Add typed host event egress rule

docs/COMMAND_REFERENCE.md

@@ -117,13 +117,13 @@ enodia-sentinel rules docs
 ```
 
 Inspects and tests event-driven detection rules without reading source code.
-`rules list` includes built-in exec/syscall rules plus configured exec rules
-from `exec_rules_file`. `rules show <sid>` prints the rule metadata and match
-conditions. `rules test <event-json>` loads an exec or syscall event JSON file,
-runs the matching rule engine, and prints any alerts that would fire. Use `-`
-instead of a path to read the event JSON from stdin. `rules docs` emits Markdown
-rule documentation from the active rule metadata; the built-in snapshot lives in
-[RULES.md](RULES.md).
+`rules list` includes built-in exec, syscall, and typed host-event rules plus
+configured exec rules from `exec_rules_file`. `rules show <sid>` prints the rule
+metadata and match conditions. `rules test <event-json>` loads an exec, syscall,
+or host-event JSON file, runs the matching rule engine, and prints any alerts
+that would fire. Use `-` instead of a path to read the event JSON from stdin.
+`rules docs` emits Markdown rule documentation from the active rule metadata;
+the built-in snapshot lives in [RULES.md](RULES.md).
 
 Exec event JSON shape:
 
@@ -151,6 +151,20 @@ Syscall event JSON shape:
 }
 ```
 
+Host event JSON shape:
+
+```json
+{
+  "event": "tcp_connect",
+  "pid": 42,
+  "ppid": 1,
+  "uid": 1000,
+  "comm": "python3",
+  "peer_ip": "8.8.8.8",
+  "peer_port": 4444
+}
+```
+
 Exit code:
 
 - `0`: list/show succeeded, or `rules test` matched at least one rule.