diff --git a/AGENTS.md b/AGENTS.md
index c499600f..ea9581b7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -84,7 +84,7 @@ detectors:
             - pos: pid          # named wildcard label OR integer position in ParserSchema.variables[]
               name: pid
           header_variables:
-            - pos: Type         # key in ParserSchema.logFormatVariables{}
+            - pos: Type         # key in ParserSchema.headerVariables{}
               params: {}
     global:                     # event-ID-independent instances (GLOBAL_EVENT_ID = "*")
       global_monitor:
@@ -185,7 +185,7 @@ class MyDetector(TrackerDetector):
         super().__init__(name=name, config=config)
 
     def train(self, input_: ParserSchema) -> None:
-        self._ingest(input_, variables={...}, event_id=input_["EventID"])
+        self._ingest(input_, variables={...}, event_id=input_["eventID"])
 ```
 
 Pass tracker kwargs by overriding `_event_data_kwargs()` / `_auto_conf_kwargs()`; build an extra store with `self._new_store()`. Keep `__init__` callable as `MyDetector(name=..., config=...)`: `from_binary()` rebuilds the detector that way, so any other constructor argument needs a default.
diff --git a/README.md b/README.md
index 72a284da..20ae0647 100644
--- a/README.md
+++ b/README.md
@@ -1,106 +1,24 @@
-# DetectMateLibrary
-
-Main library to run the different components in DetectMate.
-
-## Main structure
-
-The library contains the next components:
-
-* **Parsers**: parse the logs received from the reader.
-* **Detectors**: return alerts if anomalies are detected.
-* **Alert Aggregation**: aggregate the alerts produced by the detectors.
-* **Schemas**: standard data classes used in DetectMate.
-```
- +--------+     +-----------+    +-------------------+
- | Parser | --> |  Detector | -> | Alert Aggregation |
- +--------+     +-----------+    +-------------------+
-```
-## Developer setup:
-
-### Step 1: Install python dependencies
-Set up the dev environment and install pre-commit hooks:
-
-```bash
-uv sync --dev
-uv run prek install
-```
-
-### Step 2: Install Protobuf dependencies
-
-To install in Linux do:
-
-```bash
-sudo apt install -y protobuf-compiler
-protoc --version
-```
-
-This dependency is only needed if a proto file is modified. To compile the proto file do:
-```bash
-protoc --proto_path=src/detectmatelibrary/schemas/ --python_out=src/detectmatelibrary/schemas/ src/detectmatelibrary/schemas/schemas.proto
-```
 
-### Step 3: Run unit tests
-Run the tests:
-
-```bash
-uv run --dev pytest -q
-```
-
-Run the tests with coverage (add --cov-report=html to generate an HTML report):
-
-```bash
-uv run --dev pytest --cov=. --cov-report=term-missing
-```
-
-## Workspace generator (`mate create`)
-
-DetectMateLibrary includes a small CLI helper to bootstrap standalone workspaces
-for custom parsers and detectors. This is useful if you want to develop and test
-components in isolation while still using the same library and schemas.
-
-### Usage
-
-The CLI entry point is `mate` with a `create` command:
-
-```bash
-mate create --type <parser|detector> --name <workspace_name> --dir <target_dir>
-```
+# DetectMateLibrary
 
-| Option   | Description                                                                                                                                                                   |
-|----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `--type` | Component type to generate:<br>- `parser`: CoreParser-based template<br>- `detector`: CoreDetector-based template                                                             |
-| `--name` | Name of the component and package:<br>- Creates package dir: `<target_dir>/<name>/`<br>- Creates main file: `<name>.py`<br>- Derives class names: `<Name>` and `<Name>Config` |
-| `--dir`  | Directory where the workspace will be created                                                                                                                                 |
+![UML](docs/img/logo.png)
 
+DetectMate is a flexible, component-based library for parsing and log anomaly detection.
 
-### What gets generated
+## Installation
 
-For example:
+Download us from `Pip`!!
 
 ```bash
-mate create --type parser --name custom_parser --dir ./workspaces/custom_parser
-```
-
-will create:
-
-```text
-workspaces/custom_parser/          # workspace root
-├── custom_parser/                 # Python package
-│   ├── __init__.py
-│   └── custom_parser.py           # CoreParser-based template
-├── tests/
-│   └── test_custom_parser.py      # generated from template to test custom_parser
-├── data.json                      # example data to run the code
-├── LICENSE.md                     # copied from main project
-├── .gitignore                     # copied from main project
-├── .pre-commit-config.yaml        # copied from main project
-├── pyproject.toml                 # minimal project + dev extras
-└── README.md                      # setup instructions
+pip install detectmatelibrary
 ```
 
 ## Documentation
 
-- [Project Documentation](https://ait-detectmate.github.io/DetectMateLibrary/latest/)
+Main documentations:
+
+- [Library Documentation](https://ait-detectmate.github.io/DetectMateLibrary/latest/) (this repo)
+- [Service Documentation](https://github.com/ait-detectmate/DetectMateService/tree/main)
 
 ## Contribution
 
diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index deac6763..086eaf72 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -19,6 +19,7 @@ This document explains the expected API and how to implement an alert aggregator
   With the default `buffer_size` of 1, it is called for every alert with a list of one.
 - Use a typed `Config` class (subclass of `CoreAlertAggregatorConfig`) to hold runtime parameters.
 
+
 ## CoreAlertAggregator: minimal API
 
 ```python
@@ -52,16 +53,60 @@ Before calling `aggregate_alerts()`, `CoreAlertAggregator.run()` collects these
 alerts in the window:
 
 - `detectorIDs`, `detectorTypes`, `alertIDs`: one entry per alert
-- `logIDs`, `extractedTimestamps`: the entries of all alerts, combined into one list
+- `logIDs`, `logTimestamps`: the entries of all alerts, combined into one list
 
-After `aggregate_alerts()` returns `True`, `run()` also sets `outputTimestamp`. So the only
-fields left for `aggregate_alerts()` to fill are `description` and `alertsObtain`.
+After `aggregate_alerts()` returns `True`, `run()` also sets `aggregatedTimestamp`. So the only
+fields left for `aggregate_alerts()` to fill are `description` and `alertDetails`.
 
 !!! warning "The alerts' details are not carried over"
     `run()` copies only the fields listed above. Everything else in the incoming alerts is dropped
-    unless your `aggregate_alerts()` keeps it, including their `detectionTimestamp` and
+    unless your `aggregate_alerts()` keeps it, including their `detectedTimestamp` and
     `receivedTimestamp`.
 
-## Available alert aggregators
+## Alert aggregator methods
+
+The alert aggregator are numbered from simplest to most complex, and the sidebar lists them in the same order.
+
+| # | Detector | What it detects |
+|---|---|---|
+| 00 | [Basic Concat Aggregator](alert_aggregators/basic_concatenation.md) | Concat a set of alerts. |
+| 01 | [LogID Count Aggregator](alert_aggregators/logid_count.md) | Count the amount of times a logID is in alerts. |
+| 02 | [Time Delta](alert_aggregators/time_delta.md) | Group alerts by their time difference. |
+
+
+### Common parameters (all alert aggregators)
+
+There are some parameters, that **every** alert aggregator inherits from `CoreAlertAggregatorConfig`/`CoreConfigCoreAlertAggregator`/`BasicConfig`, regardless of what it does. The other parameters, that are **specific** for the respective detector, are explained right at the detectors documentation page, later on.
+
+<!-- Start common_arguments -->
+???+ note "Top level"
+
+    | Field | Type | Default | Description |
+    |---|---|---|---|
+    | `auto_config` | boolean | False | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Description |
+    |---|---|---|---|
+    | `start_id` | integer | 10 | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | Number of logs used for the configuration step. None skips it. |
+    | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End common_arguments -->
+
+### Density Clustering Aggregator
+
+The alert aggregators that are based on density clustering ([Time Delta](alert_aggregators/time_delta.md)) accept also the following arguments:
+
+<!-- Start density_clustering_arguments -->
+???+ note "params"
 
-- [Basic Concat](alert_aggregators/basic_concatenation.md)
+    | Field | Type | Default | Description |
+    |---|---|---|---|
+    | `buffer_size` | integer | 3 | The size of the buffer. |
+    | `buffer_mode` | object | BufferMode.BATCH | The mode of the buffer. |
+    | `delta` | number | 0.5 | The threshold for the clustering. |
+<!-- End density_clustering_arguments -->
diff --git a/docs/alert_aggregators/basic_concatenation.md b/docs/alert_aggregators/basic_concatenation.md
index d7c60c1c..bca3916b 100644
--- a/docs/alert_aggregators/basic_concatenation.md
+++ b/docs/alert_aggregators/basic_concatenation.md
@@ -1,26 +1,71 @@
 # Basic Concat Alert Aggregation
 
-The basic concat alert aggregation approach aggregates x number of alerts into one output schema.
+The Basic Concat alert aggregation combines the most recent alerts into one aggregated record by
+concatenating their IDs and timestamps.
+
+## In/out
+
+Input and output schemas in the pipeline
+
+## In/out
 
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
 | **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
 
+## Description
 
-# Configuration example
+The aggregator keeps a sliding window of the last `buffer_size` alerts. The first aggregated record
+is emitted once the window is full, and then one record for every new alert, so consecutive records
+overlap. Alerts are combined in the order they arrive, not grouped by log, and the alerts' own
+messages are not carried over (see [What `run()` fills in for you](../alert_aggregator.md#what-run-fills-in-for-you)).
+The [tutorial](../user_guide/tutorial.md#4-add-an-alert-aggregator) shows the overlapping output.
 
