可观测性与安全的融合：统一数据平台的建设实践

/* MD / 富文本中的 .toc（含博客园搬家等嵌套结构）；.toc-box 在侧栏，不受影响 */
#content_views .toc,
/* 编辑器常在目录前后插入空 p（:empty 仍占 20px），一并去掉避免顶空隙 */
#content_views.markdown_views > p:empty:has(+ .toc),
#content_views.markdown_views > .toc + p:empty,
/* 富文本旧版目录标记 */
#content_views.htmledit_views #main-toc,
#content_views.htmledit_views #hr-toc,
#content_views.htmledit_views p[id*=\”-toc\”] {
display: none !important;
}
/* 目录去掉后，紧跟的首个标题不再多出一块上边距 */
#content_views.markdown_views > .toc + h1,
#content_views.markdown_views > .toc + h2,
#content_views.markdown_views > .toc + h3,
#content_views.markdown_views > .toc + h4,
#content_views.markdown_views > .toc + p:empty + h1,
#content_views.markdown_views > .toc + p:empty + h2,
#content_views.markdown_views > .toc + p:empty + h3,
#content_views.markdown_views > .toc + p:empty + h4 {
margin-top: 0 !important;
}

1. 引言：当可观测性遇上安全

过去十年，可观测性（Observability）与安全（Security）几乎是两条平行演进的技术赛道。前者围绕 Metrics、Logs、Traces 三大支柱，服务于 SRE 与研发团队，目标是"更快发现并定位故障"；后者围绕威胁检测、事件响应、合规审计，服务于安全团队，目标是"更快发现并阻断攻击"。

但当我们把视角拉高会发现：两者本质上都在回答同一个问题——“系统里正在发生什么，以及这是否正常？” 故障与攻击在数据层面高度同构：一次异常的 CPU 飙升，可能是流量突增，也可能是一次挖矿木马；一次异常的出站连接，可能是业务调用，也可能是一次数据外泄。

本文从 CNCF 的行业观察出发，结合安全厂商收购可观测性公司的产业信号，探讨如何以 OpenTelemetry 为骨干构建统一数据采集层，用 Trace 关联分析还原攻击链路，并给出 Security Observability 平台的技术选型建议。

2. CNCF CTO 观察：可观测性与安全正在融合

CNCF CTO 在多个公开场合反复强调一个判断：可观测性与安全的边界正在消失。这一判断并非概念炒作，而是由三个现实因素共同推动：

• 数据同源：安全检测所需的运行时行为数据（进程、网络、文件、系统调用），与可观测性所需的运行时上下文（服务、依赖、调用链）来自同一批采集点。重复采集意味着双倍开销与双份维护成本。
• 响应同速：云原生环境下，攻击窗口以分钟计。安全团队如果还在等日志从另一个系统批量导出，就已经错过了最佳处置时机。可观测性平台提供的实时流式能力，正是安全响应所需要的。
• 组织同频：越来越多企业将 SRE 与安全运营（SecOps）纳入同一个平台工程团队，共享数据底座与告警通道，避免"两套系统、两套口径、两套值班"。

CNCF 社区的具体动作也印证了这一趋势：OpenTelemetry 项目持续扩展对安全相关信号的支持，Falco 等运行时安全项目与可观测性生态的集成日益紧密，Kubernetes 审计日志、eBPF 采集等能力被逐步纳入统一的数据管道。

一句话总结：可观测性是安全的数据底座，安全是可观测性的价值延伸。

下图展示了可观测性与安全在数据、响应、组织三个维度上的融合关系：

#mermaid-svg-GmeGX6vKONRhQqbA{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-GmeGX6vKONRhQqbA .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-GmeGX6vKONRhQqbA .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-GmeGX6vKONRhQqbA .error-icon{fill:#552222;}#mermaid-svg-GmeGX6vKONRhQqbA .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-GmeGX6vKONRhQqbA .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-GmeGX6vKONRhQqbA .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-GmeGX6vKONRhQqbA .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-GmeGX6vKONRhQqbA .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-GmeGX6vKONRhQqbA .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-GmeGX6vKONRhQqbA .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-GmeGX6vKONRhQqbA .marker{fill:#333333;stroke:#333333;}#mermaid-svg-GmeGX6vKONRhQqbA .marker.cross{stroke:#333333;}#mermaid-svg-GmeGX6vKONRhQqbA svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-GmeGX6vKONRhQqbA p{margin:0;}#mermaid-svg-GmeGX6vKONRhQqbA .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-GmeGX6vKONRhQqbA .cluster-label text{fill:#333;}#mermaid-svg-GmeGX6vKONRhQqbA .cluster-label span{color:#333;}#mermaid-svg-GmeGX6vKONRhQqbA .cluster-label span p{background-color:transparent;}#mermaid-svg-GmeGX6vKONRhQqbA .label text,#mermaid-svg-GmeGX6vKONRhQqbA span{fill:#333;color:#333;}#mermaid-svg-GmeGX6vKONRhQqbA .node rect,#mermaid-svg-GmeGX6vKONRhQqbA .node circle,#mermaid-svg-GmeGX6vKONRhQqbA .node ellipse,#mermaid-svg-GmeGX6vKONRhQqbA .node polygon,#mermaid-svg-GmeGX6vKONRhQqbA .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-GmeGX6vKONRhQqbA .rough-node .label text,#mermaid-svg-GmeGX6vKONRhQqbA .node .label text,#mermaid-svg-GmeGX6vKONRhQqbA .image-shape .label,#mermaid-svg-GmeGX6vKONRhQqbA .icon-shape .label{text-anchor:middle;}#mermaid-svg-GmeGX6vKONRhQqbA .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-GmeGX6vKONRhQqbA .rough-node .label,#mermaid-svg-GmeGX6vKONRhQqbA .node .label,#mermaid-svg-GmeGX6vKONRhQqbA .image-shape .label,#mermaid-svg-GmeGX6vKONRhQqbA .icon-shape .label{text-align:center;}#mermaid-svg-GmeGX6vKONRhQqbA .node.clickable{cursor:pointer;}#mermaid-svg-GmeGX6vKONRhQqbA .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-GmeGX6vKONRhQqbA .arrowheadPath{fill:#333333;}#mermaid-svg-GmeGX6vKONRhQqbA .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-GmeGX6vKONRhQqbA .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-GmeGX6vKONRhQqbA .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-GmeGX6vKONRhQqbA .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-GmeGX6vKONRhQqbA .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-GmeGX6vKONRhQqbA .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-GmeGX6vKONRhQqbA .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-GmeGX6vKONRhQqbA .cluster text{fill:#333;}#mermaid-svg-GmeGX6vKONRhQqbA .cluster span{color:#333;}#mermaid-svg-GmeGX6vKONRhQqbA div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-GmeGX6vKONRhQqbA .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-GmeGX6vKONRhQqbA rect.text{fill:none;stroke-width:0;}#mermaid-svg-GmeGX6vKONRhQqbA .icon-shape,#mermaid-svg-GmeGX6vKONRhQqbA .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-GmeGX6vKONRhQqbA .icon-shape p,#mermaid-svg-GmeGX6vKONRhQqbA .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-GmeGX6vKONRhQqbA .icon-shape .label rect,#mermaid-svg-GmeGX6vKONRhQqbA .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-GmeGX6vKONRhQqbA .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-GmeGX6vKONRhQqbA .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-GmeGX6vKONRhQqbA :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

