baseline

type DeviationQuery struct {
	Drilldowns []string `json:"drilldowns"`
}

type DeviationRecord struct {
	ID                string  `json:"id"`
	RunID             string  `json:"run_id"`
	TemplateName      string  `json:"template_name"`
	ProfileID         string  `json:"profile_id"`
	DeviationType     string  `json:"deviation_type"`
	Status            string  `json:"status"`
	ExpectedValue     float64 `json:"expected_value"`
	ObservedValue     float64 `json:"observed_value"`
	RecommendedAction string  `json:"recommended_action"`
	Payload           string  `json:"payload"`
	CreatedAt         string  `json:"created_at"`
}

type DeviationView struct {
	Deviation DeviationRecord `json:"deviation"`
	Query     DeviationQuery  `json:"query"`
}

type DeviationsReport struct {
	SchemaVersion string          `json:"schema_version"`
	RunID         string          `json:"run_id,omitempty"`
	ResultSetID   string          `json:"result_set_id"`
	PageHash      string          `json:"page_hash"`
	Count         int             `json:"count"`
	Deviations    []DeviationView `json:"deviations"`
}

type FeatureVector struct {
	ExecCount              int64   `json:"exec_count"`
	ProcessObservedCount   int64   `json:"process_observed_count"`
	OutlivedRootCount      int64   `json:"outlived_root_count"`
	FileOpenCount          int64   `json:"file_open_count"`
	FileWriteCount         int64   `json:"file_write_count"`
	SecretPathCount        int64   `json:"secret_path_count"`
	NetworkEventCount      int64   `json:"network_event_count"`
	MetadataIPCount        int64   `json:"metadata_ip_count"`
	PrivateCIDRCount       int64   `json:"private_cidr_count"`
	PolicyBlockCount       int64   `json:"policy_block_count"`
	ActiveCPUSeconds       float64 `json:"active_cpu_seconds"`
	RuntimeEventCount      int64   `json:"runtime_event_count"`
	SuspiciousRuntimeCount int64   `json:"suspicious_runtime_count"`
}

type Profile struct {
	ID                string
	TemplateName      string
	ExecCount         int64
	NetworkEventCount int64
	PolicyBlockCount  int64
	ActiveCPUSeconds  float64
	Features          FeatureVector
	Payload           string
	Status            string
	CreatedAt         string
}