-```yaml
-alert_aggregators:
-    BasicConcatAggregator:
-        method_type: "basic_concat_aggregator"
-        buffer_size: 3
-        deduplicate_values: False
-        auto_config: False
-```
+## At a glance
 
-## Example usage
+| Learns from training data | Auto-configuration | Needs `events` | Federation |
+|---|---|---|---|
+| ❌ | ❌ | ❌ | ❌ |
+
+
+## Example
 
 ```python
 --8<-- "docs/examples/alert_aggregators/basic_concat.py:example_1"
 ```
+
+## Configuration file
+
+The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
+
+```yaml
+--8<-- "docs/examples/alert_aggregators/basic_concat.yaml"
+```
+
+Load it with `yaml.safe_load` and pass the dict as `config=`, as in the example. The key under `alert_aggregators:` must match the aggregator's `name`.
+
+## Configuration arguments
+
+All parameters this alert aggregator accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this aggregator or `shared` with other alert aggregators.
+
+<!-- Start arguments -->
+??? note "Top level"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `method_type` | string | basic_concat_aggregator | shared | Indicates what type of method it is. |
+    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `buffer_size` | integer | 3 | specific | Buffer size use in the aggregation. |
+    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
+    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End arguments -->
diff --git a/docs/alert_aggregators/logid_count.md b/docs/alert_aggregators/logid_count.md
new file mode 100644
index 00000000..94e178e3
--- /dev/null
+++ b/docs/alert_aggregators/logid_count.md
@@ -0,0 +1,61 @@
+# LogID Count Alert Aggregation
+
+The logID count alert aggregation tracks how many times each log ID appears in the alerts, and if it exceeds a specified threshold, it triggers the aggregation.
+
+## In/out
+
+|            | Schema                     | Description        |
+|------------|----------------------------|--------------------|
+| **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
+| **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
+
+## At a glance
+
+| Learns from training data | Auto-configuration | Needs `events` | Federation |
+|---|---|---|---|
+| ❌ | ❌ | ❌ | ❌ |
+
+## Description
+
+A log ID counter stores, in a fixed-size table, the counts for different log IDs. If the count for any log ID from the Detector Schemas exceeds a defined threshold, it returns an alert aggregation.
+
+The fixed-size table operates as a FIFO: once it is full, it removes the oldest entry and inserts the new log ID.
+## Example
+
+```python
+--8<-- "docs/examples/alert_aggregators/logid_count.py:example_1"
+```
+
+## Configuration file
+
+The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
+
+```yaml
+--8<-- "docs/examples/alert_aggregators/logid_count.yaml"
+```
+
+## Configuration arguments
+
+All parameters this detector accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this detector or `shared` with other detectors (see the [Alert Aggregation overview](../alert_aggregator.md#common-parameters-all-alert-aggregators)). Where this detector changes a shared default, the shared value is shown in brackets.
+
+<!-- Start arguments -->
+??? note "Top level"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `method_type` | string | logid_count_aggregator | shared | Indicates what type of method it is. |
+    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `max_count` | integer | 4 | specific | Max count of alerts in a specific logID. |
+    | `max_memory` | integer | 5000 | specific | Max number of logIDs store in the count memory. |
+    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
+    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End arguments -->
diff --git a/docs/alert_aggregators/time_delta.md b/docs/alert_aggregators/time_delta.md
new file mode 100644
index 00000000..f65fba67
--- /dev/null
+++ b/docs/alert_aggregators/time_delta.md
@@ -0,0 +1,67 @@
+# Time Delta Alert Aggregation
+
+The time-delta alert aggregator implements alert aggregation by grouping alerts according their time-difference as proposed by [Landauer et al.](https://dl.acm.org/doi/pdf/10.1145/3510581).
+
+## In/out
+
+|            | Schema                     | Description        |
+|------------|----------------------------|--------------------|
+| **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
+| **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
+
+## At a glance
+
+| Learns from training data | Auto-configuration | Needs `events` | Federation |
+|---|---|---|---|
+| ❌ | ❌ | ❌ | ❌ |
+
+## Description
+
+This class implements alert aggregation by considering the differences between the timestamps of alerts.
+
+Two alerts will be assigned to the same group if the time difference between them is below a certain threshold delta.
+The time difference is computed based on the timestamps of the last logs associated with each alert as these determine the earliest time at which the alert was detected.
+Important: It is assumed that the alerts arrive in order of their timestamps!
+
+## Example
+
+```python
+--8<-- "docs/examples/alert_aggregators/time_delta.py:example_1"
+```
+
+## Configuration file
+
+The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
+
+```yaml
+--8<-- "docs/examples/alert_aggregators/time_delta.yaml"
+```
+
+Load it with `yaml.safe_load` and pass the dict as `config=`, as in the example. The key under `alert_aggregators:` must match the aggregator's `name`.
+
+## Configuration arguments
+
+All parameters this alert aggregator accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this aggregator or `shared` with other alert aggregators.
+
+<!-- Start arguments -->
+??? note "Top level"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `method_type` | string | time_delta_aggregator | shared | The kind of aggregation method. |
+    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `buffer_size` | integer | 3 | specific | The size of the buffer. |
+    | `buffer_mode` | object | BufferMode.BATCH | specific | The mode of the buffer. |
+    | `delta` | number | 10.0 | specific | The threshold for the clustering. |
+    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
+    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End arguments -->
diff --git a/docs/auxiliar/input_buffer.md b/docs/auxiliar/input_buffer.md
index 09a53397..e1d352b2 100644
--- a/docs/auxiliar/input_buffer.md
+++ b/docs/auxiliar/input_buffer.md
@@ -1,4 +1,4 @@
-#  Data Buffer
+# Data Buffer
 
 The data buffer is an auxiliary method that can be used in all the components. It takes the stream data and formats it to the given specifications.
 
diff --git a/docs/auxiliar/persistency.md b/docs/auxiliar/persistency.md
index 808af5c0..27653386 100644
--- a/docs/auxiliar/persistency.md
+++ b/docs/auxiliar/persistency.md
@@ -1,7 +1,7 @@
 # Persistency
 
 The persistency module gives a detector a place to remember things about the
-events it sees. State is keyed by `EventID` and survives across training, the
+events it sees. State is keyed by `eventID` and survives across training, the
 detection loop, and (optionally) restarts on disk.
 
 This page is structured to read top-to-bottom: first the mental model, then a
@@ -14,10 +14,10 @@ rest of the page much easier to follow.
 
 ### 1. Events
 
-Logs are grouped by `EventID`. Two events with the same ID share a template
+Logs are grouped by `eventID`. Two events with the same ID share a template
 but have their own variable values. Persistency stores **one independent state
-object per event ID**, so an `EventStabilityTracker` for `EventID=4733` does
-not interfere with one for `EventID=4624`.
+object per event ID**, so an `EventStabilityTracker` for `eventID=4733` does
+not interfere with one for `eventID=4624`.
 
 ### 2. Backends (`EventDataStructure`)
 
@@ -239,10 +239,10 @@ class MyDetector(TrackerDetector):
         super().__init__(name=name, config=config)
 
     def train(self, input_):
-        self._ingest(input_, variables={...}, event_id=input_["EventID"])
+        self._ingest(input_, variables={...}, event_id=input_["eventID"])
 
     def detect(self, input_, output_):
-        tracker = self.persistency.get_events_data().get(input_["EventID"])
+        tracker = self.persistency.get_events_data().get(input_["eventID"])
         # compare against tracker to produce alerts
 ```
 
diff --git a/docs/contribution.md b/docs/contribution.md
index 64b81925..dc6ccfa0 100644
--- a/docs/contribution.md
+++ b/docs/contribution.md
@@ -11,9 +11,13 @@ Bug reports are very helpful to us in improving the software, and therefore, the
 at least the following information in a bug report:
 
 1. Description of the bug. Describe the problem clearly.
-2. Steps to reproduce. With the following configuration, go to.., click.., see error
-3. Expected behavior. What should happen?
-4. Environment. What was the environment for the test(version, browser, etc..)
+2. Steps to reproduce. A minimal code snippet, plus the configuration (YAML or dict) and, if
+   possible, a few log lines that trigger the problem.
+3. Expected behavior. What should happen, and what happens instead (including the full error
+   message, if any)?
+4. Environment. Your Python version, your DetectMate version
+   (`python -c "import detectmatelibrary; print(detectmatelibrary.__version__)"`) and your
+   operating system.
 
 *Please don't include any private/sensitive information in your issue! For reporting security-related issues, see [SECURITY.md](https://github.com/ait-detectmate/DetectMateLibrary/blob/main/SECURITY.md)*
 
diff --git a/docs/detectors.md b/docs/detectors.md
index f3d9e5fe..b1eca29d 100644
--- a/docs/detectors.md
+++ b/docs/detectors.md
@@ -8,7 +8,7 @@ Detectors process structured logs from Parsers and emit alerts when anomalies ar
 | **Input**  | [ParserSchema](schemas.md) | Structured log     |
 | **Output** | [DetectorSchema](schemas.md)| Alert / finding    |
 
-This document describes the minimal API, implementation guidance, a short example detector and a unit test pattern.
+This document describes the minimal API, implementation guidance and a short example detector.
 
 ## CoreDetector: minimal API
 
@@ -145,7 +145,7 @@ example configurations set `auto_config: false` anyway, to make this explicit. I
 `auto_config` is `True` *and* `data_use_configure` is set, the configure phase replaces the
 `events` block with its own selection.
 
-When `auto_config` is set to `False`, the detector expects an explicit `events` or `global` block that specifies exactly which variables to monitor. `events` refers to event-specific variables while `global` refers to variables, that are not bound to events (`header_variables` can but don't have to be event bound):
+When `auto_config` is set to `False`, the detector expects an explicit `events` or `global` block that specifies exactly which variables to monitor. `events` refers to event-specific variables while `global` refers to variables that are not bound to events (`header_variables` can but don't have to be event bound):
 
 ```yaml
 detectors:
@@ -172,14 +172,14 @@ detectors:
 
 ### Common parameters (all detectors)
 
-There are some parameters, that **every** detector inherits from `CoreDetectorConfig`/`CoreConfig`/`BasicConfig`, regardless of what it does. The other parameters, that are **specific** for the respective detector, are explained right at the detectors documentation page, later on.
+Some parameters are inherited by **every** detector from `CoreDetectorConfig`/`CoreConfig`/`BasicConfig`, regardless of what it does. The parameters that are **specific** to a detector are explained on that detector's own page.
 