统一数据底座

安全侧

可观测性侧

Metrics指标

Logs日志

Traces调用链

威胁检测

事件响应

合规审计

同源采集点进程网络文件系统调用

实时流式管道

共享告警通道

3. 安全厂商收购可观测性公司的行业信号

如果说 CNCF 的观察是"技术趋势"，那么资本市场的动作就是"产业确认"。近几年，多起安全厂商收购可观测性/日志分析公司的案例，释放出明确的行业信号：

这些收购背后的共同逻辑是：安全产品的竞争力，正在从"检测规则的数量"转向"数据上下文的深度"。一个能回答"这个异常请求来自哪个服务、经过了哪些依赖、影响了哪些用户"的平台，其检测价值远高于一个只会喊"发现可疑 IP"的工具。

对建设者而言，这意味着选型时不应再把可观测性平台与安全平台割裂评估，而应优先考虑能否共享同一套采集、存储与查询能力。

从"单点工具"到"统一数据平台"的演进路径，可以更直观地理解这些收购背后的产业逻辑：

#mermaid-svg-4IwVV6jyrGXG5YVD{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-4IwVV6jyrGXG5YVD .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-4IwVV6jyrGXG5YVD .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-4IwVV6jyrGXG5YVD .error-icon{fill:#552222;}#mermaid-svg-4IwVV6jyrGXG5YVD .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-4IwVV6jyrGXG5YVD .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-4IwVV6jyrGXG5YVD .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-4IwVV6jyrGXG5YVD .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-4IwVV6jyrGXG5YVD .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-4IwVV6jyrGXG5YVD .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-4IwVV6jyrGXG5YVD .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-4IwVV6jyrGXG5YVD .marker{fill:#333333;stroke:#333333;}#mermaid-svg-4IwVV6jyrGXG5YVD .marker.cross{stroke:#333333;}#mermaid-svg-4IwVV6jyrGXG5YVD svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-4IwVV6jyrGXG5YVD p{margin:0;}#mermaid-svg-4IwVV6jyrGXG5YVD .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-4IwVV6jyrGXG5YVD .cluster-label text{fill:#333;}#mermaid-svg-4IwVV6jyrGXG5YVD .cluster-label span{color:#333;}#mermaid-svg-4IwVV6jyrGXG5YVD .cluster-label span p{background-color:transparent;}#mermaid-svg-4IwVV6jyrGXG5YVD .label text,#mermaid-svg-4IwVV6jyrGXG5YVD span{fill:#333;color:#333;}#mermaid-svg-4IwVV6jyrGXG5YVD .node rect,#mermaid-svg-4IwVV6jyrGXG5YVD .node circle,#mermaid-svg-4IwVV6jyrGXG5YVD .node ellipse,#mermaid-svg-4IwVV6jyrGXG5YVD .node polygon,#mermaid-svg-4IwVV6jyrGXG5YVD .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-4IwVV6jyrGXG5YVD .rough-node .label text,#mermaid-svg-4IwVV6jyrGXG5YVD .node .label text,#mermaid-svg-4IwVV6jyrGXG5YVD .image-shape .label,#mermaid-svg-4IwVV6jyrGXG5YVD .icon-shape .label{text-anchor:middle;}#mermaid-svg-4IwVV6jyrGXG5YVD .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-4IwVV6jyrGXG5YVD .rough-node .label,#mermaid-svg-4IwVV6jyrGXG5YVD .node .label,#mermaid-svg-4IwVV6jyrGXG5YVD .image-shape .label,#mermaid-svg-4IwVV6jyrGXG5YVD .icon-shape .label{text-align:center;}#mermaid-svg-4IwVV6jyrGXG5YVD .node.clickable{cursor:pointer;}#mermaid-svg-4IwVV6jyrGXG5YVD .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-4IwVV6jyrGXG5YVD .arrowheadPath{fill:#333333;}#mermaid-svg-4IwVV6jyrGXG5YVD .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-4IwVV6jyrGXG5YVD .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-4IwVV6jyrGXG5YVD .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-4IwVV6jyrGXG5YVD .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-4IwVV6jyrGXG5YVD .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-4IwVV6jyrGXG5YVD .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-4IwVV6jyrGXG5YVD .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-4IwVV6jyrGXG5YVD .cluster text{fill:#333;}#mermaid-svg-4IwVV6jyrGXG5YVD .cluster span{color:#333;}#mermaid-svg-4IwVV6jyrGXG5YVD div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-4IwVV6jyrGXG5YVD .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-4IwVV6jyrGXG5YVD rect.text{fill:none;stroke-width:0;}#mermaid-svg-4IwVV6jyrGXG5YVD .icon-shape,#mermaid-svg-4IwVV6jyrGXG5YVD .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-4IwVV6jyrGXG5YVD .icon-shape p,#mermaid-svg-4IwVV6jyrGXG5YVD .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-4IwVV6jyrGXG5YVD .icon-shape .label rect,#mermaid-svg-4IwVV6jyrGXG5YVD .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-4IwVV6jyrGXG5YVD .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-4IwVV6jyrGXG5YVD .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-4IwVV6jyrGXG5YVD :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

