add `origin_referrer_url`, `origin_url` and `zone_identifier` to the file attribute

[AsuNa-jp]

Changes

This PR adds the following attributes.

• file.origin_referrer_url
• file.origin_url
• file.zone_identifier

(Thanks @trisch-me for all the advice you gave me in creating this PR!)

Background: What are these fields for? (Updated 2024/Oct/21)

When downloading files from the internet (or network) using a web browser (such as Chrome or Edge) or a certain application, information about where the file came from is generally added to the file. This is a general behavior that can occur on all operating systems, and its primary use is to enhance security by providing context about the file’s source, allowing the system to assess potential risks and enforce appropriate security measures.

The details are explained below.

Windows

In Windows, it is known as the Mark of the Web(ref1, ref2), and is added to the file's NTFS alternate data stream.

For example, when you download an image file (image17.webp) from this webpage using a web browser, the download source URL is automatically added to the file's Alternate Data Stream (ADS) as following.

• Inside image17.webp:Zone.Identifier:$DATA

This PR adds a field to store the URL of the file's origin, which is saved in the NTFS alternate data stream (ADS).

• ZoneId is inteded to be stored in the zone_identifier field.
• ReferrerUrl is intended to be stored in the origin_referrer_url field
• HostUrl is inteded to be stored in the origin_url field.

Note - In the case of Windows, MotW can be used not only with NTFS but also with ReFS (8.1/2012 R2 or later)

Linux

In Linux, some applications may store the file origin metadata in extended attributes (xattr) or Gnome virtual filesystem(gvfs) to track the source of a file.

For example, when you download an image file (image17.webp) from this webpage using a web browser, the download source URL is automatically added to gvfs.

example of a file downloaded by using firefox

Additionally, by using Curl or Wget, the referer URL(user.xdg.referrer.url) and origin URL(user.xdg.origin.url) can be attached to the file's extended attributes. (Google Chrome used to add user.xdg.referrer.url and user.xdg.origin.url as well but it currently turned off this feature.)

• https://wiki.archlinux.org/title/Extended_attributes

example of a file downloaded by using curl

• user.xdg.referrer.url is intended to be stored in the origin_referrer_url field
• user.xdg.origin.url is inteded to be stored in the origin_url field.

Note - As written in this web page, all major Linux file systems including Ext4, Btrfs, ZFS, and XFS support extended attributes.

MacOS

(Since I don't have a Mac device, my investigation will be based on the internet.)

In MacOS, some applications may store the file origin metadata in extended attributes to track the source of a file as follows. It seems that both the referrer and origin URL are being saved.

The image source is as follows: https://stackoverflow.com/questions/70444996/obtaining-metadata-where-from-of-a-file-on-mac

The same thing is mentioned on another website as well. (https://exiftool.org/forum/index.php?topic=14991.0)

Usually if we save a file from browser, the file will have 2 strings in the 'Where from' attribute:

Background: the use cases. (Updated 2024/Oct/21)

• (A). For example, in Elastic Security (Elastic Defend), a file open event may be generated when a file is opened. By including the file's origin information, such as the Origin URL and Referrer URL, the system can assess whether the file might be malware downloaded from a malicious website based on those URLs.

• (B). Another example would be adding file origin information (such as the Origin URL and Referrer URL) to the file creation event when a file is downloaded from the internet. This would make it possible to detect if the file was downloaded from a website on a blocklist and take actions such as deleting the file.

Merge requirement checklist

• [x] CONTRIBUTING.md guidelines followed.
• [x] Change log entry added, according to the guidelines in When to add a changelog entry.
  • If your PR does not need a change log, start the PR title with [chore]
• [x] schema-next.yaml updated with changes to existing conventions.

[linux-foundation-easycla[bot]]

The committers listed above are authorized under a signed CLA.

