S
Shaun Miller
Current HEC log ingestion does not usefully index nested json.
Business Justification
Our organization is adopting OpenTelemetry as the standard observability framework for collecting logs, metrics, traces, and events across cloud, on-premises, and application environments. While OpenTelemetry has become the industry standard for telemetry collection, the current SIEM integration options are either limited or require custom ingestion pipelines.
Native OpenTelemetry support would simplify integrations, reduce operational overhead, improve telemetry consistency, and enable broader security visibility across modern infrastructure.
Requested Capability
  1. Native OpenTelemetry Data Ingestion
Support direct ingestion of:
OpenTelemetry Protocol (OTLP) over gRPC
OTLP over HTTP
OpenTelemetry Collector forwarding
Structured OpenTelemetry logs
Metrics relevant to security monitoring
Distributed traces
  1. OpenTelemetry Schema Awareness
Automatically recognize and normalize standard OpenTelemetry fields such as:
service.name
service.namespace
service.version
host.name
cloud.provider
cloud.region
deployment.environment
trace_id
span_id
severity_number
severity_text
Resource attributes
Instrumentation scope attributes
  1. Security Correlation
Enable correlation between:
Logs and traces
Infrastructure telemetry and security alerts
Application events and security incidents
User actions across distributed services
Examples:
Correlate authentication failures across microservices using Trace IDs.
Trace lateral movement activity across distributed applications.
Link API abuse indicators to backend service traces.
  1. OpenTelemetry Collector Integration
Provide validated configurations and documentation for:
OpenTelemetry Collector
Azure Monitor Exporter
Kubernetes deployments
Containerized workloads
AWS, Azure, and GCP environments
  1. Detection Content
Provide out-of-the-box dashboards and detections that leverage OpenTelemetry data:
Authentication anomalies
API abuse patterns
Service-to-service communication anomalies
Application compromise indicators
Distributed denial-of-service indicators
Suspicious trace patterns
  1. Performance and Scalability
Support:
High-volume OTLP ingestion
Multi-tenant collection architectures
Collector-based aggregation
Sampling-aware analytics
Buffered and resilient ingestion mechanisms
Expected Benefits
Operational Benefits
Reduced custom parser and connector maintenance
Faster onboarding of new applications
Standardized telemetry pipeline
Improved data quality and consistency
Security Benefits
Better visibility into modern cloud-native environments
Enhanced attack-path analysis
Improved incident investigation through trace correlation
Stronger detection coverage across distributed systems
Business Benefits
Reduced integration costs
Faster deployment of new services
Alignment with industry standards
Future-proof telemetry architecture
Priority
High
Use Cases
Correlate security events across microservices using Trace IDs.
Investigate suspicious application behavior end-to-end.
Monitor Kubernetes workloads through OpenTelemetry Collectors.
Centralize observability and security telemetry using a single standard.
Reduce dependence on vendor-specific agents and collectors.
Desired Outcome
The SIEM should be capable of ingesting, parsing, normalizing, correlating, and analyzing OpenTelemetry telemetry natively, allowing organizations to leverage OpenTelemetry as a first-class data source for security monitoring, threat detection, and incident response.
Impact: High value for organizations adopting cloud-native architectures, Kubernetes, Azure/AWS/GCP services, and modern observability platforms.