{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://sdm2.local/schemas/sdm-event-behavior.schema.json",
  "title": "SDM2.0 Behavior Event (event_kind=behavior)",
  "description": "M1 机器契约：对齐 docs/SDM事件模型逻辑契约字段目录.md 的正式行为事件 Schema。暂缓内容（state、correlation、diagnostics、mapping_revision、projection_version、contract）不得出现。typed object 内部属性由对象注册表（M2）治理，本 Schema 只约束角色结构与身份字段。",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "meta",
    "event_kind",
    "behavior",
    "carriers"
  ],
  "properties": {
    "meta": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "schema_version",
        "tenant_id",
        "event_id",
        "occur_time",
        "mapping_id"
      ],
      "properties": {
        "schema_version": {
          "type": "string",
          "description": "逻辑契约版本"
        },
        "tenant_id": {
          "type": "string",
          "description": "租户标识"
        },
        "event_id": {
          "type": "string",
          "description": "行为事件唯一标识"
        },
        "occur_time": {
          "type": "string",
          "format": "date-time",
          "description": "行为事实发生时间"
        },
        "ingest_time": {
          "type": [
            "string",
            "null"
          ],
          "format": "date-time",
          "description": "平台接收时间"
        },
        "parse_time": {
          "type": [
            "string",
            "null"
          ],
          "format": "date-time",
          "description": "解析完成时间"
        },
        "mapping_id": {
          "type": "string",
          "description": "不可变映射身份；语义变化必须创建新值"
        },
        "data_source": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": false,
          "properties": {
            "vendor": {
              "type": [
                "string",
                "null"
              ],
              "description": "来源厂商"
            },
            "product": {
              "type": [
                "string",
                "null"
              ],
              "description": "来源产品"
            },
            "category": {
              "type": [
                "string",
                "null"
              ],
              "description": "来源分类"
            },
            "instance_id": {
              "type": [
                "string",
                "null"
              ],
              "description": "接入实例标识；仅采集器/连接器/Kafka source/接入节点，不表示观察者"
            }
          }
        },
        "source_record": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": false,
          "properties": {
            "log_id": {
              "type": [
                "string",
                "null"
              ],
              "description": "来源日志编号"
            },
            "record_kind": {
              "type": [
                "string",
                "null"
              ],
              "description": "来源记录分类或兼容路由值；不改变 event_kind=behavior"
            },
            "log_type": {
              "type": [
                "string",
                "null"
              ],
              "description": "来源日志类型"
            },
            "log_level": {
              "type": [
                "string",
                "null"
              ],
              "description": "原始日志等级；不等同于观察断言严重度"
            },
            "log_name": {
              "type": [
                "string",
                "null"
              ],
              "description": "来源日志名称"
            },
            "raw_ref": {
              "type": [
                "string",
                "null"
              ],
              "description": "原始日志回查引用"
            }
          }
        }
      }
    },
    "event_kind": {
      "const": "behavior",
      "description": "当前唯一实现值；观察依附于行为，state 后续单独定义"
    },
    "behavior": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "layer",
        "type"
      ],
      "properties": {
        "layer": {
          "enum": [
            "network",
            "system",
            "application"
          ],
          "description": "行为观测层次"
        },
        "type": {
          "enum": [
            "appear",
            "read",
            "change",
            "disappear",
            "flow"
          ],
          "description": "五类闭集行为类型：表达「发生了什么性质的行为」，新动作归入闭集、不扩模型"
        },
        "operation": {
          "type": [
            "string",
            "null"
          ],
          "description": "具体动作，如 login、query、write、connect；开放动作名"
        },
        "outcome": {
          "enum": [
            "allowed",
            "denied",
            "success",
            "failed",
            "observed",
            "unknown",
            null
          ],
          "description": "allowed/denied=处置结果；success/failed=执行结果；observed=事实记录；unknown=来源无结果"
        },
        "message": {
          "type": [
            "string",
            "null"
          ],
          "description": "行为事实描述消息"
        }
      }
    },
    "subject": {
      "$ref": "#/$defs/entity_ref"
    },
    "object": {
      "$ref": "#/$defs/entity_ref"
    },
    "carriers": {
      "type": "array",
      "description": "承载或执行行为的实体，可为空数组",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "ref_id",
          "entity_type",
          "carrier_role"
        ],
        "properties": {
          "ref_id": {
            "type": "string",
            "description": "载体引用"
          },
          "entity_type": {
            "$ref": "#/$defs/entity_type"
          },
          "carrier_role": {
            "type": "string",
            "description": "载体关系，如 parent_process、script_engine"
          },
          "host": {
            "type": [
              "object",
              "null"
            ],
            "additionalProperties": true,
            "description": "entity_type=host 时的属性对象；内部字段由对象注册表治理（M2）"
          },
          "process": {
            "type": [
              "object",
              "null"
            ],
            "additionalProperties": true,
            "description": "entity_type=process 时的属性对象；内部字段由对象注册表治理（M2）"
          },
          "file": {
            "type": [
              "object",
              "null"
