Add typed host event egress rule

docs/RULES.md

@@ -1,6 +1,6 @@
 # Enodia Sentinel Event Rule Reference
 
-Generated from the active exec/syscall rule defaults plus any configured `exec_rules_file` entries.
+Generated from the active exec/syscall/host-event rule defaults plus any configured `exec_rules_file` entries.
 
 Use `enodia-sentinel rules list/show/test` to inspect rules and validate event fixtures locally.
 
@@ -203,3 +203,23 @@ Expected false positives:
 - Realtime or performance-sensitive services using `mlock` intentionally.
 
 Drill or fixture: Use `rules test` with syscall `mlock`, `mlock2`, or `mlockall`.
+
+## SID 100067: Interpreter connected to an unusual public port
+
+- Event: `tcp_connect`
+- Signature: `host_rule.suspicious-egress`
+- Classtype: `suspicious-egress`
+- Severity: `HIGH`
+- Origin: `builtin`
+
+Match fields:
+- `events`: `tcp_connect`
+- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
+- `peer_public`: `True`
+- `peer_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`
+
+Expected false positives:
+- Interactive admin scripts that intentionally connect to a non-standard public service.
+- Developer tooling using interpreters for custom APIs on high ports.
+
+Drill or fixture: Use `rules test` with a `tcp_connect` event whose `comm` is an interpreter and whose public `peer_port` is not a common service port.