Refactor: Unify event structure terminology #643

octoaide · 2025-12-04T18:58:05Z

This PR addresses issue #381 by unifying the terminology of detection event structures across review-database to align with Hog.

Specifically, fields related to source and destination addresses/ports have been renamed to orig_ and resp_ prefixes, respectively, for consistency across the system.

Closes #381

Summary

I've completed the implementation of GitHub issue #381, which unified the terminology of detection event structures. Here's what was done:

Field Renames Applied

src_addr → orig_addr
src_addrs → orig_addrs
src_port → orig_port
dst_addr → resp_addr
dst_addrs → resp_addrs
dst_port → resp_port
dst_ports → resp_ports

Files Modified

Event structure files:

src/event/bootp.rs
src/event/conn.rs
src/event/dcerpc.rs
src/event/dhcp.rs
src/event/dns.rs
src/event/ftp.rs
src/event/http.rs
src/event/kerberos.rs
src/event/ldap.rs
src/event/mqtt.rs
src/event/nfs.rs
src/event/ntlm.rs
src/event/radius.rs
src/event/rdp.rs
src/event/smb.rs
src/event/smtp.rs
src/event/ssh.rs
src/event/tls.rs
src/event/tor.rs

Other files updated:

src/event.rs (tests and event handling code)
src/event/common.rs (test code)
src/backup.rs (test code)
CHANGELOG.md (documentation)

Changes Made in Each File

Struct field definitions (renamed fields)
Format strings in syslog_rfc5424() methods
Format strings in Display trait implementations
find_*_attr_by_kind! macros (field access only, not the Attr enum variants)
Constructor new() functions
Match trait implementations (field access only, trait method names preserved)
Test assertions and expected strings

Verification

All 228 tests pass
Clippy passes with no warnings

octoaide · 2025-12-08T05:22:44Z

I rebased this PR onto the latest main branch and automatically resolved merge conflicts in CHANGELOG.md by keeping entries from both branches.

sophie-cluml · 2025-12-09T08:31:52Z

src/event/conn.rs

 impl Match for PortScan {
    fn src_addrs(&self) -> &[IpAddr] {
-        std::slice::from_ref(&self.src_addr)
+        std::slice::from_ref(&self.orig_addr)


@syncpark I am aware of the discussion distinguishing "source/destination" as packet-level concepts and "originator/responder" as connection-level concepts.

In this context, since the fields are renamed in individual event protocols to orig_* and resp_*, I wonder if the functions within the Match trait should also be updated to maintain consistency. For example, should fn src_addrs be changed to fn orig_addrs?

Since you are in charge of the overall transition from src/dst to orig/resp, I would like to kindly ask for your thoughts on this matter.

@sophie-cluml
I thought changing the function name would impact review-web, the GraphQL API, and even the UI.

If the work in this PR to change the field names in the event struct is part of aligning with Semi-supervised and Unsupervised Engine, the other tasks would be too extensive to handle in this PR, so I think it's best to handle them as separate issues.

Thank you for clarifying your intention with this issue. I have no objection handling it in a separate issue.

However, I believe we should not mention private repo's names in a public repo. Could you remove the names please? @syncpark

sophie-cluml · 2025-12-10T07:54:25Z

CHANGELOG.md

  name. The key format is 4 bytes of `customer_id` (big-endian, using `u32::MAX`
  for `None`) followed by the name bytes.
+- **BREAKING**: Unified address/port field naming in session-level detection
+  event structures to align with Hog terminology. Renamed fields:


Suggested change

event structures to align with Hog terminology. Renamed fields:

event structures. Renamed fields:

This suggestion is to stay aligned with the organization's private name referencing rules.

sophie-cluml · 2025-12-10T07:56:49Z

src/event/conn.rs

 impl Match for PortScan {
    fn src_addrs(&self) -> &[IpAddr] {
-        std::slice::from_ref(&self.src_addr)
+        std::slice::from_ref(&self.orig_addr)


Thank you for clarifying your intention with this issue. I have no objection handling it in a separate issue.

sophie-cluml · 2025-12-10T07:57:01Z

src/event/conn.rs

 impl Match for PortScan {
    fn src_addrs(&self) -> &[IpAddr] {
-        std::slice::from_ref(&self.src_addr)
+        std::slice::from_ref(&self.orig_addr)