            ],
            "additionalProperties": true,
            "description": "entity_type=file 时的属性对象；内部字段由对象注册表治理（M2）"
          },
          "script": {
            "type": [
              "object",
              "null"
            ],
            "additionalProperties": true,
            "description": "entity_type=script 时的属性对象；内部字段由对象注册表治理（M2）"
          },
          "application": {
            "type": [
              "object",
              "null"
            ],
            "additionalProperties": true,
            "description": "entity_type=application 时的属性对象；内部字段由对象注册表治理（M2）"
          },
          "service": {
            "type": [
              "object",
              "null"
            ],
            "additionalProperties": true,
            "description": "entity_type=service 时的属性对象；内部字段由对象注册表治理（M2）"
          },
          "resource": {
            "type": [
              "object",
              "null"
            ],
            "additionalProperties": true,
            "description": "entity_type=resource 时的属性对象；内部字段由对象注册表治理（M2）"
          },
          "container": {
            "type": [
              "object",
              "null"
            ],
            "additionalProperties": true,
            "description": "entity_type=container 时的属性对象；内部字段由对象注册表治理（M2）"
          }
        },
        "allOf": [
          {
            "if": {
              "properties": {
                "entity_type": {
                  "const": "host"
                }
              },
              "required": [
                "entity_type"
              ]
            },
            "then": {
              "required": [
                "host"
              ]
            }
          },
          {
            "if": {
              "properties": {
                "entity_type": {
                  "const": "process"
                }
              },
              "required": [
                "entity_type"
              ]
            },
            "then": {
              "required": [
                "process"
              ]
            }
          },
          {
            "if": {
              "properties": {
                "entity_type": {
                  "const": "file"
                }
              },
              "required": [
                "entity_type"
              ]
            },
            "then": {
              "required": [
                "file"
              ]
            }
          },
          {
            "if": {
              "properties": {
                "entity_type": {
                  "const": "script"
                }
              },
              "required": [
                "entity_type"
              ]
            },
            "then": {
              "required": [
                "script"
              ]
            }
          },
          {
            "if": {
              "properties": {
                "entity_type": {
                  "const": "application"
                }
              },
              "required": [
                "entity_type"
              ]
            },
            "then": {
              "required": [
                "application"
              ]
            }
          },
          {
            "if": {
              "properties": {
                "entity_type": {
                  "const": "service"
                }
              },
              "required": [
                "entity_type"
              ]
            },
            "then": {
              "required": [
                "service"
              ]
            }
          },
          {
            "if": {
              "properties": {
                "entity_type": {
                  "const": "resource"
                }
              },
              "required": [
                "entity_type"
              ]
            },
            "then": {
              "required": [
                "resource"
              ]
            }
          },
          {
            "if": {
              "properties": {
                "entity_type": {
                  "const": "container"
                }
              },
              "required": [
                "entity_type"
              ]
            },
            "then": {
              "required": [
                "container"
              ]
            }
          }
        ]
      }
    },
    "facets": {
      "type": "object",
      "description": "领域行为上下文；禁止通用 related。候选域见字段目录 2.8",
      "additionalProperties": false,
      "properties": {
        "network": {
          "$ref": "#/$defs/facet_object"
        },
        "process": {
          "$ref": "#/$defs/facet_object"
        },
        "file": {
          "$ref": "#/$defs/facet_object"
        },
        "authorization": {
          "$ref": "#/$defs/facet_object"
        },
        "peripheral": {
          "$ref": "#/$defs/facet_object"
        },
        "authentication": {
          "$ref": "#/$defs/facet_object"
        },
        "dns": {
          "$ref": "#/$defs/facet_object"
        },
        "http": {
          "$ref": "#/$defs/facet_object"
        },
        "database": {
          "$ref": "#/$defs/facet_object"
        },
        "email": {
          "$ref": "#/$defs/facet_object"
        },
        "application": {
          "$ref": "#/$defs/facet_object"
        },
        "container": {
          "$ref": "#/$defs/facet_object"
        },
        "tls": {
          "$ref": "#/$defs/facet_object"
        },
        "registry": {
          "$ref": "#/$defs/facet_object"
        },
        "cloud": {
          "$ref": "#/$defs/facet_object"
        }
      }
    },
    "observation": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "observation_id",
        "observer",
        "action",
        "evidence_refs"
      ],
      "properties": {
        "observation_id": {
          "type": "string",
          "description": "观察记录 ID"
        },
        "observer": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "ref_id",
            "entity_type"
          ],
          "properties": {
            "ref_id": {
              "type": [
