests as log entries, annotations, or semi-structured

      events as a string, providing additional granularity and context about what

      happens at specific points during the execution of an operation.'
  operation:
    name: operation
    description: 'Describes an action performed in a span, such as API requests, database

      queries, or computations.'
  parent_uid:
    name: parent_uid
    description: 'The ID of the parent span for this span object, establishing its
      relationship

      in the trace hierarchy.'
  service:
    name: service
    description: 'Identifies the service or component that generates the span, helping
      trace its

      path through the distributed system.'
  start_time:
    name: start_time
    description: 'The start timestamp of the span, essential for identifying latency
      and

      performance bottlenecks. This timestamp is normalized across the observability

      system, ensuring consistency even when events occur across distributed services

      with potentially unsynchronized clocks. By using normalized time, observability

      tools can provide accurate, uniform measurements of operation performance and

      latency, regardless of where or when the events actually occur.'
    required: true
  status_code:
    name: status_code
    description: 'Indicates the outcome of the operation in the span, such as success,
      failure,

      or error. Issues in a span typically refer to problems such as failed

      operations, timeouts, service unavailability, or errors in processing that can

      negatively impact the performance or reliability of the system. Tracking the

      `status_code` helps pinpoint these issues, enabling quicker identification and

      resolution of system inefficiencies or faults.'
  uid:
    name: uid
    description: 'The unique identifier for the span, used in distributed systems
      and

      microservices architectures to track and correlate requests across different

      components of an application. It enables tracing the flow of a request through

      various services.'
    required: true

name: Span
description: 'Represents a single unit of work or operation within a distributed trace.
  A

  span typically tracks the execution of a request across a service, capturing

  important details such as the operation, timestamps, and status. Spans help

  break down the overall trace into smaller, manageable parts, enabling detailed

  analysis of the performance and behavior of specific operations within the

  system. They are crucial for understanding latency, dependencies, and

  bottlenecks in complex distributed systems.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Span
is_a: Object
slot_usage:
  duration:
    name: duration
    description: 'The total time, in milliseconds, that the span represents, calculated
      as the

      difference between start_time and end_time. It reflects the operation''s

      performance and latency, independent of event timestamps, and accounts for

      normalized times used by observability tools to ensure consistency across

      distributed systems.'
  end_time:
    name: end_time
    description: 'The end timestamp of the span, essential for identifying latency
      and

      performance bottlenecks. Like the start time, this timestamp is normalized

      across the observability system to ensure consistency, even when events are

      recorded across distributed services with unsynchronized clocks. Normalized

      time allows for accurate duration calculations and helps observability tools

      track performance across services, regardless of the individual system time

      settings.'
    required: true
  message:
    name: message
    description: 'The message in a span (often referred to as a span event) serves
      as a way to

      record significant moments or occurrences during the span''s lifecycle. This

      content typically manifests as log entries, annotations, or semi-structured

      events as a string, providing additional granularity and context about what

      happens at specific points during the execution of an operation.'
  operation:
    name: operation
    description: 'Describes an action performed in a span, such as API requests, database

      queries, or computations.'
  parent_uid:
    name: parent_uid
    description: 'The ID of the parent span for this span object, establishing its
      relationship

      in the trace hierarchy.'
  service:
    name: service
    description: 'Identifies the service or component that generates the span, helping
      trace its

      path through the distributed system.'
  start_time:
    name: start_time
    description: 'The start timestamp of the span, essential for identifying latency
      and

      performance bottlenecks. This timestamp is normalized across the observability

      system, ensuring consistency even when events occur across distributed services

      with potentially unsynchronized clocks. By using normalized time, observability

      tools can provide accurate, uniform measurements of operation performance and

      latency, regardless of where or when the events actually occur.'
    required: true
  status_code:
    name: status_code
    description: 'Indicates the outcome of the operation in the span, such as success,
      failure,

      or error. Issues in a span typically refer to problems such as failed

      operations, timeouts, service unavailability, or errors in processing that can

      negatively impact the performance or reliability of the system. Tracking the

      `status_code` helps pinpoint these issues, enabling quicker identification and

      resolution of system inefficiencies or faults.'
  uid:
    name: uid
    description: 'The unique identifier for the span, used in distributed systems
      and

      microservices architectures to track and correlate requests across different

      components of an application. It enables tracing the flow of a request through

      various services.'
    required: true
attributes:
  duration:
    name: duration
    description: 'The total time, in milliseconds, that the span represents, calculated
      as the

      difference between start_time and end_time. It reflects the operation''s

      performance and latency, independent of event timestamps, and accounts for

      normalized times used by observability tools to ensure consistency across

      distributed systems.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Duration Milliseconds
    rank: 1000
    alias: duration
    owner: Span
    domain_of:
    - Span
    - Timespan
    - Trace
    - FirewallRule
    - BaseEvent
    - ScanActivity
    range: integer
  end_time:
    name: end_time
    description: 'The end timestamp of the span, essential for identifying latency
      and

