security-alert-center/docs/event-schema-v1.json

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://git.kalinamall.ru/PapaTramp/security-alert-center/schemas/event-v1.json",
  "title": "Security Alert Center Event v1",
  "description": "Каноническое событие от ssh-monitor или RDP-login-monitor",
  "type": "object",
  "required": [
    "schema_version",
    "event_id",
    "occurred_at",
    "source",
    "host",
    "category",
    "type",
    "severity",
    "title",
    "summary"
  ],
  "additionalProperties": false,
  "properties": {
    "schema_version": {
      "type": "string",
      "const": "1.0"
    },
    "event_id": {
      "type": "string",
      "format": "uuid",
      "description": "UUID v4, уникален глобально, для идемпотентности"
    },
    "occurred_at": {
      "type": "string",
      "format": "date-time",
      "description": "ISO 8601 с offset, время события на хосте"
    },
    "source": {
      "type": "object",
      "required": ["product", "product_version"],
      "additionalProperties": false,
      "properties": {
        "product": {
          "type": "string",
          "enum": ["ssh-monitor", "rdp-login-monitor"]
        },
        "product_version": {
          "type": "string"
        },
        "agent_instance_id": {
          "type": "string",
          "description": "Стабильный ID установки агента"
        }
      }
    },
    "host": {
      "type": "object",
      "required": ["hostname", "os_family"],
      "additionalProperties": false,
      "properties": {
        "hostname": { "type": "string" },
        "display_name": { "type": "string" },
        "fqdn": { "type": "string" },
        "os_family": {
          "type": "string",
          "enum": ["linux", "windows"]
        },
        "os_version": { "type": "string" },
        "ipv4": { "type": "string" },
        "ipv6": { "type": "string" },
        "timezone": {
          "type": "string",
          "description": "IANA, например Europe/Moscow"
        }
      }
    },
    "category": {
      "type": "string",
      "enum": [
        "auth",
        "privilege",
        "network",
        "session",
        "report",
        "agent"
      ]
    },
    "type": {
      "type": "string",
      "description": "Машиночитаемый тип, см. docs/agent-integration.md",
      "examples": [
        "ssh.login.success",
        "ssh.login.failed",
        "privilege.sudo.command",
        "ssh.ip.banned",
        "ssh.bruteforce.mass",
        "session.logind.new",
        "rdp.login.success",
        "rdp.login.failed",
        "rdp.session.logoff",
        "rdp.shadow.control.started",
        "rdp.shadow.control.stopped",
        "rdp.shadow.control.permission",
        "winrm.session.started",
        "smb.admin_share.access",
        "rdg.connection.success",
        "report.daily.ssh",
        "agent.heartbeat",
        "agent.inventory",
        "agent.test"
      ]
    },
    "severity": {
      "type": "string",
      "enum": ["info", "warning", "high", "critical"]
    },
    "title": {
      "type": "string",
      "maxLength": 256
    },
    "summary": {
      "type": "string",
      "description": "Человекочитаемый текст (как в Telegram сейчас)",
      "maxLength": 8192
    },
    "details": {
      "type": "object",
      "description": "Структурированные поля по типу события",
      "additionalProperties": true
    },
    "raw": {
      "type": "object",
      "properties": {
        "format": {
          "type": "string",
          "enum": ["journal", "windows_event_xml", "text"]
        },
        "payload": {
          "type": "string",
          "maxLength": 16384
        }
      },
      "additionalProperties": false
    },
    "tags": {
      "type": "array",
      "items": { "type": "string", "maxLength": 64 },
      "maxItems": 32
    },
    "dedup_key": {
      "type": "string",
      "maxLength": 512
    },
    "correlation_id": {
      "type": "string",
      "format": "uuid"
    },
    "fingerprint": {
      "type": "string",
      "maxLength": 128
    },
    "enrichment": {
      "type": "object",
      "additionalProperties": true,
      "properties": {
        "attempt_number": { "type": "integer", "minimum": 0 },
        "threshold": { "type": "integer", "minimum": 0 },
        "risk_level": {
          "type": "string",
          "enum": ["low", "medium", "high", "critical"]
        },
        "filtered_out": { "type": "boolean" },
        "filter_reason": { "type": "string" }
      }
    }
  }
}