 <!-- Start common_arguments -->
 ???+ note "Top level"
 
     | Field | Type | Default | Description |
     |---|---|---|---|
-    | `auto_config` | boolean | True | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | Events configuration dict keyed by event_id. |
     | `global` | object | {} | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
 
@@ -188,8 +188,8 @@ There are some parameters, that **every** detector inherits from `CoreDetectorCo
     | Field | Type | Default | Description |
     |---|---|---|---|
     | `start_id` | integer | 10 | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
@@ -207,13 +207,13 @@ The detectors that keep their model in persistency stores ([New Event](detectors
 
     | Field | Type | Default | Description |
     |---|---|---|---|
-    | `persist` | object, null | None | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
     | Field | Type | Default | Description |
     |---|---|---|---|
-    | `allow_fed` | boolean | False | Allow to do the federation |
+    | `allow_fed` | boolean | False | Builds the stores needed to take part in federation. |
 <!-- End tracker_arguments -->
 
 ### Per-variable model detectors
@@ -255,7 +255,7 @@ The two neural detectors ([DeepLog](detectors/deeplog.md), [LogBERT](detectors/l
 
 ### Configuration semantics (preliminary)
 
-**`events` key**: the key is the `EventID` (or `event_id`) to monitor: an integer as the parser emits it (see the [Template Matcher](parsers/template_matcher.md) docs for how the EventID is assigned), or a name (see [Named EventIDs and variables](#named-eventids-and-variables) below).
+**`events` key**: the key is the `eventID` (or `event_id`) to monitor: an integer as the parser emits it (see the [Template Matcher](parsers/template_matcher.md) docs for how the EventID is assigned), or a name (see [Named EventIDs and variables](#named-eventids-and-variables) below).
 
 **`global` key** - This one has a similar functionality as the `events` key but refers to variables, that are not bound to events (thus can only contain `header_variables`).
 
@@ -272,7 +272,7 @@ pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=
 
 ### Named EventIDs and variables
 
-Instead of numbers, the `events` block can use names: a name for the `EventID`, and
+Instead of numbers, the `events` block can use names: a name for the `eventID`, and
 the name of a wildcard for `variables[].pos`. The names come from the
 [Template Matcher](parsers/template_matcher.md)'s template file:
 
@@ -285,10 +285,10 @@ the name of a wildcard for `variables[].pos`. The names come from the
     --8<-- "docs/examples/data/named_templates.csv"
     ```
 
-The parser still emits numbers (`EventID` 1 and position 0 for `<user>` in the second
+The parser still emits numbers (`eventID` 1 and position 0 for `<user>` in the second
 template), so the names must be translated before the detector runs. Do this once,
 after creating both components, with `compile_detector_config()`. **Without this step
-the detector monitors nothing**; it only logs a warning that the named `EventID` was
+the detector monitors nothing**; it only logs a warning that the named `eventID` was
 never observed in training.
 
 ```python
@@ -368,8 +368,8 @@ axes:
 | `slope_index` | change centroid vs. `slope_threshold` | index positions |
 | `slope_time` | change centroid vs. `slope_threshold` | normalized timestamps |
 
-Any subset of the four may be enabled, and any single one may stand alone. The
-default (`index` alone) is the historical behaviour: each segment's mean rate
+Any subset of the four may be enabled, and any single one may stand alone. By
+default only `index` is enabled: each segment's mean rate
 of change is compared against its entry in `segment_thresholds` (four segments
 by default, one threshold per segment), and the segments are **equal-count**:
 each holds the same number of observations, regardless of how much time they
@@ -379,7 +379,7 @@ traffic looks stable, because the flood supplies enough samples to dominate the
 later segments. Enabling `time` cuts the same segments at **equal
 durations** instead, so each segment covers the same amount of wall-clock time;
 the detector then needs an event time per record, which it reads from the log's
-named variables (`logFormatVariables`, i.e. the fields declared in the parser's
+named variables (`headerVariables`, i.e. the fields declared in the parser's
 `log_format`) under the name given by `timestamp_variable`. `slope_index` and
 `slope_time` ask a different question (whether the change centroid sits early
 or late in the series), on the index axis and the time axis respectively.
@@ -410,12 +410,11 @@ detectors:
       timestamp_format: "%y%m%d %H%M%S"
 ```
 
-Defaults reproduce the historical behaviour exactly: `index: True`, the other
-three `False`, `segment_thresholds: [1.1, 0.3, 0.1, 0.01]`, `decision: consensus`,
+The defaults are `index: True`, the other three `False`,
+`segment_thresholds: [1.1, 0.3, 0.1, 0.01]`, `decision: consensus` and
 `slope_threshold: -0.05`. A config that sets nothing under `classification`
-classifies identically to before these changes on every series with at least
-four observations; the one exception is the segment floor described under
-"Fields" below.
+uses exactly these. A variable with fewer observations than segments is
+classified `INSUFFICIENT_DATA`; see the segment floor under "Fields" below.
 
 #### The decision rule
 
@@ -448,7 +447,7 @@ All of these live in the detector's `auto_config_params` block.
 | `use_stable_vars` | `bool` | `true` | Include variables classified `STABLE` in the generated configuration. |
 | `use_static_vars` | `bool` | `true` | Include variables classified `STATIC`. Defaults to `false` on `NewValueComboDetector`. |
 | `classification` | `ClassificationMethods` | see below | Which classification methods run and how their verdicts combine. |
-| `timestamp_variable` | `str \| null` | `null` | Name of the field in `logFormatVariables` holding the record's event time. Required for `time` and `slope_time` to have any effect. Only named log-format fields are consulted, never the positional `variables` list. |
+| `timestamp_variable` | `str \| null` | `null` | Name of the field in `headerVariables` holding the record's event time. Required for `time` and `slope_time` to have any effect. Only named log-format fields are consulted, never the positional `variables` list. |
 | `timestamp_format` | `str \| null` | `null` | Explicit [`strftime`](https://docs.python.org/3/library/datetime.html#strftime-and-strptime-format-codes) pattern for parsing that field. When unset, `TimeFormatHandler` auto-detects the format (ISO 8601, Apache, syslog, numeric epoch seconds/milliseconds, and other common layouts). |
 
 Set `timestamp_format` when the source uses a layout the auto-detection does not
diff --git a/docs/detectors/bigram_frequency.md b/docs/detectors/bigram_frequency.md
index 5834fc32..434c4e22 100644
--- a/docs/detectors/bigram_frequency.md
+++ b/docs/detectors/bigram_frequency.md
@@ -50,10 +50,10 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | bigram_frequency_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
@@ -63,13 +63,13 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | `default_freqs` | boolean | False | specific | Initialize the probabilities with default values from https://github.com/markbaggett/freq. |
     | `skip_repetitions` | boolean | True | specific | Only use distinct values for character-pair counting. This counteracts the problem of imbalanced word frequencies that distort the frequency table generated in a single run. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/detectors/charset.md b/docs/detectors/charset.md
index 11f9de65..dfc97c37 100644
--- a/docs/detectors/charset.md
+++ b/docs/detectors/charset.md
@@ -1,6 +1,6 @@
 # Charset Detector
 
-The Charset Detector raises alerts when previously unseen characters appear in configured fields. It is useful to detect novelty, configuration drift, or the appearance of new actors in the environment.
+The Charset Detector raises alerts when previously unseen characters appear in configured fields. It is useful to detect malformed or injected values in fields with a predictable format, for example shell characters such as `;` in a user name.
 
 ## In/out
 
@@ -19,7 +19,7 @@ Input and output schemas in the pipeline
 
 ## Description
 
-This detector maintains a lightweight set of observed characters per monitored field and emits an alert when a character not present in the set is seen for the first time (subject to configuration).
+This detector keeps the set of characters observed during training for each monitored field and emits an alert whenever a value contains a character that is not in the set. Alerts don't add the character to the set, so the same unseen character raises an alert every time it appears.
 
 ## Example
 
@@ -50,23 +50,23 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | charset_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ??? note "params"
 
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/detectors/combo.md b/docs/detectors/combo.md
index fca4ae37..ebd26f6a 100644
--- a/docs/detectors/combo.md
+++ b/docs/detectors/combo.md
@@ -19,7 +19,7 @@ Input and output schemas in the pipeline
 
 ## Description
 
-This detector maintains a lightweight set of observed combination of values per monitored fields and emits an alert when a combination is not present in the set seen for the first time (subject to configuration).
+This detector keeps the set of value combinations observed during training for each group of monitored fields and emits an alert whenever a combination that is not in the set appears. Alerts don't add the combination to the set, so the same unseen combination raises an alert every time it appears.
 
 A combination needs at least two variables in the same instance: with a single variable the detector behaves like the [New Value Detector](new_value.md).
 
@@ -54,23 +54,23 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | new_value_combo_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ??? note "params"
 
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/detectors/deeplog.md b/docs/detectors/deeplog.md
index 16a0d78f..4cabdbae 100644
--- a/docs/detectors/deeplog.md
+++ b/docs/detectors/deeplog.md
@@ -50,7 +50,7 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | deeplog_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
 
@@ -59,8 +59,8 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/detectors/ecvc_detector.md b/docs/detectors/ecvc_detector.md
index af292b69..dcfe68d5 100644
--- a/docs/detectors/ecvc_detector.md
+++ b/docs/detectors/ecvc_detector.md
@@ -52,10 +52,10 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | ecvc_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
@@ -66,11 +66,11 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | `seed` | integer | 0 | specific | Random seed used to shuffle count vectors into train/validation splits. |
     | `threshold_method` | string | mean | specific | Method used to derive the anomaly threshold from the validation split: 'mean' averages the distance scores, 'default' uses a fixed threshold of 0. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 <!-- End arguments -->
diff --git a/docs/detectors/event_sequence.md b/docs/detectors/event_sequence.md
index a8751bf4..374283b4 100644
--- a/docs/detectors/event_sequence.md
+++ b/docs/detectors/event_sequence.md
@@ -78,10 +78,10 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | event_sequence_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
@@ -89,13 +89,13 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     |---|---|---|---|---|
     | `fixed_window_size` | integer, null | None | specific | Length of the sliding EventID window. A window whose exact EventID sequence was not seen during training is reported as an anomaly. When set it overrides the `auto_config_params` window range and skips auto-configuration; auto-configuration writes its own choice here. While it is None the detector is unconfigured and neither trains nor alerts. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/detectors/logbert.md b/docs/detectors/logbert.md
index 510a8eac..aecaf0a7 100644
--- a/docs/detectors/logbert.md
+++ b/docs/detectors/logbert.md
@@ -50,7 +50,7 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | logbert_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
 
@@ -59,8 +59,8 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/detectors/new_event.md b/docs/detectors/new_event.md
index 03ccf041..c2c60022 100644
--- a/docs/detectors/new_event.md
+++ b/docs/detectors/new_event.md
@@ -19,7 +19,7 @@ Input and output schemas in the pipeline
 
 ## Description
 
-This detector maintains a lightweight set of observed event IDs and emits an alert when an event ID not present in the set is seen for the first time (subject to configuration).
+This detector keeps the set of event IDs observed during training and emits an alert whenever an event ID that is not in the set appears. Alerts don't add the event ID to the set, so the same unseen event ID raises an alert every time it appears.
 