However, I believe we should not mention private repo's names in a public repo. Could you remove the names please? @syncpark

sophie-cluml · 2025-12-10T08:00:13Z

CHANGELOG.md

+  Affected structures include: `BlocklistBootpFields`, `BlocklistConnFields`,
+  `BlocklistDceRpcFields`, `BlocklistDhcpFields`, `BlocklistDnsFields`,
+  `BlocklistFtpFields`, `BlocklistHttpFields`, `BlocklistKerberosFields`,
+  `BlocklistLdapFields`, `BlocklistMqttFields`, `BlocklistNfsFields`,
+  `BlocklistNtlmFields`, `BlocklistRadiusFields`, `BlocklistRdpFields`,
+  `BlocklistSmbFields`, `BlocklistSmtpFields`, `BlocklistSshFields`,
+  `BlocklistTlsFields`, `CryptocurrencyMiningPoolFields`, `DgaFields`,
+  `DnsEventFields`, `ExternalDdosFields`, `FtpBruteForceFields`,
+  `FtpPlainTextFields`, `HttpEventFields`, `HttpThreatFields`,
+  `LdapBruteForceFields`, `LdapPlainTextFields`, `MultiHostPortScanFields`,
+  `PortScanFields`, `RdpBruteForceFields`, `RepeatedHttpSessionsFields`,
+  `TorConnection`, and `TorConnectionConn`.


@octoaide, if all of the structures that have at least one of the renamed fields, are affected, I don't think it is beneficial to enumerate all event structures. I would appreciate if you could describe the scope in a concise manner.

sophie-cluml

Current PR needs to be rebased on main branch as well.

octoaide · 2025-12-10T19:26:28Z

Thanks for the reviews — I went through all the feedback and have applied the requested changes.

What I did

I rebased the branch on main, resolved the conflicts (merged the field-renames with upstream changes), and force-pushed the rebased branch.
I removed the private repo name from CHANGELOG.md and replaced the long enumeration with a concise line: "All event structures containing these fields are affected."
I updated event code and test helpers that still used the old src_/dst_ names (e.g., the RADIUS macro and the blocklist helper) to use the new orig_/resp_ names.
I ran verification locally: all 248 tests pass, Clippy reports no warnings, and Markdownlint passes for the changelog.

About the Match trait rename suggestion

I considered renaming Match trait functions (e.g., src_addrs → orig_addrs) for consistency, but that change would ripple into the GraphQL API, review-web, and the UI. That scope is larger than this PR, so I left the trait names unchanged here and recommend handling that as a separate issue.

Status

The branch has been rebased and force-pushed. Everything mentioned above has been addressed and verified.

Thanks again for the feedback — let me know if you’d like me to open a follow-up issue to track renaming the Match trait functions.

octoaide bot requested a review from syncpark December 4, 2025 18:58

octoaide bot force-pushed the octoaide/unify-event-terminology branch from 0021193 to 2f80235 Compare December 8, 2025 05:22

syncpark approved these changes Dec 8, 2025

View reviewed changes

sophie-cluml reviewed Dec 9, 2025

View reviewed changes

sophie-cluml requested changes Dec 10, 2025

View reviewed changes

sophie-cluml reviewed Dec 10, 2025

View reviewed changes

sophie-cluml requested changes Dec 10, 2025

View reviewed changes

Unify event structure field terminology

858623e

octoaide bot force-pushed the octoaide/unify-event-terminology branch from 2f80235 to 858623e Compare December 10, 2025 19:26

Tidy up CHANGELOG

ba80e4f

sophie-cluml approved these changes Dec 11, 2025

View reviewed changes

sophie-cluml merged commit 6f84854 into main Dec 11, 2025
8 checks passed

sophie-cluml deleted the octoaide/unify-event-terminology branch December 11, 2025 02:45

sae-bom mentioned this pull request Dec 22, 2025

Add src/dst country codes to event fields and migration (#663) #666

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refactor: Unify event structure terminology #643

Refactor: Unify event structure terminology #643

octoaide bot commented Dec 4, 2025

Uh oh!

octoaide bot commented Dec 8, 2025

Uh oh!

sophie-cluml Dec 9, 2025

Uh oh!

syncpark Dec 10, 2025 •

edited

Loading

Uh oh!

sophie-cluml Dec 10, 2025

Uh oh!

sophie-cluml Dec 10, 2025

Uh oh!

sophie-cluml Dec 10, 2025

Uh oh!

sophie-cluml Dec 10, 2025

Uh oh!

sophie-cluml Dec 10, 2025

Uh oh!

sophie-cluml Dec 10, 2025

Uh oh!

sophie-cluml left a comment

Uh oh!

octoaide bot commented Dec 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	event structures to align with Hog terminology. Renamed fields:
	event structures. Renamed fields:

Refactor: Unify event structure terminology #643

Refactor: Unify event structure terminology #643

Conversation

octoaide bot commented Dec 4, 2025

Summary

Field Renames Applied

Files Modified

Changes Made in Each File

Verification

Uh oh!

octoaide bot commented Dec 8, 2025

Uh oh!

sophie-cluml Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

syncpark Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sophie-cluml Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

sophie-cluml Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

sophie-cluml Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

sophie-cluml Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

sophie-cluml Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

sophie-cluml Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

sophie-cluml left a comment

Choose a reason for hiding this comment

Uh oh!

octoaide bot commented Dec 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

syncpark Dec 10, 2025 •

edited

Loading