docs / reference/event-types

Event types

Every event_type the ekmire control plane emits, what fires it, and what fields the event carries.

⏱ 6 min read

Schema

Every event conforms to the MireEvent schema. See API reference for the full TypeScript interface.

{
  "id": "evt_a3f9b2c1",
  "event_type": "semantic.threat_detected",
  "severity": "critical",
  "source": "proxy",
  "rule_id": null,
  "score": 0.94,
  "payload_hash": "a3f9b2c1d4e5f6a7...",
  "upstream": "POST /api/chat",
  "attacker_cost": 0.0003,
  "ts": "2026-05-27T14:22:01Z"
}

All event types

EVENT TYPE	SOURCE	DESCRIPTION
build.scan_passed	cli	Commit scanned, no findings.
build.scan_blocked	cli	Commit blocked — one or more critical/high findings.
build.suppressed	cli	Finding suppressed via `# ekmire-ignore`.
network.request_blocked	proxy	Request blocked by deterministic rule.
network.tarpit_engaged	proxy	IP classified as automated; tarpitting at 1 byte/s.
network.scraper_trap_hit	proxy	Honeypot URL accessed; IP tarpitted.
semantic.threat_detected	proxy	Semantic score ≥ block threshold. Request blocked.
semantic.logged	proxy	Score ≥ log threshold but < block. Logged only.
audit.finding	cli / mcp	Dev Audit finding returned.
audit.false_positive	dashboard	User marked an event as a false positive.

Common fields

id — opaque event identifier. Idempotency key for webhook replay.
severity — critical · high · medium · low · info.
source — proxy · cli · mcp · device_scanner · dev_audit.
rule_id — present for deterministic events. null for semantic events.
score — present for semantic events. Float 0–1.
payload_hash — SHA-256 of the raw payload. The raw payload itself is never stored.
ts — UTC timestamp, ISO 8601.

Rule IDs