 ## Example
 
@@ -50,21 +50,21 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | new_event_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ??? note "params"
 
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 <!-- End arguments -->
diff --git a/docs/detectors/new_value.md b/docs/detectors/new_value.md
index 62a5e10d..95157284 100644
--- a/docs/detectors/new_value.md
+++ b/docs/detectors/new_value.md
@@ -19,7 +19,7 @@ Input and output schemas in the pipeline
 
 ## Description
 
-This detector maintains a lightweight set of observed values per monitored field and emits an alert when a value not present in the set is seen for the first time (subject to configuration).
+This detector keeps the set of values observed during training for each monitored field and emits an alert whenever a value that is not in the set appears. Alerts don't add the value to the set, so the same unseen value raises an alert every time it appears.
 
 ## Example
 
@@ -50,23 +50,23 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | new_value_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ??? note "params"
 
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/detectors/random_detector.md b/docs/detectors/random_detector.md
index 64840cc0..80e05d44 100644
--- a/docs/detectors/random_detector.md
+++ b/docs/detectors/random_detector.md
@@ -50,7 +50,7 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | random_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
 
@@ -59,8 +59,8 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/detectors/rule_based.md b/docs/detectors/rule_based.md
index ace49d2e..7be844ae 100644
--- a/docs/detectors/rule_based.md
+++ b/docs/detectors/rule_based.md
@@ -19,7 +19,7 @@ Input and output schemas in the pipeline
 
 ## Description
 
-The detector analyzes parsed logs one by one and checks which rules are triggered. When alerts are produced, the triggered rules and their messages are recorded in the `alertsObtain` field of the output schema. The `score` field contains the number of rules that triggered.
+The detector analyzes parsed logs one by one and checks which rules are triggered. When alerts are produced, the triggered rules and their messages are recorded in the `alertDetails` field of the output schema. The `score` field contains the number of rules that triggered.
 
 ### Available rules
 
@@ -66,7 +66,7 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | rule_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
 
@@ -76,8 +76,8 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     |---|---|---|---|---|
     | `rules` | array | [{'rule': 'R001 - TemplateNotFound'}, {'rule': 'R003 - CheckForExceptions'}, {'rule': 'R004 - ErrorLevelFound'}] | specific | List of rules to evaluate, each a dict with a 'rule' name and an optional 'args' list. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/detectors/scvs_detector.md b/docs/detectors/scvs_detector.md
index ce75278a..5918394d 100644
--- a/docs/detectors/scvs_detector.md
+++ b/docs/detectors/scvs_detector.md
@@ -52,10 +52,10 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | scvs_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
@@ -63,11 +63,11 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     |---|---|---|---|---|
     | `window_size` | integer | 10 | specific | Length of the event-ID window a count vector is built over. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 <!-- End arguments -->
diff --git a/docs/detectors/value_range.md b/docs/detectors/value_range.md
index 21220d98..60040bcd 100644
--- a/docs/detectors/value_range.md
+++ b/docs/detectors/value_range.md
@@ -50,10 +50,10 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | value_range_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
@@ -61,13 +61,13 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     |---|---|---|---|---|
     | `ignore_non_numerical_val` | boolean | True | specific | Drop non-numeric values instead of raising when a configured variable cannot be cast to a number. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/development.md b/docs/development.md
index 97ba47ce..00a5195d 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -20,9 +20,9 @@ uv sync --dev
 