单点安全工具规则数量竞争

能力补齐收购日志APM追踪

数据整合安全事件与调用链

平台化统一数据底座

价值计费按风险效果度量

4. 统一数据采集：OpenTelemetry 作为安全遥测的骨干

4.1 为什么选择 OpenTelemetry

OpenTelemetry（OTel）已成为云原生可观测性的事实标准，其核心价值在于厂商中立的数据模型与统一的采集协议（OTLP）。将其作为安全遥测的骨干，有三点关键理由：

下图对比了传统"双管道"采集与 OTel 统一采集的差异：

#mermaid-svg-reIY0gKRuO66zOCp{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-reIY0gKRuO66zOCp .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-reIY0gKRuO66zOCp .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-reIY0gKRuO66zOCp .error-icon{fill:#552222;}#mermaid-svg-reIY0gKRuO66zOCp .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-reIY0gKRuO66zOCp .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-reIY0gKRuO66zOCp .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-reIY0gKRuO66zOCp .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-reIY0gKRuO66zOCp .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-reIY0gKRuO66zOCp .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-reIY0gKRuO66zOCp .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-reIY0gKRuO66zOCp .marker{fill:#333333;stroke:#333333;}#mermaid-svg-reIY0gKRuO66zOCp .marker.cross{stroke:#333333;}#mermaid-svg-reIY0gKRuO66zOCp svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-reIY0gKRuO66zOCp p{margin:0;}#mermaid-svg-reIY0gKRuO66zOCp .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-reIY0gKRuO66zOCp .cluster-label text{fill:#333;}#mermaid-svg-reIY0gKRuO66zOCp .cluster-label span{color:#333;}#mermaid-svg-reIY0gKRuO66zOCp .cluster-label span p{background-color:transparent;}#mermaid-svg-reIY0gKRuO66zOCp .label text,#mermaid-svg-reIY0gKRuO66zOCp span{fill:#333;color:#333;}#mermaid-svg-reIY0gKRuO66zOCp .node rect,#mermaid-svg-reIY0gKRuO66zOCp .node circle,#mermaid-svg-reIY0gKRuO66zOCp .node ellipse,#mermaid-svg-reIY0gKRuO66zOCp .node polygon,#mermaid-svg-reIY0gKRuO66zOCp .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-reIY0gKRuO66zOCp .rough-node .label text,#mermaid-svg-reIY0gKRuO66zOCp .node .label text,#mermaid-svg-reIY0gKRuO66zOCp .image-shape .label,#mermaid-svg-reIY0gKRuO66zOCp .icon-shape .label{text-anchor:middle;}#mermaid-svg-reIY0gKRuO66zOCp .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-reIY0gKRuO66zOCp .rough-node .label,#mermaid-svg-reIY0gKRuO66zOCp .node .label,#mermaid-svg-reIY0gKRuO66zOCp .image-shape .label,#mermaid-svg-reIY0gKRuO66zOCp .icon-shape .label{text-align:center;}#mermaid-svg-reIY0gKRuO66zOCp .node.clickable{cursor:pointer;}#mermaid-svg-reIY0gKRuO66zOCp .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-reIY0gKRuO66zOCp .arrowheadPath{fill:#333333;}#mermaid-svg-reIY0gKRuO66zOCp .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-reIY0gKRuO66zOCp .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-reIY0gKRuO66zOCp .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-reIY0gKRuO66zOCp .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-reIY0gKRuO66zOCp .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-reIY0gKRuO66zOCp .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-reIY0gKRuO66zOCp .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-reIY0gKRuO66zOCp .cluster text{fill:#333;}#mermaid-svg-reIY0gKRuO66zOCp .cluster span{color:#333;}#mermaid-svg-reIY0gKRuO66zOCp div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-reIY0gKRuO66zOCp .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-reIY0gKRuO66zOCp rect.text{fill:none;stroke-width:0;}#mermaid-svg-reIY0gKRuO66zOCp .icon-shape,#mermaid-svg-reIY0gKRuO66zOCp .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-reIY0gKRuO66zOCp .icon-shape p,#mermaid-svg-reIY0gKRuO66zOCp .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-reIY0gKRuO66zOCp .icon-shape .label rect,#mermaid-svg-reIY0gKRuO66zOCp .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-reIY0gKRuO66zOCp .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-reIY0gKRuO66zOCp .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-reIY0gKRuO66zOCp :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

