Data Model

The Event is modular by design: fields common to every origin live at the top level; protocol specifics live in the ProtocolData enum. Heuristics, rules and the scorer pattern-match on the accessor helpers and return early for variants they don't handle — no pipeline stage may assume an event is HTTP.

Event (top level)

A source produces a thin RawEvent; the ingestor promotes it to Event and fills geo/ASN/reputation.

ProtocolData (protocol enum)

HttpData (key fields)

UploadInfo / UploadKind (F10)

UploadInfo carries field_name, filename, content_type, size and kind. UploadKind classifies by magic bytes (the client declaration is only a hint): Text, Image (PNG/JPEG/GIF/WebP/BMP), Archive (ZIP/gzip/bzip2), Executable (MZ/ELF/Mach-O/shebang), Pdf, Unknown.

Accessor helpers

impl Event {
    pub fn http(&self) -> Option<&HttpData>
    pub fn tcp(&self) -> Option<&TcpData>
    pub fn tls(&self) -> Option<&TlsData>
    pub fn syslog(&self) -> Option<&SyslogData>
    pub fn protocol_kind(&self) -> ProtocolKind
}

DSL rules use protocol_kind() for protocol conditions (ProtocolKind: Http, Http3, Tcp, Udp, Tls, Other).

Golden rule: adding a new protocol

1. Add a variant to ProtocolData.
2. Add a helper on impl Event (e.g. pub fn my_proto(&self) -> Option<&MyData>).
3. Update protocol_kind().
4. Never add loose fields to the Event top level — put them in the enum.

Old consumers keep compiling (they simply ignore the new variant) and the same pipeline serves nginx today and TCP/TLS tomorrow.

Encoding normalization (heuristics)

Heuristics (SQLi, XSS, path traversal, etc.) run over the URL-decoded form of path/query (heuristics::http_text), so encoded payloads (%27 = ', + or %20 = space) cannot bypass detection. When writing new heuristics, always use http_text(http) instead of reading http.path / http.query directly.