fix(appsec): add WAF and RASP duration telemetry

[florentinl]

APPSEC-62670
APPSEC-62671

Description

Adds AppSec instrumentation telemetry distributions for WAF and RASP execution durations, matching tracer-wide semantics by reporting aggregate request/context values with event_rules_version and waf_version tags.

Testing

• Passes regular dd-trace-py unit tests

Risks

Low. Telemetry-only change; no tracing payload or blocking behavior changes.

Additional Notes

Includes release note.

[cit-pr-commenter-54b7da]

Codeowners resolved as

ddtrace/appsec/_asm_request_context.py                                  @DataDog/asm-python
releasenotes/notes/appsec-waf-rasp-duration-telemetry-9d214f6730b34ad1.yaml  @DataDog/apm-python
tests/appsec/appsec/test_telemetry.py                                   @DataDog/asm-python

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-05-19 07:10:41

Comparing candidate commit c8ec992 in PR branch florentin.labelle/missing-waf-and-rasp-telemetry with baseline commit f0f5ba0 in branch main.

Found 0 performance improvements and 1 performance regressions! Performance is the same for 66 metrics, 0 unstable metrics.

scenario:iastaspectsospath-ospathbasename_aspect

• 🟥 execution_time [+104.586µs; +110.805µs] or [+24.017%; +25.446%]

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f3333793d3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[florentinl]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-05-18 08:52:55 UTC ℹ️ Start processing command /merge

---

2026-05-18 08:53:01 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 52m (p90).

---

2026-05-18 10:53:35 UTC ❌ MergeQueue: The build pipeline has timeout

The merge request has been interrupted because the build 0 took longer than expected. The current limit for the base branch 'main' is 120 minutes.

[florentinl]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-05-18 11:31:57 UTC ℹ️ Start processing command /merge

---

2026-05-18 11:32:02 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 52m (p90).

---

2026-05-18 13:32:37 UTC ❌ MergeQueue: The build pipeline has timeout

The merge request has been interrupted because the build 0 took longer than expected. The current limit for the base branch 'main' is 120 minutes.

[datadog-prod-us1-4]

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c8ec992 | Docs | Datadog PR Page | Give us feedback!}