重复采集双份维护

OTel统一管道

应用SDK与eBPF与审计日志

OTelCollector

可观测性后端

安全检测引擎

传统双管道

业务埋点

可观测性后端

安全Agent

安全平台

4.2 采集架构设计

#mermaid-svg-ZQi0gU2dj8ElVENN{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-ZQi0gU2dj8ElVENN .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-ZQi0gU2dj8ElVENN .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-ZQi0gU2dj8ElVENN .error-icon{fill:#552222;}#mermaid-svg-ZQi0gU2dj8ElVENN .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-ZQi0gU2dj8ElVENN .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-ZQi0gU2dj8ElVENN .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-ZQi0gU2dj8ElVENN .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-ZQi0gU2dj8ElVENN .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-ZQi0gU2dj8ElVENN .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-ZQi0gU2dj8ElVENN .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-ZQi0gU2dj8ElVENN .marker{fill:#333333;stroke:#333333;}#mermaid-svg-ZQi0gU2dj8ElVENN .marker.cross{stroke:#333333;}#mermaid-svg-ZQi0gU2dj8ElVENN svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-ZQi0gU2dj8ElVENN p{margin:0;}#mermaid-svg-ZQi0gU2dj8ElVENN .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-ZQi0gU2dj8ElVENN .cluster-label text{fill:#333;}#mermaid-svg-ZQi0gU2dj8ElVENN .cluster-label span{color:#333;}#mermaid-svg-ZQi0gU2dj8ElVENN .cluster-label span p{background-color:transparent;}#mermaid-svg-ZQi0gU2dj8ElVENN .label text,#mermaid-svg-ZQi0gU2dj8ElVENN span{fill:#333;color:#333;}#mermaid-svg-ZQi0gU2dj8ElVENN .node rect,#mermaid-svg-ZQi0gU2dj8ElVENN .node circle,#mermaid-svg-ZQi0gU2dj8ElVENN .node ellipse,#mermaid-svg-ZQi0gU2dj8ElVENN .node polygon,#mermaid-svg-ZQi0gU2dj8ElVENN .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-ZQi0gU2dj8ElVENN .rough-node .label text,#mermaid-svg-ZQi0gU2dj8ElVENN .node .label text,#mermaid-svg-ZQi0gU2dj8ElVENN .image-shape .label,#mermaid-svg-ZQi0gU2dj8ElVENN .icon-shape .label{text-anchor:middle;}#mermaid-svg-ZQi0gU2dj8ElVENN .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-ZQi0gU2dj8ElVENN .rough-node .label,#mermaid-svg-ZQi0gU2dj8ElVENN .node .label,#mermaid-svg-ZQi0gU2dj8ElVENN .image-shape .label,#mermaid-svg-ZQi0gU2dj8ElVENN .icon-shape .label{text-align:center;}#mermaid-svg-ZQi0gU2dj8ElVENN .node.clickable{cursor:pointer;}#mermaid-svg-ZQi0gU2dj8ElVENN .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-ZQi0gU2dj8ElVENN .arrowheadPath{fill:#333333;}#mermaid-svg-ZQi0gU2dj8ElVENN .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-ZQi0gU2dj8ElVENN .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-ZQi0gU2dj8ElVENN .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-ZQi0gU2dj8ElVENN .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-ZQi0gU2dj8ElVENN .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-ZQi0gU2dj8ElVENN .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-ZQi0gU2dj8ElVENN .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-ZQi0gU2dj8ElVENN .cluster text{fill:#333;}#mermaid-svg-ZQi0gU2dj8ElVENN .cluster span{color:#333;}#mermaid-svg-ZQi0gU2dj8ElVENN div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-ZQi0gU2dj8ElVENN .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-ZQi0gU2dj8ElVENN rect.text{fill:none;stroke-width:0;}#mermaid-svg-ZQi0gU2dj8ElVENN .icon-shape,#mermaid-svg-ZQi0gU2dj8ElVENN .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-ZQi0gU2dj8ElVENN .icon-shape p,#mermaid-svg-ZQi0gU2dj8ElVENN .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-ZQi0gU2dj8ElVENN .icon-shape .label rect,#mermaid-svg-ZQi0gU2dj8ElVENN .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-ZQi0gU2dj8ElVENN .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-ZQi0gU2dj8ElVENN .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-ZQi0gU2dj8ElVENN :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

消费层

处理层

采集层

数据源层

应用SDK OTel自动与手动

eBPFAgent内核态行为

K8s审计日志APIServer

网络流量Flow与PCAP

OTelCollector DaemonSet

OTelCollector Gateway集群

脱敏Processor

采样Processor

富化Processor资产身份标签

可观测性后端Trace Metric Log

安全检测引擎规则与ML

数据湖长期留存与回溯

4.3 关键实践要点

• 统一资源属性：为每个遥测数据附加 service.name、k8s.namespace.name、cloud.account.id 等资源标签，这是后续安全关联分析的"主键"。
• 安全信号标准化：将进程执行、文件访问、网络连接等安全事件映射为 OTel Log 记录，并遵循统一的属性命名，避免各 Agent 各自为政。
• 分级采样策略：对高价值安全信号（如特权进程启动、敏感文件访问）采用全量采集，对普通业务 Trace 采用尾部采样，平衡成本与覆盖。
• 数据脱敏前置：在 Collector 层完成 PII 脱敏，确保安全数据留存不违反合规要求。

