[BREAKING] Add ECS user namespace

.chloggen/user_ns.yaml

@@ -0,0 +1,22 @@
+# Use this changelog template to create an entry for release notes.
+#
+# If your change doesn't affect end users you should instead start
+# your pull request title with [chore] or use the "Skip Changelog" label.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: new_component
+
+# The name of the area of concern in the attributes-registry, (e.g. http, cloud, db)
+component: user
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Add new user namespace
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+# The values here must be integers.
+issues: [731]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:

docs/attributes-registry/README.md

@@ -51,6 +51,7 @@ Currently, the following namespaces exist:
 * [Thread](thread.md)
 * [TLS](tls.md)
 * [URL](url.md)
+* [User](user.md)
 * [User agent](user-agent.md)
 
 [developers recommendations]: ../general/attribute-naming.md#recommendations-for-application-developers

docs/attributes-registry/user.md

@@ -0,0 +1,20 @@
+<!--- Hugo front matter used to generate the website version of this page:
+--->
+
+# User
+
+## User Attributes
+
+<!-- semconv registry.user(omit_requirement_level) -->
+| Attribute  | Type | Description  | Examples  |
+|---|---|---|---|
+| `user.domain` | string | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | `internal.example.com` |
+| `user.email` | string | User email address. | `a.einstein@example.com` |
+| `user.full_name` | string | User's full name | `Albert Einstein` |
+| `user.hash` | string | Unique user hash to correlate information for a user in anonymized form. [1] | `364fc68eaf4c8acec74a4e52d7d1feaa` |
+| `user.id` | string | Unique identifier of the user. | `S-1-5-21-202424912787-2692429404-2351956786-1000` |
+| `user.name` | string | Short name or login/username of the user. | `a.einstein` |
+| `user.roles` | string[] | Array of user roles at the time of the event. | `[admin, reporting_user]` |
+
+**[1]:** Useful if `user.id` or `user.name` contain confidential information and cannot be used.
+<!-- endsemconv -->

model/registry/user.yaml

@@ -0,0 +1,43 @@
+groups:
+  - id: registry.user
+    prefix: user
+    type: attribute_group
+    brief: "Describes information about the user that is relevant to the event."
+    attributes:
+      - id: domain
+        type: string
+        brief: >
+          Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name.
+        examples: ['internal.example.com']
+      - id: email
+        type: string
+        brief: >
+          User email address.
+        examples: ['a.einstein@example.com']
+      - id: full_name
+        type: string
+        brief: >
+          User's full name
+        examples: ['Albert Einstein']
+      - id: hash
+        type: string
+        brief: >
+          Unique user hash to correlate information for a user in anonymized form.
+        note: >
+          Useful if `user.id` or `user.name` contain confidential information and cannot be used.
+        examples: ['364fc68eaf4c8acec74a4e52d7d1feaa']
+      - id: id
+        type: string
+        brief: >
+          Unique identifier of the user.
+        examples: ['S-1-5-21-202424912787-2692429404-2351956786-1000']
+      - id: name
+        type: string
+        brief: >
+          Short name or login/username of the user.
+        examples: ['a.einstein']
+      - id: roles
+        type: string[]
+        brief: >
+          Array of user roles at the time of the event.
+        examples: ["admin", "reporting_user"]