                "string",
                "null"
              ],
              "description": "观察者引用；身份未知时为 null"
            },
            "entity_type": {
              "anyOf": [
                {
                  "$ref": "#/$defs/entity_type"
                },
                {
                  "type": "null"
                }
              ],
              "description": "观察者实体类型；身份未知时为 null"
            },
            "host": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": true,
              "description": "entity_type=host 时的属性对象；内部字段由对象注册表治理（M2）"
            },
            "endpoint": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": true,
              "description": "entity_type=endpoint 时的属性对象；内部字段由对象注册表治理（M2）"
            },
            "process": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": true,
              "description": "entity_type=process 时的属性对象；内部字段由对象注册表治理（M2）"
            },
            "user": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": true,
              "description": "entity_type=user 时的属性对象；内部字段由对象注册表治理（M2）"
            },
            "account": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": true,
              "description": "entity_type=account 时的属性对象；内部字段由对象注册表治理（M2）"
            },
            "device": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": true,
              "description": "entity_type=device 时的属性对象；内部字段由对象注册表治理（M2）"
            },
            "application": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": true,
              "description": "entity_type=application 时的属性对象；内部字段由对象注册表治理（M2）"
            },
            "service": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": true,
              "description": "entity_type=service 时的属性对象；内部字段由对象注册表治理（M2）"
            },
            "resource": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": true,
              "description": "entity_type=resource 时的属性对象；内部字段由对象注册表治理（M2）"
            }
          },
          "allOf": [
            {
              "if": {
                "properties": {
                  "entity_type": {
                    "const": "host"
                  }
                },
                "required": [
                  "entity_type"
                ]
              },
              "then": {
                "required": [
                  "host"
                ]
              }
            },
            {
              "if": {
                "properties": {
                  "entity_type": {
                    "const": "endpoint"
                  }
                },
                "required": [
                  "entity_type"
                ]
              },
              "then": {
                "required": [
                  "endpoint"
                ]
              }
            },
            {
              "if": {
                "properties": {
                  "entity_type": {
                    "const": "process"
                  }
                },
                "required": [
                  "entity_type"
                ]
              },
              "then": {
                "required": [
                  "process"
                ]
              }
            },
            {
              "if": {
                "properties": {
                  "entity_type": {
                    "const": "user"
                  }
                },
                "required": [
                  "entity_type"
                ]
              },
              "then": {
                "required": [
                  "user"
                ]
              }
            },
            {
              "if": {
                "properties": {
                  "entity_type": {
                    "const": "account"
                  }
                },
                "required": [
                  "entity_type"
                ]
              },
              "then": {
                "required": [
                  "account"
                ]
              }
            },
            {
              "if": {
                "properties": {
                  "entity_type": {
                    "const": "device"
                  }
                },
                "required": [
                  "entity_type"
                ]
              },
              "then": {
                "required": [
                  "device"
                ]
              }
            },
            {
              "if": {
                "properties": {
                  "entity_type": {
                    "const": "application"
                  }
                },
                "required": [
                  "entity_type"
                ]
              },
              "then": {
                "required": [
                  "application"
                ]
              }
            },
            {
              "if": {
                "properties": {
                  "entity_type": {
                    "const": "service"
                  }
                },
                "required": [
                  "entity_type"
                ]
              },
              "then": {
                "required": [
                  "service"
                ]
              }
            },
            {
              "if": {
                "properties": {
                  "entity_type": {
                    "const": "resource"
                  }
                },
                "required": [
                  "entity_type"
                ]
              },
              "then": {
                "required": [
                  "resource"
                ]
              }
            }
          ],
          "description": "观察者实体；地址统一放对应对象的 ip（如 device.ip、host.ip），禁止 device_ip/observer_ip 同义字段"
        },
        "action": {
          "enum": [
            "record",
            "detect",
            "assess"
          ],
          "description": "观察动作"
        },
        "observed_at": {
          "type": [
            "string",
            "null"
          ],
          "format": "date-time",