# OTel Collector 配置片段：安全信号分流示例
processors:
batch:
timeout: 5s
attributes/security:
actions:
– key: telemetry.category
value: security
action: insert
tail_sampling:
policies:
– name: security–critical
type: string_attribute
string_attribute:
key: security.severity
values: ["high", "critical"]
– name: baseline
type: probabilistic
probabilistic:
sampling_percentage: 10

exporters:
otlp/observability:
endpoint: obs–backend:4317
otlp/security:
endpoint: sec–engine:4317

service:
pipelines:
traces:
receivers: [otlp]
processors: [attributes/security, tail_sampling, batch]
exporters: [otlp/observability, otlp/security]

5. 安全事件的 Trace 关联分析：从指标异常到攻击链路还原

5.1 核心思路

传统安全告警是"点"——一个可疑 IP、一次异常登录。而 Trace 提供的是"线"——一次请求从入口到出口的完整路径。将安全事件挂载到 Trace 上，就能把孤立的告警点连成可解释的攻击链路。

5.2 关联分析流程

#mermaid-svg-B8am4sH8dbViMWyN{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-B8am4sH8dbViMWyN .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-B8am4sH8dbViMWyN .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-B8am4sH8dbViMWyN .error-icon{fill:#552222;}#mermaid-svg-B8am4sH8dbViMWyN .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-B8am4sH8dbViMWyN .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-B8am4sH8dbViMWyN .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-B8am4sH8dbViMWyN .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-B8am4sH8dbViMWyN .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-B8am4sH8dbViMWyN .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-B8am4sH8dbViMWyN .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-B8am4sH8dbViMWyN .marker{fill:#333333;stroke:#333333;}#mermaid-svg-B8am4sH8dbViMWyN .marker.cross{stroke:#333333;}#mermaid-svg-B8am4sH8dbViMWyN svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-B8am4sH8dbViMWyN p{margin:0;}#mermaid-svg-B8am4sH8dbViMWyN .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-B8am4sH8dbViMWyN .cluster-label text{fill:#333;}#mermaid-svg-B8am4sH8dbViMWyN .cluster-label span{color:#333;}#mermaid-svg-B8am4sH8dbViMWyN .cluster-label span p{background-color:transparent;}#mermaid-svg-B8am4sH8dbViMWyN .label text,#mermaid-svg-B8am4sH8dbViMWyN span{fill:#333;color:#333;}#mermaid-svg-B8am4sH8dbViMWyN .node rect,#mermaid-svg-B8am4sH8dbViMWyN .node circle,#mermaid-svg-B8am4sH8dbViMWyN .node ellipse,#mermaid-svg-B8am4sH8dbViMWyN .node polygon,#mermaid-svg-B8am4sH8dbViMWyN .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-B8am4sH8dbViMWyN .rough-node .label text,#mermaid-svg-B8am4sH8dbViMWyN .node .label text,#mermaid-svg-B8am4sH8dbViMWyN .image-shape .label,#mermaid-svg-B8am4sH8dbViMWyN .icon-shape .label{text-anchor:middle;}#mermaid-svg-B8am4sH8dbViMWyN .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-B8am4sH8dbViMWyN .rough-node .label,#mermaid-svg-B8am4sH8dbViMWyN .node .label,#mermaid-svg-B8am4sH8dbViMWyN .image-shape .label,#mermaid-svg-B8am4sH8dbViMWyN .icon-shape .label{text-align:center;}#mermaid-svg-B8am4sH8dbViMWyN .node.clickable{cursor:pointer;}#mermaid-svg-B8am4sH8dbViMWyN .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-B8am4sH8dbViMWyN .arrowheadPath{fill:#333333;}#mermaid-svg-B8am4sH8dbViMWyN .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-B8am4sH8dbViMWyN .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-B8am4sH8dbViMWyN .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-B8am4sH8dbViMWyN .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-B8am4sH8dbViMWyN .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-B8am4sH8dbViMWyN .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-B8am4sH8dbViMWyN .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-B8am4sH8dbViMWyN .cluster text{fill:#333;}#mermaid-svg-B8am4sH8dbViMWyN .cluster span{color:#333;}#mermaid-svg-B8am4sH8dbViMWyN div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-B8am4sH8dbViMWyN .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-B8am4sH8dbViMWyN rect.text{fill:none;stroke-width:0;}#mermaid-svg-B8am4sH8dbViMWyN .icon-shape,#mermaid-svg-B8am4sH8dbViMWyN .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-B8am4sH8dbViMWyN .icon-shape p,#mermaid-svg-B8am4sH8dbViMWyN .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-B8am4sH8dbViMWyN .icon-shape .label rect,#mermaid-svg-B8am4sH8dbViMWyN .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-B8am4sH8dbViMWyN .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-B8am4sH8dbViMWyN .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-B8am4sH8dbViMWyN :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

