DevSecOps Practice Hub

Security Observability

Correlate metrics, logs and traces so security questions can be answered quickly.

IntermediateMonitoringOperations

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Operate Runtime security, secrets rotation and configuration reconciliation.
  • Monitor Detection engineering, SIEM, compliance evidence and incident response.

Overview

Observability adds traces and consistent correlation identifiers on top of logs and metrics, so an investigator can follow a single request across services.

Why it matters

During an incident the constraint is how fast you can answer questions, not how much data you stored.

How it works

  1. 01Services are instrumented with OpenTelemetry.
  2. 02Trace and request identifiers are propagated and logged.
  3. 03Dashboards are built for investigation workflows, not just uptime.

Common tools

OpenTelemetryGrafanaTempoKubernetesLinuxAWS

Implementation examples

pythonPropagate trace context in logs
from opentelemetry import trace span = trace.get_current_span()ctx = span.get_span_context()logger.info("payment.authorised", extra={    "trace_id": format(ctx.trace_id, "032x"),    "order_id": order.id,})
Shared identifiers are what let logs, metrics and traces be joined during an investigation.

Best practices

  • Propagate trace context across every service boundary.
  • Build investigation-oriented dashboards ahead of incidents.

Common mistakes

  • Instrumenting for performance only and omitting security-relevant attributes.