Skip to content

Core concepts

Core concepts

The library is small: one value object you produce, one contract the formatters implement, and a pure sink contract the delivery layer implements elsewhere.

  • SIEM events — the normalized SiemEvent value object, its enums, and the flattening contract for context.
  • Formatters — how each of the five formatters maps a SiemEvent onto its SIEM's real schema, field by field.