 ## Use prek to run code checks
 
-Every code contributer must use [`prek`](https://github.com/j178/prek) to run basic checks at commit time.
+Every code contributor must use [`prek`](https://github.com/j178/prek) to run basic checks at commit time.
 `prek` is configured via the existing `.pre-commit-config.yaml`
-and can be installed as part of the `dev` extras. To ensure pre-commit hooks run before each commit, run:
+and is installed with the `dev` dependency group. To ensure pre-commit hooks run before each commit, run:
 
 ```bash
 uv run prek install
@@ -66,10 +66,10 @@ The `configure()` method ingests all available variables (not just configured on
 ```python
 def configure(self, input_):
     self.auto_conf_persistency.ingest_event(
-        event_id=input_["EventID"],
+        event_id=input_["eventID"],
         event_template=input_["template"],
         variables=input_["variables"],
-        named_variables=input_["logFormatVariables"],
+        named_variables=input_["headerVariables"],
     )
 ```
 
diff --git a/docs/examples/alert_aggregators/basic_concat.py b/docs/examples/alert_aggregators/basic_concat.py
index ce66e7c6..34ca5b4d 100644
--- a/docs/examples/alert_aggregators/basic_concat.py
+++ b/docs/examples/alert_aggregators/basic_concat.py
@@ -2,37 +2,28 @@
 # --8<-- [start:example_1]
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
+import yaml
 
-aggregations_config = {
-    "alert_aggregators": {
-        "BasicConcatAggregator": {
-            "method_type": "basic_concat_aggregator",
-            "buffer_size": 3,
-            "deduplicate_values": False,
-            "auto_config": False,
-        }
-    }
-}
 
+with open("docs/examples/alert_aggregators/basic_concat.yaml") as f:
+    config = yaml.safe_load(f)
 
-input_ = schemas.DetectorSchema({
+input_ = sc.DetectorSchema({
     "detectorID": "1",
     "detectorType": "dummy",
     "alertID": "2",
-    "detectionTimestamp": 0,
+    "detectedTimestamp": 0,
     "logIDs": ["logID1"],
     "score": 0.2,
-    "extractedTimestamps": [-1],
+    "logTimestamps": [-1],
     "description": "hello there",
     "receivedTimestamp": 1,
-    "alertsObtain": {"99 problems": "but logs aint one"}
+    "alertDetails": {"99 problems": "but logs aint one"}
 })
 
-alert_aggregator = BasicConcatAggregation(
-    "BasicConcatAggregator", aggregations_config
-)
+alert_aggregator = BasicConcatAggregation("BasicConcatAggregator", config)
 alert_aggregator.process(input_)
 
 # --8<-- [end:example_1]
diff --git a/docs/examples/alert_aggregators/basic_concat.yaml b/docs/examples/alert_aggregators/basic_concat.yaml
new file mode 100644
index 00000000..9d653635
--- /dev/null
+++ b/docs/examples/alert_aggregators/basic_concat.yaml
@@ -0,0 +1,6 @@
+alert_aggregators:
+  BasicConcatAggregator:
+    method_type: basic_concat_aggregator
+    auto_config: false
+    params:
+      buffer_size: 3            # aggregate the 3 most recent alerts
diff --git a/docs/examples/alert_aggregators/logid_count.py b/docs/examples/alert_aggregators/logid_count.py
new file mode 100644
index 00000000..cb9d012a
--- /dev/null
+++ b/docs/examples/alert_aggregators/logid_count.py
@@ -0,0 +1,35 @@
+# --8<-- [start:example_1]
+from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegation
+
+import detectmatelibrary.schemas as schemas
+
+import yaml
+
+
+with open("docs/examples/alert_aggregators/logid_count.yaml") as f:
+    config = yaml.safe_load(f)
+
+
+def generate_schema(log_id: str | list[str]) -> schemas.DetectorSchema:
+    log_id = log_id if isinstance(log_id, list) else [log_id]
+    return schemas.DetectorSchema({
+        "detectorID": "1",
+        "detectorType": "dummy",
+        "alertID": "2",
+        "detectedTimestamp": 0,
+        "logIDs": log_id,
+        "score": 0.2,
+        "logTimestamps": [-1],
+        "description": "hello there",
+        "receivedTimestamp": 1,
+        "alertDetails": {"99 problems": "but logs aint one"}
+    })
+
+
+alert_aggregator = LogIDCountAggegation("LogIDCountAggregator", config=config)
+
+print(alert_aggregator.process(generate_schema("a")) is None)  # True
+print(alert_aggregator.process(generate_schema("b")) is None)  # True
+print(alert_aggregator.process(generate_schema("a")) is None)  # False
+
+# --8<-- [end:example_1]
diff --git a/docs/examples/alert_aggregators/logid_count.yaml b/docs/examples/alert_aggregators/logid_count.yaml
new file mode 100644
index 00000000..bc646f55
--- /dev/null
+++ b/docs/examples/alert_aggregators/logid_count.yaml
@@ -0,0 +1,5 @@
+alert_aggregators:
+    LogIDCountAggregator:
+        method_type: "logid_count_aggregator"
+        max_count: 2
+        max_memory: 5000
diff --git a/docs/examples/alert_aggregators/time_delta.py b/docs/examples/alert_aggregators/time_delta.py
new file mode 100644
index 00000000..2b01157a
--- /dev/null
+++ b/docs/examples/alert_aggregators/time_delta.py
@@ -0,0 +1,53 @@
+# --8<-- [start:example_1]
+import yaml
+
+from detectmatelibrary.alert_aggregation.time_delta import (
+    TimeDeltaAggregation,
+)
+from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
+
+with open("docs/examples/alert_aggregators/time_delta.yaml") as f:
+    config = yaml.safe_load(f)
+
+
+def make_alert(alert_id: str, timestamp: float) -> DetectorSchema:
+    return DetectorSchema(
+        {
+            "detectorID": "detector",
+            "detectorType": "dummy",
+            "alertID": alert_id,
+            "detectedTimestamp": 0,
+            "logIDs": [f"log-{alert_id}"],
+            "score": 0.0,
+            "logTimestamps": [timestamp],
+            "description": "test alert",
+            "receivedTimestamp": 0,
+            "alertDetails": {},
+        }
+    )
+
+
+aggregator = TimeDeltaAggregation(config)
+first = make_alert("a", 0)
+second = make_alert("b", 6)
+third = make_alert("c", 9)
+fourth = make_alert("d", 15)
+
+first_output = AggregateSchema()
+aggregator.aggregate_alerts(first, first_output)
+
+second_output = AggregateSchema()
+aggregator.aggregate_alerts(second, second_output)
+
+third_output = AggregateSchema()
+aggregator.aggregate_alerts(third, third_output)
+
+fourth_output = AggregateSchema()
+aggregator.aggregate_alerts(fourth, fourth_output)
+
+print(first_output["alertDetails"]["a"] == "0")  # True
+print(second_output["alertDetails"]["b"] == "1")  # True
+print(third_output["alertDetails"]["c"] == "1")  # True
+print(fourth_output["alertDetails"]["d"] == "2")  # True
+
+# --8<-- [end:example_1]
diff --git a/docs/examples/alert_aggregators/time_delta.yaml b/docs/examples/alert_aggregators/time_delta.yaml
new file mode 100644
index 00000000..b00bb97b
--- /dev/null
+++ b/docs/examples/alert_aggregators/time_delta.yaml
@@ -0,0 +1,4 @@
+alert_aggregators:
+    TimeDeltaAggregator:
+        method_type: time_delta_aggregator
+        delta: 4.0
diff --git a/docs/examples/config/update.py b/docs/examples/config/update.py
index 12b8d8aa..4abb5b06 100644
--- a/docs/examples/config/update.py
+++ b/docs/examples/config/update.py
@@ -26,10 +26,16 @@
 from detectmatelibrary.common.core import CoreConfig
 from detectmatelibrary.common.detector import CoreDetectorConfig
 from detectmatelibrary.common.parser import CoreParserConfig
+from detectmatelibrary.common.alert_aggregator import CoreAlertAggregatorConfig
+from detectmatelibrary.base_alert_aggregation.density_clustering import DensityClusteringAggregationConfig
+from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregationConfig
+from detectmatelibrary.alert_aggregation.time_delta import TimeDeltaAggregationConfig
+from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegationConfig
 from detectmatelibrary.base_detectors import TrackerDetectorConfig
 from detectmatelibrary.base_detectors import VariableDetectorConfig
 from detectmatelibrary.base_detectors import DeepLearningDetectorConfig
 
+
 from typing import Any
 
 
@@ -184,6 +190,36 @@ def update_shared_args_parsers(doc_path: str) -> None:
         raise Exception(f"While updating {doc_path} -> {str(e)}")
 
 
+def update_shared_args_aggregation(doc_path: str) -> None:
+    """Fill docs/alert_aggregation.md's tables of parameters shared across several
+    alert_aggregator: fields every parser has (CoreAlertAggregatorConfig)."""
+    try:
+        with open(doc_path, "r") as f:
+            docs = f.readlines()
+
+        docs = append_docs(
+            docs=docs,
+            start_cmd="<!-- Start common_arguments -->\n",
+            end_cmd="<!-- End common_arguments -->\n",
+            add=get_arguments(CoreAlertAggregatorConfig().get_docs(), with_scope=False),
+        )
+        docs = append_docs(
+            docs=docs,
+            start_cmd="<!-- Start density_clustering_arguments -->\n",
+            end_cmd="<!-- End density_clustering_arguments -->\n",
+            add=get_arguments(
+                _family_rows(
+                    DensityClusteringAggregationConfig(), base=CoreAlertAggregatorConfig
+                ),
+                with_scope=False,
+            ),
+        )
+        with open(doc_path, "w") as f:
+            f.writelines(docs)
+    except Exception as e:
+        raise Exception(f"While updating {doc_path} -> {str(e)}")
+
+
 # %% Documentation update
 #
 # Every config below drives its own doc page: whenever a Field is added,
@@ -244,11 +280,33 @@ def update_shared_args_parsers(doc_path: str) -> None:
     ),
 ]
 
+AGGREGATOR_DOCS: list[tuple[CoreConfig, type[CoreConfig], str]] = [
+    (
+        BasicConcatAggregationConfig(),
+        CoreAlertAggregatorConfig,
+        "docs/alert_aggregators/basic_concatenation.md"
+    ),
+    (
+        LogIDCountAggegationConfig(),
+        CoreAlertAggregatorConfig,
+        "docs/alert_aggregators/logid_count.md"
+    ),
+    (
+        TimeDeltaAggregationConfig(),
+        CoreAlertAggregatorConfig,
+        "docs/alert_aggregators/time_delta.md"
+    )
+]
+
 update_shared_args_detectors("docs/detectors.md")
 update_shared_args_parsers("docs/parsers.md")
+update_shared_args_aggregation("docs/alert_aggregator.md")
 
 for detector_config, shared_base, doc_path in DETECTOR_DOCS:
     update_docs(detector_config, doc_path=doc_path, shared_base=shared_base)
 
 for parser_config, shared_base, doc_path in PARSER_DOCS:
     update_docs(parser_config, doc_path=doc_path, shared_base=shared_base)
+
+for aggr_config, shared_base, doc_path in AGGREGATOR_DOCS:
+    update_docs(aggr_config, doc_path=doc_path, shared_base=shared_base)
diff --git a/docs/examples/detectors/bigram_frequency.py b/docs/examples/detectors/bigram_frequency.py
index 0291faad..d6c2d183 100644
--- a/docs/examples/detectors/bigram_frequency.py
+++ b/docs/examples/detectors/bigram_frequency.py
@@ -11,7 +11,7 @@
 def failed_login(user: str) -> schemas.ParserSchema:
     """What a parser emits for 'Failed password for <user> from 10.0.0.1 port
     22'."""
-    return schemas.ParserSchema({"EventID": 1, "variables": [user, "10.0.0.1", "22"]})