          "description": "观察时间"
        },
        "assertion": {
          "type": [
            "object",
            "null"
          ],
          "description": "观察者判断；action 为 detect/assess 时必须有；不覆盖事实层",
          "additionalProperties": true
        },
        "evidence_refs": {
          "type": "array",
          "description": "指向事实事件、原始日志或证据对象的引用",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "extensions": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "source_private": {
          "type": "object",
          "additionalProperties": true,
          "description": "来源私有字段；不含诊断信息"
        },
        "profiles": {
          "type": "object",
          "additionalProperties": true,
          "description": "画像或平台上下文"
        },
        "enrichments": {
          "type": "object",
          "additionalProperties": true,
          "description": "富化结果"
        }
      }
    }
  },
  "$defs": {
    "entity_type": {
      "enum": [
        "user",
        "account",
        "host",
        "endpoint",
        "process",
        "file",
        "service",
        "domain",
        "url",
        "device",
        "resource",
        "application",
        "cloud",
        "container",
        "certificate",
        "script"
      ],
      "description": "16 值权威枚举；geo 不是独立类型"
    },
    "facet_object": {
      "type": "object",
      "description": "领域 facet；内部字段由字段目录典型路径与注册表治理",
      "additionalProperties": true
    },
    "entity_ref": {
      "type": [
        "object",
        "null"
      ],
      "description": "主体或客体；身份未采集/不适用时为 null，不得用空对象 {} 表示未知；对象形态下 ref_id 与 entity_type 必填",
      "additionalProperties": false,
      "properties": {
        "ref_id": {
          "type": "string",
          "description": "事件内实体引用；实体非 null 时设置"
        },
        "entity_type": {
          "$ref": "#/$defs/entity_type"
        },
        "user": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=user 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "account": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=account 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "host": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=host 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "endpoint": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=endpoint 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "process": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=process 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "file": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=file 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "service": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=service 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "domain": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=domain 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "url": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=url 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "device": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=device 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "resource": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=resource 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "application": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=application 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "cloud": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=cloud 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "container": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=container 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "certificate": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=certificate 时的属性对象；内部字段由对象注册表治理（M2）"
        },
        "script": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "entity_type=script 时的属性对象；内部字段由对象注册表治理（M2）"
        }
      },
      "allOf": [
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "user"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "user"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "account"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "account"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "host"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "host"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "endpoint"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "endpoint"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "process"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "process"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "file"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "file"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "service"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "service"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "domain"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "domain"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "url"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "url"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "device"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "device"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "resource"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "resource"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "application"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "application"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "cloud"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "cloud"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "container"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "container"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "certificate"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "certificate"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "entity_type": {
                "const": "script"
              }
            },
            "required": [
              "entity_type"
            ]
          },
          "then": {
            "required": [
              "script"
            ]
          }
        }
      ],
      "required": [
        "ref_id",
        "entity_type"
      ]
    }
  }
}