• :white_check_mark: login: AsuNa-jp / name: Asuka Nakajima (ba508e4907cbc36e02b9064cfcbb93a1753c016b, e8256e6c0943182110e234a12da0a8bbe97e50ce, a2b4b356c16c0d386690a02fd47a88d459c28d3d, d82f261562c6e4046abb03d5d2a15952ee637d50, 130bf610d4a027a8d4d2d2ddd97b9c61c2c68999, 160b7ee57d8b17d05604ffa7c28b0febb32f3d98, a1a4867ce01ca352dd8d4f216608766567eaa928, ec834e6f05b8bbc27a39bc8376f4702ff3fabe23, 1f6663a2c2336fee32bc5399bba98af914500279, b0016f66a7bca425bdf719fbb88c2aa6f1d6316e, f4ad750d9ef5a2e405b889c15ddb0ce774eb4577, 37c9710f956bf263b920c09db7adb515545914f3, 481bd1c885d5f2b8e882fe45de236d0314989b2d, 968e8c2b27dcd1a8c36a1a0c383df9b8fc4674d6, 4b1193619096e1214e430cd689087d4396cf3487, c55cb2ba3c188153aee783c1149b451d39ec082d, 264fd13b28db4d01471a40d0611ec045aafcb3fb, c6b8d78b267bbf94828743e5b580782396d568d6, b590595897623720fda48b76322c1a7331d4914a, 7d5331c5a3deb673d5879583ca7d51ef4de2d69a, 17107e45483253fbf505a8bef50fc8a6b086a170, 4a2fed9910cde10b2a34e5a36bbac23296c6df70, daa081ee945c246f9080961bbb77a81a524a8de4, a3dfd75717dfc5ac16a62114dba7f33c82776ee6, 0793ef9a175dc5fc259bd3eb8d0ed2a663b173d5, ed796cc1def7672425d177491380c4863ebf3318, f4e241ce283ca48db014c38862d1c0212e89f725)
• :white_check_mark: login: trisch-me / name: Alexandra Konrad (329df1023ea3df159ea338c21a63e6bda79c3182)

[AsuNa-jp]

Hi @trisch-me Thank you for the prompt feedback on this PR. All of your points are absolutely valid. I have updated the PR based on your suggestions. (https://github.com/open-telemetry/semantic-conventions/pull/1430/commits/160b7ee57d8b17d05604ffa7c28b0febb32f3d98, https://github.com/open-telemetry/semantic-conventions/pull/1430/commits/37c9710f956bf263b920c09db7adb515545914f3) If there is anything else, please feel free to let me know!

[AsuNa-jp]

Thank you all for your comments. Based on feedback from various sources, I have added file.zone_identifier to this PR.

However, since there also have been concerns raised about whether the fields we plan to add are even necessary, we are considering having @trisch-me (and @magermark ) lead a more in-depth discussion during the upcoming Otel Semantic Convention meeting.

[AsuNa-jp]

Hi @trisch-me @lmolkova @joaopgrassi Based on last week’s discussion at the Symantec convention meeting, I have added additional explanations to this PR. If you need further explanations before approving this PR, please don't hesitate to let me know.

[trisch-me]

@AsuNa-jp could you please fix conflicts? thanks

[jsuereth]

My only remaining concern with this PR (and based on @lmolkova's comments) is whether the things you're defining should be event fields vs. attributes.

The two use cases you mention both involve an event. Are these attributes you're defining things we'd want to include in Spans and Metrics?

I think it'd be reasonable to define a file.open Event that has these fields within it, but I'm not positive how you'd possible have that "turn into a metric" or otherwise interact with spans.

[AsuNa-jp]

Hi @jsuereth Thank you for taking the time to provide feedback on this PR! I understand your concern that, based on the use cases I provided, origin_referrer_url, origin_url, and zone_identifier may not seem necessary to include in the Attribute.

However, I personally believe that this information should be included in the Attributes, as they may need to be referenced later. For example, these fields could be invaluable in determining whether a previously downloaded file was actually sourced from a newly identified malicious website.

This is just an example, but let’s say it was discovered today that https://outlook.office.com/ is a malicious website. These fields would be helpful to find out, 'How many files were actually downloaded from this site?

I hope this helps address your concerns. However, if you have any further concerns, please don’t hesitate to let me know.