+    return schemas.ParserSchema({"eventID": 1, "variables": [user, "10.0.0.1", "22"]})
 
 
 # the first 4 logs train the detector (data_use_training: 4)
@@ -20,6 +20,6 @@ def failed_login(user: str) -> schemas.ParserSchema:
 
 print(detector.process(failed_login("alia")))  # None: familiar character pairs
 alert = detector.process(failed_login("xq7zv9k"))  # random-looking user name
-print(dict(alert["alertsObtain"]))
+print(dict(alert["alertDetails"]))
 # {'EventID 1 - user': 'Bigram frequency anomaly with value xq7zv9k, critical_val 0.0 and threshold 0.05.'}
 # --8<-- [end:example]
diff --git a/docs/examples/detectors/charset.py b/docs/examples/detectors/charset.py
index 78f8abe8..e81f4982 100644
--- a/docs/examples/detectors/charset.py
+++ b/docs/examples/detectors/charset.py
@@ -11,7 +11,7 @@
 def failed_login(user: str) -> schemas.ParserSchema:
     """What a parser emits for 'Failed password for <user> from 10.0.0.1 port
     22'."""
-    return schemas.ParserSchema({"EventID": 1, "variables": [user, "10.0.0.1", "22"]})
+    return schemas.ParserSchema({"eventID": 1, "variables": [user, "10.0.0.1", "22"]})
 
 
 # the first 3 logs train the detector (data_use_training: 3)
@@ -20,6 +20,6 @@ def failed_login(user: str) -> schemas.ParserSchema:
 
 print(detector.process(failed_login("carla")))  # None: only known characters
 alert = detector.process(failed_login("bob;rm -rf"))
-print(dict(alert["alertsObtain"]))
+print(dict(alert["alertDetails"]))
 # {'EventID 1 - user': "Unknown character(s): ' ', '-', ';', 'f', 'm'"}
 # --8<-- [end:example]
diff --git a/docs/examples/detectors/combo.py b/docs/examples/detectors/combo.py
index d7f5a544..ac490bbf 100644
--- a/docs/examples/detectors/combo.py
+++ b/docs/examples/detectors/combo.py
@@ -11,7 +11,7 @@
 def login(user: str, ip: str) -> schemas.ParserSchema:
     """What a parser emits for 'Accepted password for <user> from <ip> port
     22'."""
-    return schemas.ParserSchema({"EventID": 0, "variables": [user, ip, "22"]})
+    return schemas.ParserSchema({"eventID": 0, "variables": [user, ip, "22"]})
 
 
 # the first 3 logs train the detector (data_use_training: 3)
@@ -21,6 +21,6 @@ def login(user: str, ip: str) -> schemas.ParserSchema:
 print(detector.process(login("bob", "10.0.0.2")))  # None: known user/IP pair
 # alice and 10.0.0.2 are both known, but never appeared together
 alert = detector.process(login("alice", "10.0.0.2"))
-print(dict(alert["alertsObtain"]))
+print(dict(alert["alertDetails"]))
 # {"EventID 0 - ('user', 'src_ip')": "Unknown value combination: ('alice', '10.0.0.2')"}
 # --8<-- [end:example]
diff --git a/docs/examples/detectors/deeplog.py b/docs/examples/detectors/deeplog.py
index 78d8a03e..7155b35b 100644
--- a/docs/examples/detectors/deeplog.py
+++ b/docs/examples/detectors/deeplog.py
@@ -10,7 +10,7 @@
 
 def event(event_id: int) -> schemas.ParserSchema:
     """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    return schemas.ParserSchema({"eventID": event_id})
 
 
 # a repeating workflow of 4 events; the model trains once 60 windows are collected
diff --git a/docs/examples/detectors/ecvc_detector.py b/docs/examples/detectors/ecvc_detector.py
index 09eaf186..fd5b458a 100644
--- a/docs/examples/detectors/ecvc_detector.py
+++ b/docs/examples/detectors/ecvc_detector.py
@@ -10,7 +10,7 @@
 
 def event(event_id: int) -> schemas.ParserSchema:
     """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    return schemas.ParserSchema({"eventID": event_id})
 
 
 # normal session: 0 = login accepted, 1 = session opened, 2 = session closed.
diff --git a/docs/examples/detectors/event_sequence.py b/docs/examples/detectors/event_sequence.py
index 9a9027ea..54a4b5d5 100644
--- a/docs/examples/detectors/event_sequence.py
+++ b/docs/examples/detectors/event_sequence.py
@@ -1,4 +1,6 @@
 # --8<-- [start:example]
+from itertools import count
+
 import yaml
 from detectmatelibrary import schemas
 from detectmatelibrary.detectors.event_sequence_detector import EventSequenceDetector
@@ -8,9 +10,13 @@
 detector = EventSequenceDetector(name="LoginSequenceDetector", config=config)
 
 
+log_ids = count()
+
+
 def event(event_id: int) -> schemas.ParserSchema:
-    """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    """A parsed log with a running logID; only its EventID (the matched
+    template) matters for detection."""
+    return schemas.ParserSchema({"eventID": event_id, "logID": str(next(log_ids))})
 
 
 # normal session: 0 = login accepted, 1 = session opened, 2 = session closed.
@@ -23,8 +29,8 @@ def event(event_id: int) -> schemas.ParserSchema:
 
 detector.process(event(0))
 alert = detector.process(event(2))  # session closed without being opened
-print(dict(alert["alertsObtain"]))
-# {'Sequence (0, 2)': 'EventID sequence of length 2 ending at logID  was not seen during training.'}
+print(dict(alert["alertDetails"]))
+# {'Sequence (0, 2)': 'EventID sequence of length 2 ending at logID 10 was not seen during training.'}
 
 print(detector.get_known_sequences())  # {(0, 1), (1, 2), (2, 0)}
 # --8<-- [end:example]
diff --git a/docs/examples/detectors/logbert.py b/docs/examples/detectors/logbert.py
index b460d1c6..8fed4c03 100644
--- a/docs/examples/detectors/logbert.py
+++ b/docs/examples/detectors/logbert.py
@@ -10,7 +10,7 @@
 
 def event(event_id: int) -> schemas.ParserSchema:
     """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    return schemas.ParserSchema({"eventID": event_id})
 
 
 # a repeating workflow of 4 events; the model trains once 60 windows are collected
diff --git a/docs/examples/detectors/named_events.py b/docs/examples/detectors/named_events.py
index 1b8cbece..1aa70302 100644
--- a/docs/examples/detectors/named_events.py
+++ b/docs/examples/detectors/named_events.py
@@ -35,7 +35,7 @@
 ]
 for line in lines:
     alert = detector.process(parser.process(schemas.LogSchema({"log": line})))
-    print(dict(alert["alertsObtain"]) if alert else None)
+    print(dict(alert["alertDetails"]) if alert else None)
 # None
 # None
 # {'EventID 1 - user': "Unknown value: 'mallory'"}
diff --git a/docs/examples/detectors/new_event.py b/docs/examples/detectors/new_event.py
index 22c44bd3..67dd0dff 100644
--- a/docs/examples/detectors/new_event.py
+++ b/docs/examples/detectors/new_event.py
@@ -10,7 +10,7 @@
 
 def event(event_id: int) -> schemas.ParserSchema:
     """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    return schemas.ParserSchema({"eventID": event_id})
 
 
 # the first 3 logs train the detector (data_use_training: 3):
@@ -20,5 +20,5 @@ def event(event_id: int) -> schemas.ParserSchema:
 
 print(detector.process(event(1)))  # None: known event
 alert = detector.process(event(2))  # a template never seen during training
-print(dict(alert["alertsObtain"]))  # {'EventID 2 - {}': "Unknown event ID: '2'"}
+print(dict(alert["alertDetails"]))  # {'EventID 2 - {}': "Unknown event ID: '2'"}
 # --8<-- [end:example]
diff --git a/docs/examples/detectors/new_value.py b/docs/examples/detectors/new_value.py
index d9ecb77c..1d64461f 100644
--- a/docs/examples/detectors/new_value.py
+++ b/docs/examples/detectors/new_value.py
@@ -11,7 +11,7 @@
 def login(user: str, ip: str) -> schemas.ParserSchema:
     """What a parser emits for 'Accepted password for <user> from <ip> port
     22'."""
-    return schemas.ParserSchema({"EventID": 0, "variables": [user, ip, "22"]})
+    return schemas.ParserSchema({"eventID": 0, "variables": [user, ip, "22"]})
 
 
 # the first 3 logs train the detector (data_use_training: 3)
@@ -20,5 +20,5 @@ def login(user: str, ip: str) -> schemas.ParserSchema:
 
 print(detector.process(login("bob", "10.0.0.9")))  # None: bob is a known user
 alert = detector.process(login("mallory", "10.0.0.1"))
-print(dict(alert["alertsObtain"]))  # {'EventID 0 - user': "Unknown value: 'mallory'"}
+print(dict(alert["alertDetails"]))  # {'EventID 0 - user': "Unknown value: 'mallory'"}
 # --8<-- [end:example]
diff --git a/docs/examples/detectors/random_detector.py b/docs/examples/detectors/random_detector.py
index 90cac0b3..94d3a81e 100644
--- a/docs/examples/detectors/random_detector.py
+++ b/docs/examples/detectors/random_detector.py
@@ -8,7 +8,7 @@
     config = yaml.safe_load(f)
 detector = RandomDetector(name="RandomDetector", config=config)
 
-login = schemas.ParserSchema({"EventID": 0, "variables": ["alice", "10.0.0.1", "22"]})
+login = schemas.ParserSchema({"eventID": 0, "variables": ["alice", "10.0.0.1", "22"]})
 
 np.random.seed(0)  # only to make this example reproducible
 
diff --git a/docs/examples/detectors/rule_based.py b/docs/examples/detectors/rule_based.py
index 4740114c..3fe9339d 100644
--- a/docs/examples/detectors/rule_based.py
+++ b/docs/examples/detectors/rule_based.py
@@ -10,7 +10,7 @@
 
 def parsed(event_id: int, log: str, level: str = "INFO") -> schemas.ParserSchema:
     """A parsed log; EventID -1 means the parser found no matching template."""
-    return schemas.ParserSchema({"EventID": event_id, "log": log, "logFormatVariables": {"Level": level}})
+    return schemas.ParserSchema({"eventID": event_id, "log": log, "headerVariables": {"Level": level}})
 
 
 logs = [
@@ -21,7 +21,7 @@ def parsed(event_id: int, log: str, level: str = "INFO") -> schemas.ParserSchema
 ]
 for log in logs:
     alert = detector.process(log)
-    print(dict(alert["alertsObtain"]) if alert else None)
+    print(dict(alert["alertDetails"]) if alert else None)
 # None
 # {'R001 - TemplateNotFound': 'No template found by parser'}
 # {'R002 - SpecificKeyword': "Found word 'sudo' in the logs"}
diff --git a/docs/examples/detectors/scvs_detector.py b/docs/examples/detectors/scvs_detector.py
index cddacbeb..4fbda79e 100644
--- a/docs/examples/detectors/scvs_detector.py
+++ b/docs/examples/detectors/scvs_detector.py
@@ -10,7 +10,7 @@
 
 def event(event_id: int) -> schemas.ParserSchema:
     """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    return schemas.ParserSchema({"eventID": event_id})
 
 
 # normal session: 0 = login accepted, 1 = session opened, 2 = session closed.
diff --git a/docs/examples/detectors/value_range.py b/docs/examples/detectors/value_range.py
index 38f70b9b..0bfb3c80 100644
--- a/docs/examples/detectors/value_range.py
+++ b/docs/examples/detectors/value_range.py
@@ -11,7 +11,7 @@
 def download(path: str, bytes_read: int) -> schemas.ParserSchema:
     """What a parser emits for 'close <path> bytes read <bytes_read> written
     0'."""
-    return schemas.ParserSchema({"EventID": 2, "variables": [path, str(bytes_read), "0"]})
+    return schemas.ParserSchema({"eventID": 2, "variables": [path, str(bytes_read), "0"]})
 
 
 # the first 3 logs train the detector (data_use_training: 3)
@@ -20,5 +20,5 @@ def download(path: str, bytes_read: int) -> schemas.ParserSchema:
 
 print(detector.process(download("/srv/d.pdf", 200)))  # None: inside the learned range
 alert = detector.process(download("/srv/db.dump", 99999))
