Skip to main content

Events and telemetry

Dhal emits events around inspection decisions, rule matches, signals, and operational posture.

Event content​

Events can include:

  • action;
  • rule ID;
  • route;
  • severity;
  • risk score;
  • correlation ID;
  • matched signals;
  • rate-limit metadata;
  • redacted IP and identity values.

Redaction​

Redaction is controlled by observability.redaction.

{
  "observability": {
    "redaction": {
      "enabled": true,
      "ip": "mask",
      "identity": "hash",
      "userAgent": "full"
    }
  }
}

Webhooks​

Webhook payloads should be signed in production.

OpenTelemetry​

OpenTelemetry telemetry should use Dhal-specific attributes such as dhal.action, dhal.rule_id, and dhal.severity.