      performance bottlenecks. Like the start time, this timestamp is normalized

      across the observability system to ensure consistency, even when events are

      recorded across distributed services with unsynchronized clocks. Normalized

      time allows for accurate duration calculations and helps observability tools

      track performance across services, regardless of the individual system time

      settings.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - End Time
    rank: 1000
    alias: end_time
    owner: Span
    domain_of:
    - Span
    - Timespan
    - Trace
    - NetworkTraffic
    - UnmannedSystemOperatingArea
    - MalwareScanInfo
    - BaseEvent
    - ScanActivity
    - Finding
    - IncidentFinding
    range: TimestampT
    required: true
  message:
    name: message
    description: 'The message in a span (often referred to as a span event) serves
      as a way to

      record significant moments or occurrences during the span''s lifecycle. This

      content typically manifests as log entries, annotations, or semi-structured

      events as a string, providing additional granularity and context about what

      happens at specific points during the execution of an operation.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Message
    rank: 1000
    alias: message
    owner: Span
    domain_of:
    - Response
    - Span
    - HttpResponse
    - LoadBalancer
    - BaseEvent
    - ApplicationError
    range: string
  operation:
    name: operation
    description: 'Describes an action performed in a span, such as API requests, database

      queries, or computations.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Operation
    rank: 1000
    alias: operation
    owner: Span
    domain_of:
    - Span
    - Api
    range: string
  parent_uid:
    name: parent_uid
    description: 'The ID of the parent span for this span object, establishing its
      relationship

      in the trace hierarchy.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Parent Unique ID
    rank: 1000
    alias: parent_uid
    owner: Span
    domain_of:
    - Script
    - Span
    range: string
  service:
    name: service
    description: 'Identifies the service or component that generates the span, helping
      trace its

      path through the distributed system.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Service
    rank: 1000
    alias: service
    owner: Span
    domain_of:
    - QueryEvidence
    - Span
    - Trace
    - Api
    - MessageContext
    - ServiceQuery
    - Authentication
    range: Service
  start_time:
    name: start_time
    description: 'The start timestamp of the span, essential for identifying latency
      and

      performance bottlenecks. This timestamp is normalized across the observability

      system, ensuring consistency even when events occur across distributed services

      with potentially unsynchronized clocks. By using normalized time, observability

      tools can provide accurate, uniform measurements of operation performance and

      latency, regardless of where or when the events actually occur.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Start Time
    rank: 1000
    alias: start_time
    owner: Span
    domain_of:
    - Span
    - Timespan
    - Trace
    - NetworkTraffic
    - UnmannedSystemOperatingArea
    - MalwareScanInfo
    - BaseEvent
    - ScanActivity
    - Finding
    - IncidentFinding
    range: TimestampT
    required: true
  status_code:
    name: status_code
    description: 'Indicates the outcome of the operation in the span, such as success,
      failure,

      or error. Issues in a span typically refer to problems such as failed

      operations, timeouts, service unavailability, or errors in processing that can

      negatively impact the performance or reliability of the system. Tracking the

      `status_code` helps pinpoint these issues, enabling quicker identification and

      resolution of system inefficiencies or faults.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Status Code
    rank: 1000
    alias: status_code
    owner: Span
    domain_of:
    - Span
    - Compliance
    - BaseEvent
    - EventLogActvity
    range: string
  uid:
    name: uid
    description: 'The unique identifier for the span, used in distributed systems
      and

      microservices architectures to track and correlate requests across different

      components of an application. It enables tracing the flow of a request through

      various services.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Unique ID
    rank: 1000
    alias: uid
    owner: Span
    domain_of:
    - Osint
    - Package
    - ProgrammaticCredential
    - RelatedEvent
    - Request
    - Sbom
    - Scim
    - Script
    - Session
    - Span
    - Sso
    - Ticket
    - Token
    - Trace
    - Entity
    - Resource
    - Account
    - Advisory
    - Agent
    - AiModel
    - Aircraft
    - Analytic
    - ApplicationObject
    - Assessment
    - Certificate
    - Check
    - ClassifierDetails
    - Container
    - Cve
    - Cwe
    - D3fTactic
    - D3fTechnique
    - DataClassification
    - Database
    - Databucket
    - DomainContact
    - Edge
    - Email
    - Endpoint
    - Evidences
    - Extension
    - Feature
    - File
    - FindingObject
    - FindingInfo
    - Graph
    - Group
    - HttpRequest
    - Idp
    - Image
    - KbArticle
    - LoadBalancer
    - Logger
    - Malware
    - ManagedEntity
    - MessageContext
    - Metadata
    - Mitigation
    - NetworkConnectionInfo
    - NetworkEndpoint
    - NetworkInterface
    - Node
    - Organization
    - PeripheralDevice
    - Policy
    - ProcessEntity
    - Product
    - QueryInfo
    - Reporter
    - Rule
    - Scan
    - Service
    - SubTechnique
    - Table
    - Tactic
    - Technique
    - Trait
    - TransformationInfo
    - UnmannedAerialSystem
    - User
    - WebResource
    - Device
    - WinResource
    range: string
    required: true