-print(dict(alert["alertsObtain"]))  # {'EventID 2 - bytes_read': "Out of range value: '99999' (100 - 250)"}
+print(dict(alert["alertDetails"]))  # {'EventID 2 - bytes_read': "Out of range value: '99999' (100 - 250)"}
 # --8<-- [end:example]
diff --git a/docs/examples/others/pipeline.py b/docs/examples/others/pipeline.py
new file mode 100644
index 00000000..045e1648
--- /dev/null
+++ b/docs/examples/others/pipeline.py
@@ -0,0 +1,46 @@
+# --8<-- [start:example_1]
+from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegationConfig
+
+from detectmatelibrary.parsers.tree_matcher import TemplateCppTreeMatcherConfig
+
+from detectmatelibrary.detectors.charset_detector import CharsetDetectorConfig
+
+from detectmatelibrary.pipeline import PipelineConfig, Pipeline
+import detectmatelibrary.schemas as schemas
+
+config = PipelineConfig(
+        do_parsing=True,  # Use the parser
+        do_aggregation=True,  # Use the aggregator
+        parser=TemplateCppTreeMatcherConfig(
+            path_templates="docs/examples/data/tutorial_templates.txt",
+            log_format="type=<Type> msg=audit(<Time>): <Content>"
+        ),
+        n_workers=1,  # You can add parallelization for the detectors
+        detectors=[
+            {
+                "detectors": {
+                    "ECVCDetector": {
+                        "method_type": "ecvc_detector",
+                        "data_use_configure": 100,
+                        "window_size": 10,
+                        "seed": 0,
+                        "validation_per": 0.,
+                        "threshold_method": "mean"
+                    }
+                }
+            },
+            CharsetDetectorConfig(
+                data_use_configure=100,
+                data_use_training=1,
+                auto_config=True,
+            )
+        ],
+        aggregator=LogIDCountAggegationConfig(max_count=1)
+    )
+
+pipeline = Pipeline(config=config)
+pipeline.process(schemas.LogSchema({
+    "logID": "0",
+    "log": "pid=9699 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\"'",
+}))
+# --8<-- [end:example_1]
diff --git a/docs/examples/others/select_component.py b/docs/examples/others/select_component.py
new file mode 100644
index 00000000..06e21118
--- /dev/null
+++ b/docs/examples/others/select_component.py
@@ -0,0 +1,22 @@
+
+# --8<-- [start:pickyou]
+from detectmatelibrary.detectors.random_detector import RandomDetectorConfig
+
+import detectmatelibrary.helper.select_component as selc
+
+configs = [
+    {
+        "detectors": {
+            "a": {"method_type": "random_detector"}
+        }
+    },
+    RandomDetectorConfig(),
+]
+names = ["a", "b"]
+
+components = selc.selectComponents(
+    configs=configs, names=names, component_type="detectors"
+)
+print(len(components))  # 2
+
+# --8<-- [end:pickyou]
diff --git a/docs/examples/others/tutorial.py b/docs/examples/others/tutorial.py
index 5a763838..594ec95a 100644
--- a/docs/examples/others/tutorial.py
+++ b/docs/examples/others/tutorial.py
@@ -35,7 +35,7 @@
 
 parsed_logs = [parser.process(raw) for raw in raw_logs]
 for plog in parsed_logs:
-    print(plog["EventID"], plog["template"])
+    print(plog["eventID"], plog["template"])
 # --8<-- [end:own_parser]
 
 # --8<-- [start:detectors]
@@ -89,7 +89,7 @@
     nv_alert = new_value_detector.process(plog)
     es_alert = event_sequence_detector.process(plog)
     print(
-        f"{i:>2}  {plog['EventID']:>7}  {str(bool(nv_alert)):>8}  {str(bool(es_alert)):>13}"
+        f"{i:>2}  {plog['eventID']:>7}  {str(bool(nv_alert)):>8}  {str(bool(es_alert)):>13}"
     )
     if nv_alert:
         alerts.append(nv_alert)
diff --git a/docs/examples/parsers/json_parser.py b/docs/examples/parsers/json_parser.py
index c0fa2b80..a41fee88 100644
--- a/docs/examples/parsers/json_parser.py
+++ b/docs/examples/parsers/json_parser.py
@@ -12,8 +12,8 @@
 output = schemas.ParserSchema()
 parser.parse(schemas.LogSchema({"logID": "1", "log": json.dumps(json_log)}), output)
 
-print(output.logFormatVariables["request.method"])  # GET
-print(output.logFormatVariables["request.path"])    # /api/users
+print(output.headerVariables["request.method"])  # GET
+print(output.headerVariables["request.path"])    # /api/users
 # --8<-- [end:basic]
 
 # --8<-- [start:dict-based]
@@ -31,6 +31,6 @@
 output = schemas.ParserSchema()
 parser.parse(schemas.LogSchema({"logID": "1", "log": json.dumps(json_log)}), output)
 
-print(output.logFormatVariables["level"])  # INFO
+print(output.headerVariables["level"])  # INFO
 print(output.template)                     # pid=<*> uid=<*> auid=<*> ses=<*> msg='op=PAM:<*> acct=<*>
 # --8<-- [end:dict-based]
diff --git a/docs/examples/parsers/template_matcher.py b/docs/examples/parsers/template_matcher.py
index f7ba6416..fbef52f9 100644
--- a/docs/examples/parsers/template_matcher.py
+++ b/docs/examples/parsers/template_matcher.py
@@ -11,7 +11,7 @@
     "logID": "0",
     "log": "pid=9699 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\"'",
 }))
-print(parsed.EventID)    # 0: the first template in the file
+print(parsed.eventID)    # 0: the first template in the file
 print(parsed.template)   # pid=<*> uid=<*> auid=<*> ses=<*> msg='op=PAM:<*> acct=<*>
 print(parsed.variables)  # ('9699', '0', '4294967295', '4294967295', 'accounting', '"root"\'')
 # --8<-- [end:example]
diff --git a/docs/examples/parsers/template_tree_matcher.py b/docs/examples/parsers/template_tree_matcher.py
index 5007cf15..e835fc75 100644
--- a/docs/examples/parsers/template_tree_matcher.py
+++ b/docs/examples/parsers/template_tree_matcher.py
@@ -11,7 +11,7 @@
     "logID": "0",
     "log": "pid=9699 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\"'",
 }))
-print(parsed.EventID)    # 0: the first template in the file
+print(parsed.eventID)    # 0: the first template in the file
 print(parsed.template)   # pid <*> uid <*> auid <*> ses <*> msg op PAM <*> acct <*>
 print(parsed.variables)  # ['9699', '0', '4294967295', '4294967295', 'accounting', 'root']
 # --8<-- [end:example]
diff --git a/docs/helper/from_to.md b/docs/helper/from_to.md
index 92f8a6e2..887c706b 100644
--- a/docs/helper/from_to.md
+++ b/docs/helper/from_to.md
@@ -103,14 +103,14 @@ Example JSON save file format:
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "__version__": "1.0.0"
+        "__version__": "2.0.0"
     },
     "1": {
         "logID": "1",
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='unit=<*> comm=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "__version__": "1.0.0"
+        "__version__": "2.0.0"
     }
 }
 ```
@@ -236,14 +236,14 @@ Example input data:
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "__version__": "1.0.0"
+        "__version__": "2.0.0"
     },
     "1": {
         "logID": "1",
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='unit=<*> comm=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "__version__": "1.0.0"
+        "__version__": "2.0.0"
     }
 }
 ```
@@ -255,8 +255,8 @@ Example output data after parsing:
     "0": {
         "template": "This is a dummy template",
         "parsedTimestamp": 1771336089,
-        "EventID": 2,
-        "logFormatVariables": {
+        "eventID": 2,
+        "headerVariables": {
             "Time": "0"
         },
         "parserID": "DummyParser",
@@ -267,14 +267,14 @@ Example output data after parsing:
         ],
         "receivedTimestamp": 1771336089,
         "logID": "0",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "parsedLogID": "10"
     },
     "1": {
         "template": "This is a dummy template",
         "parsedTimestamp": 1771336089,
-        "EventID": 2,
-        "logFormatVariables": {
+        "eventID": 2,
+        "headerVariables": {
             "Time": "0"
         },
         "parserID": "DummyParser",
@@ -285,7 +285,7 @@ Example output data after parsing:
         ],
         "receivedTimestamp": 1771336089,
         "logID": "1",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "parsedLogID": "11"
     }
 }
diff --git a/docs/helper/select_component.md b/docs/helper/select_component.md
new file mode 100644
index 00000000..4cb05575
--- /dev/null
+++ b/docs/helper/select_component.md
@@ -0,0 +1,26 @@
+# Select Component
+
+Methods that make it easy to choose components solely through configuration settings.
+
+```python
+def selectComponent(
+    config: CoreConfig | dict[str, Any],
+    component_type: str,
+    name: Optional[str] = None
+) -> CoreComponent:
+    """Select a single component"""
+
+
+def selectComponents(
+    configs: list[CoreConfig | dict[str, Any]],
+    component_type: str,
+    names: Optional[list[str | None]] = None
+) -> list[CoreComponent]:
+    """Select multiple components"""
+```
+
+## Usage
+
+```python
+--8<-- "docs/examples/others/select_component.py:pickyou"
+```
diff --git a/docs/img/logo.png b/docs/img/logo.png
new file mode 100644
index 00000000..a1e6491d
Binary files /dev/null and b/docs/img/logo.png differ
diff --git a/docs/index.md b/docs/index.md
index 97977898..9f601a70 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,5 +1,7 @@
 # DetectMate Library
 
+![UML](img/logo.png)
+
 Welcome to the documentation for the DetectMate Library. DetectMate is a flexible,
 component-based library for parsing and log anomaly detection. It can be used in research and production,
 and together with the
@@ -25,6 +27,7 @@ Here you can get the full scope.
 * [Parsers](parsers.md)
 * [Detectors](detectors.md)
 * [Alert Aggregation](alert_aggregator.md)
+* [Pipelines](pipeline.md)
 * [Federation](federation.md)
 
 ## How to contribute
diff --git a/docs/other/log_formats.md b/docs/other/log_formats.md
index 8cf611a8..a828d6e8 100644
--- a/docs/other/log_formats.md
+++ b/docs/other/log_formats.md
@@ -2,7 +2,7 @@
 
 This catalog covers 18 common log formats and provides ready-to-use `log_format` patterns for the DetectMate parsers, such as the [MatcherParser](../parsers/template_matcher.md).
 
-**Key concept:** `log_format` splits a raw log line into structured header fields that become entries in `ParserSchema.logFormatVariables`. The special `<Content>` token captures the variable message body, which is then matched against your template file to produce `EventID` and `variables`. Formats without `<Content>` are fully structured, so no template file is needed.
+**Key concept:** `log_format` splits a raw log line into structured header fields that become entries in `ParserSchema.headerVariables`. The special `<Content>` token captures the variable message body, which is then matched against your template file to produce `eventID` and `variables`. Formats without `<Content>` are fully structured, so no template file is needed.
 
 **Generic configuration:**
 
@@ -53,7 +53,7 @@ Linux auditd log. Produced by the kernel audit subsystem; records system calls,
 type=USER_ACCT msg=audit(1642723741.072:375): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
 ```
 
