Events and telemetry

Security event concepts and redaction posture.

Events and telemetry

Dhal emits events around inspection decisions, rule matches, signals, and operational posture.

Event content

Events can include:

• action;
• rule ID;
• route;
• severity;
• risk score;
• correlation ID;
• matched signals;
• rate-limit metadata;
• redacted IP and identity values.

Redaction

Redaction is controlled by observability.redaction.

{
  "observability": {
    "redaction": {
      "enabled": true,
      "ip": "mask",
      "identity": "hash",
      "userAgent": "full"
    }
  }
}

Webhooks

Webhook payloads should be signed in production.

OpenTelemetry

OpenTelemetry telemetry should use Dhal-specific attributes such as dhal.action, dhal.rule_id, and dhal.severity.