Traces are observability records that follow a single request as it moves through connected services, APIs, databases, and other components. They break a transaction into spans, which can include timestamps, service names, status codes, and correlation IDs. This gives operators a step-by-step view of where a request spent time and where it failed.
In cyber security, traces help defenders understand how systems behave under normal and suspicious conditions. They can reveal unusual service-to-service calls, repeated authentication attempts, broken access controls, or data moving through unexpected paths. During investigations, traces are useful for reconstructing an attack chain, confirming alert details, and spotting weak points that logs alone may miss. Paired with logs and metrics, they give security teams the context needed to separate routine traffic from malicious activity.