In one embodiment, a device instruments an application to generate OpenTelemetry trace data during execution of the application. The device detects an occurrence of a security event during execution of the application. The device identifies a correlation between the security event and the OpenTelemetry trace data. The device provides an indication of the security event in conjunction with the OpenTelemetry trace data, based on the security event being correlated with the OpenTelemetry trace data.