Expand TUI guidance and host detection coverage

tests/test_rule_compat.py

@@ -83,6 +83,18 @@ class TestRuleEventCompatibility(unittest.TestCase):
         }
         self.assertIn(100067, self._sids(event))
 
+    def test_host_event_accepts_listen_shape(self):
+        event = {
+            "type": "listen",
+            "pid": "4242",
+            "ppid": "1",
+            "uid": "1000",
+            "comm": "python3",
+            "bind_ip": "0.0.0.0",
+            "bind_port": "4444",
+        }
+        self.assertIn(100068, self._sids(event))
+
     def test_unknown_event_shape_still_errors(self):
         with self.assertRaisesRegex(
             ValueError, "event JSON must be an exec, syscall, or host event"