// SPDX-License-Identifier: GPL-3.0-or-later

// Package model contains implementation-neutral records shared by the Go
// system snapshot, detector, and event layers.
package model

// Process is the subset of /proc process state needed by the first ported
// poll detectors. Fields are added as more Python detectors move across.
type Process struct {
	PID     int    `json:"pid"`
	Comm    string `json:"comm"`
	Cmdline string `json:"cmdline"`
	Exe     string `json:"exe"`
}

// State is one injectable detector sweep, equivalent to the Python
// SystemState boundary.
type State struct {
	Processes []Process `json:"processes"`
}

// Alert matches enodia.alert.v1.
type Alert struct {
	SID       int    `json:"sid"`
	Severity  string `json:"severity"`
	Signature string `json:"signature"`
	Classtype string `json:"classtype"`
	Key       string `json:"key"`
	Detail    string `json:"detail"`
	PIDs      []int  `json:"pids"`
}