syntax = "proto3";
package f5.nginx.agent.sdk.events;
option go_package = "github.com/nginx/agent/sdk/v2/proto/events;f5.nginx.agent.sdk.events";

import "gogo.proto";
import "google/protobuf/timestamp.proto";
import "common/common.proto";

message Metadata {
    string Module = 1 [(gogoproto.jsontag) = "module" ];
    string UUID = 2 [(gogoproto.jsontag) = "uuid" ];
    string CorrelationID = 3 [(gogoproto.jsontag) = "correlation_id" ];
    google.protobuf.Timestamp Timestamp = 4 [(gogoproto.jsontag) = "timestamp" ];
    string EventLevel = 5 [(gogoproto.jsontag) = "event_level" ];
    string Type = 6 [(gogoproto.jsontag) = "type" ];
    string Category = 7 [(gogoproto.jsontag) = "category" ];
}

message Event {
    Metadata Metadata = 1 [(gogoproto.jsontag) = "metadata" ];
    oneof data {
        ActivityEvent ActivityEvent = 2 [(gogoproto.jsontag) = "activity_event" ];

        // While generating the SecurityViolationEvent, the Metadata for a SecurityViolationEvent
        // would look as shown below:
        // *   Module           = Agent
        // *   UUID             = A UUID generated by the Agent for the EventReport
        // *   CorrelationID    = The UUID will be used as the Correlation ID to track the EventReport
        // *   Timestamp        = The timestamp when NGINX Agent received the violation event
        // *   EventLevel       = All the SecurityViolationEvent would be generated at an ERROR_EVENT_LEVEL ("ERROR") level
        //                        In future, the levels might be dynamically chosen based on Request Outcome of SecurityViolationEvent
        // *   Type             = NGINX_EVENT_TYPE ("Nginx")
        // *   Category         = APP_PROTECT_CATEGORY ("AppProtect")
        // 
        SecurityViolationEvent SecurityViolationEvent = 3 [(gogoproto.jsontag) = "security_violation_event" ];
    }
}

message EventReport {
    repeated Event Events = 1 [(gogoproto.jsontag) = "events" ];
}

message ActivityEvent {
    string Message = 1 [(gogoproto.jsontag) = "message" ];
    repeated f5.nginx.agent.sdk.common.Dimension Dimensions = 2 [(gogoproto.jsontag) = "dimensions" ];
}

// SecurityViolationEvent represents a Security Violation that is emitted by the Agent
message SecurityViolationEvent {
    string PolicyName = 1 [(gogoproto.jsontag) = "policy_name" ];
    string SupportID = 2 [(gogoproto.jsontag) = "support_id" ];

    string Outcome = 3 [(gogoproto.jsontag) = "outcome" ];
    string OutcomeReason = 4 [(gogoproto.jsontag) = "outcome_reason" ];
    string BlockingExceptionReason = 5 [(gogoproto.jsontag) = "blocking_exception_reason" ];

    string Method = 6 [(gogoproto.jsontag) = "method" ];
    string Protocol = 7 [(gogoproto.jsontag) = "protocol" ];
    string XForwardedForHeaderValue = 8 [(gogoproto.jsontag) = "xff_header_value" ];

    string URI = 9 [(gogoproto.jsontag) = "uri" ];
    string Request = 10 [(gogoproto.jsontag) = "request" ];
    string IsTruncated = 11 [(gogoproto.jsontag) = "is_truncated" ];
    string RequestStatus = 12 [(gogoproto.jsontag) = "request_status" ];
    string ResponseCode = 13 [(gogoproto.jsontag) = "response_code" ];

    string ServerAddr = 14 [(gogoproto.jsontag) = "server_addr" ];
    string VSName = 15 [(gogoproto.jsontag) = "vs_name" ];
    string RemoteAddr = 16[(gogoproto.jsontag) = "remote_addr" ];
    string RemotePort = 17 [(gogoproto.jsontag) = "destination_port" ];
    string ServerPort = 18 [(gogoproto.jsontag) = "server_port" ];

    string Violations = 19 [(gogoproto.jsontag) = "violations" ];
    string SubViolations = 20 [(gogoproto.jsontag) = "sub_violations" ];
    string ViolationRating = 21 [(gogoproto.jsontag) = "violation_rating" ];

    string SigSetNames = 22 [(gogoproto.jsontag) = "sig_set_names" ];
    string SigCVEs = 23 [(gogoproto.jsontag) = "sig_cves" ];

    string ClientClass = 24 [(gogoproto.jsontag) = "client_class" ];
    string ClientApplication = 25 [(gogoproto.jsontag) = "client_application" ];
    string ClientApplicationVersion = 26 [(gogoproto.jsontag) = "client_application_version" ];

    string Severity = 27 [(gogoproto.jsontag) = "severity" ];
    string ThreatCampaignNames = 28 [(gogoproto.jsontag) = "threat_campaign_names" ];

    string BotAnomalies = 29 [(gogoproto.jsontag) = "bot_anomalies" ];
    string BotCategory = 30 [(gogoproto.jsontag) = "bot_category" ];
    string EnforcedBotAnomalies = 31 [(gogoproto.jsontag) = "enforced_bot_anomalies" ];
    string BotSignatureName = 32 [(gogoproto.jsontag) = "bot_signature_name" ];

    string ViolationContexts = 33 [(gogoproto.jsontag) = "violation_contexts" ];
    repeated ViolationData ViolationsData = 34 [(gogoproto.jsontag) = "violations_data" ];

    string SystemID = 35 [(gogoproto.jsontag) = "system_id" ];
    string InstanceTags = 36 [(gogoproto.jsontag) = "instance_tags" ];
    string InstanceGroup = 37 [(gogoproto.jsontag) = "instance_group" ];
    string DisplayName = 38 [(gogoproto.jsontag) = "display_name" ];
    string NginxID = 39 [(gogoproto.jsontag) = "nginx_id" ];
    string ParentHostname = 40 [(gogoproto.jsontag) = "parent_hostname" ];
}

message SignatureData {
    string ID = 1 [(gogoproto.jsontag) = "sig_data_id" ];
    string BlockingMask = 2 [(gogoproto.jsontag) = "sig_data_blocking_mask" ];
    string Buffer = 3 [(gogoproto.jsontag) = "sig_data_buffer" ];
    string Offset = 4 [(gogoproto.jsontag) = "sig_data_offset" ];
    string Length = 5 [(gogoproto.jsontag) = "sig_data_length" ];
}

message ContextData {
    string Name = 1 [(gogoproto.jsontag) = "parameter_data_name"];
    string Value = 2 [(gogoproto.jsontag) = "parameter_data_value"];
}

message ViolationData {
    string Name = 1 [(gogoproto.jsontag) = "violation_data_name" ];
    string Context = 2 [(gogoproto.jsontag) = "violation_data_context" ];
    ContextData ContextData = 3 [(gogoproto.jsontag) = "violation_data_context_data" ];
    repeated SignatureData Signatures = 4 [(gogoproto.jsontag) = "violation_data_signatures" ];
}