是

否

指标异常触发CPU与连接数突增

定位异常时间窗与相关服务实例

检索该时间窗内相关Trace

提取Trace中的安全事件Span

是否存在可疑行为

沿调用链回溯定位入口与横向移动

标记为误报回流规则优化

生成攻击链路图与影响面评估

联动响应隔离阻断取证

5.3 典型关联场景

场景一：从资源异常到挖矿木马

某 Pod CPU 持续 100%，可观测性平台告警。通过 Trace 关联发现该 Pod 在异常时段内启动了 xmrig 进程（来自 eBPF 采集的进程执行事件），并存在到矿池地址的出站连接。三个信号叠加，从"性能问题"升级为"安全事件"。

场景二：从异常出站到数据外泄

安全引擎检测到某服务向陌生域名发起大量 HTTPS 请求。通过 Trace 回溯，发现该请求源自一个被注入的依赖库，且调用链上游是用户数据查询接口。由此确认这是一次供应链投毒导致的数据外泄尝试。

场景三：从登录异常到横向移动

身份系统报告某账号在短时间内从多个地域登录。通过 Trace 关联该账号发起的 API 调用，发现其访问了多个本无权限的服务，且调用模式呈现明显的自动化扫描特征，判定为凭证泄露后的横向移动。

三个典型场景在信号来源与攻击阶段上的对应关系如下：

#mermaid-svg-wpJNvPHwsLsbeCVt{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-wpJNvPHwsLsbeCVt .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-wpJNvPHwsLsbeCVt .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-wpJNvPHwsLsbeCVt .error-icon{fill:#552222;}#mermaid-svg-wpJNvPHwsLsbeCVt .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-wpJNvPHwsLsbeCVt .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-wpJNvPHwsLsbeCVt .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-wpJNvPHwsLsbeCVt .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-wpJNvPHwsLsbeCVt .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-wpJNvPHwsLsbeCVt .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-wpJNvPHwsLsbeCVt .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-wpJNvPHwsLsbeCVt .marker{fill:#333333;stroke:#333333;}#mermaid-svg-wpJNvPHwsLsbeCVt .marker.cross{stroke:#333333;}#mermaid-svg-wpJNvPHwsLsbeCVt svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-wpJNvPHwsLsbeCVt p{margin:0;}#mermaid-svg-wpJNvPHwsLsbeCVt .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-wpJNvPHwsLsbeCVt .cluster-label text{fill:#333;}#mermaid-svg-wpJNvPHwsLsbeCVt .cluster-label span{color:#333;}#mermaid-svg-wpJNvPHwsLsbeCVt .cluster-label span p{background-color:transparent;}#mermaid-svg-wpJNvPHwsLsbeCVt .label text,#mermaid-svg-wpJNvPHwsLsbeCVt span{fill:#333;color:#333;}#mermaid-svg-wpJNvPHwsLsbeCVt .node rect,#mermaid-svg-wpJNvPHwsLsbeCVt .node circle,#mermaid-svg-wpJNvPHwsLsbeCVt .node ellipse,#mermaid-svg-wpJNvPHwsLsbeCVt .node polygon,#mermaid-svg-wpJNvPHwsLsbeCVt .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-wpJNvPHwsLsbeCVt .rough-node .label text,#mermaid-svg-wpJNvPHwsLsbeCVt .node .label text,#mermaid-svg-wpJNvPHwsLsbeCVt .image-shape .label,#mermaid-svg-wpJNvPHwsLsbeCVt .icon-shape .label{text-anchor:middle;}#mermaid-svg-wpJNvPHwsLsbeCVt .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-wpJNvPHwsLsbeCVt .rough-node .label,#mermaid-svg-wpJNvPHwsLsbeCVt .node .label,#mermaid-svg-wpJNvPHwsLsbeCVt .image-shape .label,#mermaid-svg-wpJNvPHwsLsbeCVt .icon-shape .label{text-align:center;}#mermaid-svg-wpJNvPHwsLsbeCVt .node.clickable{cursor:pointer;}#mermaid-svg-wpJNvPHwsLsbeCVt .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-wpJNvPHwsLsbeCVt .arrowheadPath{fill:#333333;}#mermaid-svg-wpJNvPHwsLsbeCVt .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-wpJNvPHwsLsbeCVt .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-wpJNvPHwsLsbeCVt .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-wpJNvPHwsLsbeCVt .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-wpJNvPHwsLsbeCVt .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-wpJNvPHwsLsbeCVt .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-wpJNvPHwsLsbeCVt .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-wpJNvPHwsLsbeCVt .cluster text{fill:#333;}#mermaid-svg-wpJNvPHwsLsbeCVt .cluster span{color:#333;}#mermaid-svg-wpJNvPHwsLsbeCVt div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-wpJNvPHwsLsbeCVt .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-wpJNvPHwsLsbeCVt rect.text{fill:none;stroke-width:0;}#mermaid-svg-wpJNvPHwsLsbeCVt .icon-shape,#mermaid-svg-wpJNvPHwsLsbeCVt .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-wpJNvPHwsLsbeCVt .icon-shape p,#mermaid-svg-wpJNvPHwsLsbeCVt .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-wpJNvPHwsLsbeCVt .icon-shape .label rect,#mermaid-svg-wpJNvPHwsLsbeCVt .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-wpJNvPHwsLsbeCVt .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-wpJNvPHwsLsbeCVt .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-wpJNvPHwsLsbeCVt :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

