Add typed host event egress rule

enodia_sentinel/events/host_event.py

@@ -0,0 +1,41 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Typed host event shared by non-exec, non-syscall event rules."""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+
+@dataclass(frozen=True)
+class HostEvent:
+    event: str
+    pid: int
+    ppid: int
+    uid: int
+    comm: str
+    parent_comm: str = ""
+    path: str = ""
+    argv: tuple[str, ...] = field(default_factory=tuple)
+    peer_ip: str = ""
+    peer_port: int = 0
+    local_ip: str = ""
+    local_port: int = 0
+
+    @property
+    def argv_str(self) -> str:
+        return " ".join((self.path, *self.argv)).strip()
+
+    def to_dict(self) -> dict:
+        return {
+            "event": self.event,
+            "pid": self.pid,
+            "ppid": self.ppid,
+            "uid": self.uid,
+            "comm": self.comm,
+            "parent_comm": self.parent_comm,
+            "path": self.path,
+            "argv": list(self.argv),
+            "peer_ip": self.peer_ip,
+            "peer_port": self.peer_port,
+            "local_ip": self.local_ip,
+            "local_port": self.local_port,
+        }