luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(schema): add enodia.event.v1 EVE-style event envelope

Browse source
This commit is contained in:
Luna 2026-07-10 04:43:35 -07:00
parent 8d929b50bd
commit 54bd8ff1f4
4 changed files with 111 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/SCHEMAS.md
View file

@ -12,6 +12,23 @@ not be removed, renamed, or change type.
Schema IDs live in `enodia_sentinel/schemas.py`, and compatibility tests in
`tests/test_schema_contracts.py` pin the required v1 fields.
## `enodia.event.v1`
Uniform envelope that wraps every emitted record with a typed discriminator.
This is the Python↔Go interoperability contract: any implementation must emit
the same envelope for the same input. Modeled on Suricata's EVE JSON — the
type-specific payload lives under a key named by `event_type`.
Required fields:
| Field | Type | Meaning |
|---|---|---|
| `schema` | string | `enodia.event.v1`. |
| `event_type` | string | Discriminator: `alert`, `incident`, or `status` (additive set). |
| `timestamp` | string | ISO-8601 emission time. |
| `host` | string | Hostname at emission time. |
| `<event_type>` | object | Payload, under a key equal to `event_type` (e.g. `alert` holds an `enodia.alert.v1` object). |
## `enodia.alert.v1`
Single detection object, used inside alert snapshots and by commands such as