场景一资源异常

CPU飙升与xmrig进程与矿池连接

挖矿木马执行阶段

场景二异常出站

陌生域名HTTPS与被注入依赖库

供应链投毒外泄阶段

场景三登录异常

多地域登录与越权API扫描

凭证泄露横向移动阶段

5.4 实现要点

• Span 与安全事件对齐：在关键 Span 上附加 security.event.type、security.risk.score 等属性，使安全事件天然具备调用链上下文。
• 统一时间基准：所有采集点必须做时钟同步（NTP/PTP），否则跨源关联会因时间漂移而失效。
• 保留原始数据：关联分析往往需要回溯原始日志，因此需在数据湖中保留足够长的原始数据窗口（建议不少于 30 天）。

6. 构建 Security Observability 平台的技术选型

6.1 选型原则

• 开放优先：优先选择支持 OTLP、OpenTelemetry 语义约定的组件，避免被单一厂商锁定。
• 存算分离：采集、存储、查询分层解耦，便于按需扩展与成本优化。
• 安全内建：脱敏、访问控制、审计日志应作为平台的基础能力，而非事后补丁。

6.2 分层选型建议

各层组件之间的数据流向与职责边界如下：

#mermaid-svg-JQrzGPb2ByzoKpJh{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-JQrzGPb2ByzoKpJh .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-JQrzGPb2ByzoKpJh .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-JQrzGPb2ByzoKpJh .error-icon{fill:#552222;}#mermaid-svg-JQrzGPb2ByzoKpJh .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-JQrzGPb2ByzoKpJh .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-JQrzGPb2ByzoKpJh .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-JQrzGPb2ByzoKpJh .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-JQrzGPb2ByzoKpJh .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-JQrzGPb2ByzoKpJh .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-JQrzGPb2ByzoKpJh .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-JQrzGPb2ByzoKpJh .marker{fill:#333333;stroke:#333333;}#mermaid-svg-JQrzGPb2ByzoKpJh .marker.cross{stroke:#333333;}#mermaid-svg-JQrzGPb2ByzoKpJh svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-JQrzGPb2ByzoKpJh p{margin:0;}#mermaid-svg-JQrzGPb2ByzoKpJh .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-JQrzGPb2ByzoKpJh .cluster-label text{fill:#333;}#mermaid-svg-JQrzGPb2ByzoKpJh .cluster-label span{color:#333;}#mermaid-svg-JQrzGPb2ByzoKpJh .cluster-label span p{background-color:transparent;}#mermaid-svg-JQrzGPb2ByzoKpJh .label text,#mermaid-svg-JQrzGPb2ByzoKpJh span{fill:#333;color:#333;}#mermaid-svg-JQrzGPb2ByzoKpJh .node rect,#mermaid-svg-JQrzGPb2ByzoKpJh .node circle,#mermaid-svg-JQrzGPb2ByzoKpJh .node ellipse,#mermaid-svg-JQrzGPb2ByzoKpJh .node polygon,#mermaid-svg-JQrzGPb2ByzoKpJh .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-JQrzGPb2ByzoKpJh .rough-node .label text,#mermaid-svg-JQrzGPb2ByzoKpJh .node .label text,#mermaid-svg-JQrzGPb2ByzoKpJh .image-shape .label,#mermaid-svg-JQrzGPb2ByzoKpJh .icon-shape .label{text-anchor:middle;}#mermaid-svg-JQrzGPb2ByzoKpJh .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-JQrzGPb2ByzoKpJh .rough-node .label,#mermaid-svg-JQrzGPb2ByzoKpJh .node .label,#mermaid-svg-JQrzGPb2ByzoKpJh .image-shape .label,#mermaid-svg-JQrzGPb2ByzoKpJh .icon-shape .label{text-align:center;}#mermaid-svg-JQrzGPb2ByzoKpJh .node.clickable{cursor:pointer;}#mermaid-svg-JQrzGPb2ByzoKpJh .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-JQrzGPb2ByzoKpJh .arrowheadPath{fill:#333333;}#mermaid-svg-JQrzGPb2ByzoKpJh .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-JQrzGPb2ByzoKpJh .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-JQrzGPb2ByzoKpJh .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-JQrzGPb2ByzoKpJh .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-JQrzGPb2ByzoKpJh .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-JQrzGPb2ByzoKpJh .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-JQrzGPb2ByzoKpJh .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-JQrzGPb2ByzoKpJh .cluster text{fill:#333;}#mermaid-svg-JQrzGPb2ByzoKpJh .cluster span{color:#333;}#mermaid-svg-JQrzGPb2ByzoKpJh div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-JQrzGPb2ByzoKpJh .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-JQrzGPb2ByzoKpJh rect.text{fill:none;stroke-width:0;}#mermaid-svg-JQrzGPb2ByzoKpJh .icon-shape,#mermaid-svg-JQrzGPb2ByzoKpJh .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-JQrzGPb2ByzoKpJh .icon-shape p,#mermaid-svg-JQrzGPb2ByzoKpJh .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-JQrzGPb2ByzoKpJh .icon-shape .label rect,#mermaid-svg-JQrzGPb2ByzoKpJh .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-JQrzGPb2ByzoKpJh .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-JQrzGPb2ByzoKpJh .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-JQrzGPb2ByzoKpJh :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

