events

type EnrichedEvent struct {
	Event       utils.K8sEvent
	Timestamp   time.Time
	ContainerID string
	ProcessTree armotypes.Process
	PID         uint32
	PPID        uint32
	// SourceContext holds the context information for this event (K8s, Host, or Standalone).
	// This is populated during event enrichment if the feature is enabled.
	// May be nil for legacy K8s-only events or when feature is disabled.
	SourceContext contextdetection.ContextInfo
	// MountNamespaceID is the mount namespace ID from the container.
	// This uniquely identifies the container/host and is used for context lookup.
	// May be 0 if unavailable.
	MountNamespaceID uint64
	// Duplicate is set by the dedup check in EventHandlerFactory.ProcessEvent().
	// Consumers that respect this flag skip processing for deduplicated events.
	Duplicate bool
	// DedupBucket is the current time expressed in 64ms buckets, cached per batch tick.
	DedupBucket uint16
}

type ProcfsEvent struct {
	Type        types.EventType `json:"type"`
	Timestamp   types.Time      `json:"timestamp"`
	PID         uint32          `json:"pid"`
	PPID        uint32          `json:"ppid"`
	Comm        string          `json:"comm"`
	Pcomm       string          `json:"pcomm"`
	Cmdline     string          `json:"cmdline"`
	Uid         *uint32         `json:"uid"`
	Gid         *uint32         `json:"gid"`
	Cwd         string          `json:"cwd"`
	Path        string          `json:"path"`
	StartTimeNs uint64          `json:"start_time_ns"`
	// StartTimeWall is the display-only wall-clock creation time derived by the
	// procfs feeder from btime + StartTimeNs. Never compare it for process
	// identity — StartTimeNs (boot-relative) is the sole identity source.
	StartTimeWall  time.Time `json:"start_time_wall"`
	ContainerID    string    `json:"container_id"`
	ContainerMntNs uint64    `json:"container_mnt_ns"`
	ContainerNetNs uint64    `json:"container_net_ns"`
	HostPID        int       `json:"host_pid"`
	HostPPID       int       `json:"host_ppid"`
}