Event Schema

Event Schema

Every log line Prohori understands becomes the same typed record, an Event. Detections produce Alerts, and related alerts are grouped into Incidents.

The full field reference is in docs/SCHEMA.md. This page is the short version for rule authors.

Event fields at a glance

Field	Example
timestamp	2026-10-24T13:50:12.345000Z (always UTC)
log_source	sshd, nginx, app-security
event.action	auth.signin.failure, ssh.login.failure
event.category	authentication, web, session, account, authorization, abuse, admin, network
event.outcome	success, failure, unknown
event.severity	low, medium, high (if the source provides it)
event.reason	bad_password, unknown_user, locked
source.ip	203.0.113.7 or 2001:db8::1
user.name, user.id, user.email_hash	untrusted, may be empty
http.method, http.path, http.status, http.bytes	POST, /api/auth/signin, 401, 512
user_agent, client, host, request_id
raw	the original line (up to 8,192 characters)
extra.<key>	source-specific values, for example extra.source_port

Rules refer to fields by these dotted names.

Rules of the schema

• UTC only. A timestamp without a timezone is rejected; parsers decide the timezone.
• Log text is untrusted. Long values are truncated, never executed or interpreted.
• Immutable. Events cannot change after parsing.
• Deterministic ids. Parsing the same file twice gives the same event ids.

Severity scale

low < medium < high < critical. Logs use the first three; critical is reserved for Prohori's own alerts and incidents.