反馈优化规则

采集层OTelCollector与eBPF

传输层Kafka与Pulsar

存储层ClickHouse与TSDB与对象存储

查询分析层TraceQL与SQL与图数据库

检测层Sigma与Falco与ML

响应层SOAR与准入控制与网络策略

6.3 落地路线图

#mermaid-svg-EvXc5zkWZ8FeyeYf{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-EvXc5zkWZ8FeyeYf .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-EvXc5zkWZ8FeyeYf .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-EvXc5zkWZ8FeyeYf .error-icon{fill:#552222;}#mermaid-svg-EvXc5zkWZ8FeyeYf .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-EvXc5zkWZ8FeyeYf .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-EvXc5zkWZ8FeyeYf .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-EvXc5zkWZ8FeyeYf .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-EvXc5zkWZ8FeyeYf .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-EvXc5zkWZ8FeyeYf .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-EvXc5zkWZ8FeyeYf .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-EvXc5zkWZ8FeyeYf .marker{fill:#333333;stroke:#333333;}#mermaid-svg-EvXc5zkWZ8FeyeYf .marker.cross{stroke:#333333;}#mermaid-svg-EvXc5zkWZ8FeyeYf svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-EvXc5zkWZ8FeyeYf p{margin:0;}#mermaid-svg-EvXc5zkWZ8FeyeYf .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-EvXc5zkWZ8FeyeYf .cluster-label text{fill:#333;}#mermaid-svg-EvXc5zkWZ8FeyeYf .cluster-label span{color:#333;}#mermaid-svg-EvXc5zkWZ8FeyeYf .cluster-label span p{background-color:transparent;}#mermaid-svg-EvXc5zkWZ8FeyeYf .label text,#mermaid-svg-EvXc5zkWZ8FeyeYf span{fill:#333;color:#333;}#mermaid-svg-EvXc5zkWZ8FeyeYf .node rect,#mermaid-svg-EvXc5zkWZ8FeyeYf .node circle,#mermaid-svg-EvXc5zkWZ8FeyeYf .node ellipse,#mermaid-svg-EvXc5zkWZ8FeyeYf .node polygon,#mermaid-svg-EvXc5zkWZ8FeyeYf .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-EvXc5zkWZ8FeyeYf .rough-node .label text,#mermaid-svg-EvXc5zkWZ8FeyeYf .node .label text,#mermaid-svg-EvXc5zkWZ8FeyeYf .image-shape .label,#mermaid-svg-EvXc5zkWZ8FeyeYf .icon-shape .label{text-anchor:middle;}#mermaid-svg-EvXc5zkWZ8FeyeYf .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-EvXc5zkWZ8FeyeYf .rough-node .label,#mermaid-svg-EvXc5zkWZ8FeyeYf .node .label,#mermaid-svg-EvXc5zkWZ8FeyeYf .image-shape .label,#mermaid-svg-EvXc5zkWZ8FeyeYf .icon-shape .label{text-align:center;}#mermaid-svg-EvXc5zkWZ8FeyeYf .node.clickable{cursor:pointer;}#mermaid-svg-EvXc5zkWZ8FeyeYf .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-EvXc5zkWZ8FeyeYf .arrowheadPath{fill:#333333;}#mermaid-svg-EvXc5zkWZ8FeyeYf .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-EvXc5zkWZ8FeyeYf .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-EvXc5zkWZ8FeyeYf .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-EvXc5zkWZ8FeyeYf .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-EvXc5zkWZ8FeyeYf .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-EvXc5zkWZ8FeyeYf .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-EvXc5zkWZ8FeyeYf .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-EvXc5zkWZ8FeyeYf .cluster text{fill:#333;}#mermaid-svg-EvXc5zkWZ8FeyeYf .cluster span{color:#333;}#mermaid-svg-EvXc5zkWZ8FeyeYf div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-EvXc5zkWZ8FeyeYf .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-EvXc5zkWZ8FeyeYf rect.text{fill:none;stroke-width:0;}#mermaid-svg-EvXc5zkWZ8FeyeYf .icon-shape,#mermaid-svg-EvXc5zkWZ8FeyeYf .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-EvXc5zkWZ8FeyeYf .icon-shape p,#mermaid-svg-EvXc5zkWZ8FeyeYf .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-EvXc5zkWZ8FeyeYf .icon-shape .label rect,#mermaid-svg-EvXc5zkWZ8FeyeYf .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-EvXc5zkWZ8FeyeYf .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-EvXc5zkWZ8FeyeYf .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-EvXc5zkWZ8FeyeYf :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

阶段一统一采集OTel标准化

阶段二数据打通Trace与安全事件关联

阶段三检测增强规则与基线ML

阶段四闭环响应自动化处置

• 阶段一（1–2 个月）：完成 OTel Collector 部署与核心服务接入，统一资源属性规范。
• 阶段二（2–3 个月）：打通 Trace 与安全事件数据，建立关联查询能力，验证 2–3 个典型场景。
• 阶段三（3–6 个月）：沉淀检测规则库，引入行为基线，降低误报率。
• 阶段四（持续）：对接响应编排，实现从检测到处置的自动化闭环。

6.4 常见坑与规避

• 数据量失控：安全信号全量采集容易导致存储成本飙升，务必提前设计采样与保留策略。
• 关联字段缺失：如果早期没有统一资源属性，后期关联分析会非常痛苦，务必在阶段一就定好规范。
• 组织壁垒：技术打通容易，团队协作难。建议设立联合平台团队，共享 SLO 与值班机制。

7. 总结

可观测性与安全的融合，不是把两个系统简单拼在一起，而是在数据层面建立统一的语言。OpenTelemetry 提供了这套语言，Trace 关联分析提供了还原攻击链路的方法论，而分层解耦的技术选型则保证了平台的可演进性。

对于正在建设统一数据平台的团队，建议从"统一采集"这一最小切口入手，先让数据流起来，再逐步叠加检测与响应能力。融合的价值不在于工具的数量，而在于当异常发生时，你能用同一份数据同时回答"哪里坏了"和"谁在攻击"。