-**`log_format`:** `type=<Type> msg=audit(<Time>): <Content>`
+**`log_format`:** `type=<Type> msg=audit(<Time>:<Serial>): <Content>`
 
 **Variable noise patterns:** Numeric field values (`=\d+`), IP addresses (`(\d+\.){3}\d+`).
 
@@ -85,7 +85,8 @@ Apache httpd access log (Combined Log Format). Each line is fully structured, so
 
 **`log_format`:** `<IP> - - [<Time>] "<RequestType> <Request> <Version>" <Status> <ResponseSize> "<Referer>" "<UserAgent>"`
 
-> All fields land directly in `logFormatVariables`. Use `header_variables` in your detector config to track e.g. `Status`, `IP`, or `RequestType`.
+!!! note
+    All fields land directly in `headerVariables`. Use `header_variables` in your detector config to track e.g. `Status`, `IP`, or `RequestType`.
 
 ---
 
@@ -245,7 +246,8 @@ Jun 14 15:16:02 combo sshd(pam_unix)[19939]: authentication failure; logname= ui
 
 **`log_format`:** `<Month> <Date> <Time> <Level> <Component>([<PID>])?: <Content>`
 
-> Note: `<Level>` captures the **hostname** in standard syslog (the field name follows benchmark convention).
+!!! note
+    `<Level>` captures the **hostname** in standard syslog (the field name follows benchmark convention).
 
 **Variable noise patterns:** IP addresses (`(\d+\.){3}\d+`), embedded timestamps (`\d{2}:\d{2}:\d{2}`).
 
diff --git a/docs/parsers.md b/docs/parsers.md
index f7661259..31ae372a 100644
--- a/docs/parsers.md
+++ b/docs/parsers.md
@@ -41,7 +41,7 @@ class CoreParser:
 
 `parse()` only has to fill the fields that describe the match:
 
-- `EventID` (int): identifier for the matched template/event
+- `eventID` (int): identifier for the matched template/event
 - `template` (string): event template text
 - `variables` (repeated string): extracted parameters (extend the list)
 
@@ -50,7 +50,7 @@ class CoreParser:
 - `parserID`, `parserType`: the parser's name and `method_type`
 - `parsedLogID`: a new unique ID for the parsed record
 - `logID`, `log`: copied from the input `LogSchema`
-- `logFormatVariables`: the header fields extracted with `log_format`
+- `headerVariables`: the header fields extracted with `log_format`
 - `receivedTimestamp`, `parsedTimestamp`: set just before and just after
   `parse()` runs
 
@@ -94,7 +94,7 @@ class MyParser(CoreParser):
         text = input_.log or ""
         # simple example: split on whitespace and treat as variables
         tokens = text.split()
-        output_["EventID"] = 1
+        output_["eventID"] = 1
         output_["template"] = " ".join(["<*>"] * len(tokens))
         output_["variables"].extend(tokens)
         return True
@@ -114,7 +114,7 @@ def test_my_parser_parse():
     out = schemas.ParserSchema()
     ok = parser.parse(raw, out)
     assert ok is True
-    assert out["EventID"] == 1
+    assert out["eventID"] == 1
     assert out["variables"] == ["a", "b", "c"]
 ```
 
@@ -143,8 +143,8 @@ There are some parameters, that **every** parser inherits from `CoreParserConfig
     | Field | Type | Default | Description |
     |---|---|---|---|
     | `start_id` | integer | 10 | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/auto_parser.md b/docs/parsers/auto_parser.md
index 4c768bb0..8a7c6d58 100644
--- a/docs/parsers/auto_parser.md
+++ b/docs/parsers/auto_parser.md
@@ -62,8 +62,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     |---|---|---|---|---|
     | `fix_type` | string |  | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/drain_parser.md b/docs/parsers/drain_parser.md
index e80bcf3e..dff7cf69 100644
--- a/docs/parsers/drain_parser.md
+++ b/docs/parsers/drain_parser.md
@@ -62,8 +62,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     | `reset_in_post_train` | boolean | False | specific | fitting description yet to find |
     | `Finetune` | array | [['depth', [1, 2, 3, 4]], ['max_childs', [10, 40]], ['sim_thres', [0.2, 0.4, 0.6, 0.8]]] | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/json_parser.md b/docs/parsers/json_parser.md
index 8b6ece4c..89e6aa1f 100644
--- a/docs/parsers/json_parser.md
+++ b/docs/parsers/json_parser.md
@@ -1,6 +1,6 @@
 # JSON Parser
 
-Extracts structured information from JSON-formatted logs. Optionally delegates parsing of a specific JSON field (the "content") to a sibling Template Matcher parser. Nested JSON objects are always flattened to dot-separated keys in `logFormatVariables`.
+Extracts structured information from JSON-formatted logs. Optionally delegates parsing of a specific JSON field (the "content") to a sibling Template Matcher parser. Nested JSON objects are always flattened to dot-separated keys in `headerVariables`.
 
 ## In/out
 
@@ -23,6 +23,16 @@ With the configuration file below, the `message` field is also matched against t
 --8<-- "docs/examples/parsers/json_parser.py:dict-based"
 ```
 
+## Event IDs
+
+| Log | Event ID | Template |
+|-----|----------|----------|
+| `message` matches a template | that template's ID | the template |
+| `message` matches no template | `-1` | `<Not Found>` |
+| no `message` field | `-2` | empty |
+
+If the content parser has no templates (for example with the defaults, as in the first example), every message gets `-1`. The parser then logs a warning at the first message.
+
 ## Configuration file
 
 The configuration used by the second example above (the first one runs with all defaults). It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
@@ -56,8 +66,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     | `content_name` | string | message | specific | fitting description yet to find |
     | `content_parser` | string | JsonMatcherParser | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/logbatcher_parser.md b/docs/parsers/logbatcher_parser.md
index af199892..e92d5e47 100644
--- a/docs/parsers/logbatcher_parser.md
+++ b/docs/parsers/logbatcher_parser.md
@@ -78,8 +78,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     | `base_url` | string |  | specific | fitting description yet to find |
     | `batch_size` | integer | 10 | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/template_matcher.md b/docs/parsers/template_matcher.md
index 1564012b..18cb2383 100644
--- a/docs/parsers/template_matcher.md
+++ b/docs/parsers/template_matcher.md
@@ -16,15 +16,15 @@ Input and output schemas in the pipeline
 The template matcher is a lightweight, fast parser intended for logs that follow stable textual templates with variable fields. Templates use the token `<*>` to mark wildcard slots. The matcher:
 
 - Preprocesses logs and templates (remove spaces, punctuation, lowercase) based on config.
-- Finds the first template that matches and extracts all wildcard parameters in order.
-- Populates ParserSchema fields: `EventID`, `template`, `variables`,  `logID`, and related fields.
-- **`EventID` is the 0-indexed line number of the matched template** in the template file (first line → `EventID: 0`, second line → `EventID: 1`, etc.).
+- Tries the templates in order of how often each has matched so far, uses the first one that matches, and extracts all wildcard parameters in order. If templates overlap, the same log can therefore get a different `eventID` over time.
+- Populates ParserSchema fields: `eventID`, `template`, `variables`,  `logID`, and related fields.
+- **`eventID` is the 0-indexed line number of the matched template** in the template file (first line → `eventID: 0`, second line → `eventID: 1`, etc.).
 
-This parser is deterministic and designed for high-throughput use when templates are known in advance.
+This parser is designed for high-throughput use when templates are known in advance.
 
 ## EventID assignment (preliminary)
 
-The `EventID` (or `event_id`) field in the output `ParserSchema` identifies which template was matched. It equals the **0-indexed line number** of the matching template in the template file, for example:
+The `eventID` (or `event_id`) field in the output `ParserSchema` identifies which template was matched. It equals the **0-indexed line number** of the matching template in the template file, for example:
 
 | Line in template file | EventID |
 |-----------------------|---------|
@@ -33,7 +33,7 @@ The `EventID` (or `event_id`) field in the output `ParserSchema` identifies whic
 | 3rd line              | 2       |
 | ...                   | ...     |
 
-The `EventID` is the integer key used in detector configurations (e.g., `NewValueDetector`) to scope detection rules to logs of a particular template type.
+The `eventID` is the integer key used in detector configurations (e.g., `NewValueDetector`) to scope detection rules to logs of a particular template type.
 
 ## Template format
 
@@ -46,6 +46,11 @@ pid=<*> uid=<*> auid=<*> ses=<*> msg='op=PAM:<*> acct=<*>
 login success: user=<*> source=<*>
 ```
 
+Templates can also name their wildcards (`<user>` instead of `<*>`), and a `.csv` template
+file with an `EventId` column can name each template. Detector configurations can then use
+these names instead of numbers; see
+[Named EventIDs and variables](../detectors.md#named-eventids-and-variables).
+
 ## Example
 
 Load the templates and match a log:
@@ -88,8 +93,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     | `lowercase` | boolean | True | specific | fitting description yet to find |
     | `path_templates` | string, null | None | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/template_tree_matcher.md b/docs/parsers/template_tree_matcher.md
index 328da50d..99169d6a 100644
--- a/docs/parsers/template_tree_matcher.md
+++ b/docs/parsers/template_tree_matcher.md
@@ -13,7 +13,8 @@ Input and output schemas in the pipeline
 | **Input**  | [LogSchema](../schemas.md) | Unstructured log   |
 | **Output** | [ParserSchema](../schemas.md) | Structured log   |
 
-WARNING: This parser is not yet in a stable release and may behave differently across platforms or hardware.
+!!! warning "Not yet stable"
+    This parser is not yet in a stable release and may behave differently across platforms or hardware.
 
 ## Template format
 
@@ -63,8 +64,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     |---|---|---|---|---|
     | `path_templates` | string, null | None | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
@@ -72,4 +73,5 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     | `time_format` | string, null | None | shared | fitting description yet to find |
 <!-- End arguments -->
 
-Note: this matcher removes non-alphanumeric characters from logs and templates before matching, except for the `<*>` token. Ensure your templates are compatible with that normalization.
+!!! note
+    This matcher removes non-alphanumeric characters from logs and templates before matching, except for the `<*>` token. Ensure your templates are compatible with that normalization.
diff --git a/docs/pipeline.md b/docs/pipeline.md
new file mode 100644
index 00000000..610791a7
--- /dev/null
+++ b/docs/pipeline.md
@@ -0,0 +1,18 @@
+# Pipelines
+
+Pipelines that enable running the various components within the library, simulating the final behavior delivered by the service.
+
+
+## Main pipeline
+
+The main pipeline functions like a standard inference pipeline. To initialize the entire system, the user only needs to provide either a configuration dictionary or the configuration classes themselves. Since the pipeline inherits from [CoreComponent](advanced/overall_architecture.md), all CoreComponent methods are also available in the pipeline class.
+
+If `do_parsing=False`, the pipeline will take already-parsed logs as input, and the parsing step will be skipped. Likewise, if `do_aggregation=False`, the pipeline will output the detectors’ alerts directly, and the alert aggregation step will be skipped.
+
+The pipeline allows you to pass either a Config class instance or the dictionary used to initialize that Config class as arguments to the various components. For the detectors list, both methods can be combined, as shown in the example.
+
+### Example
+
+```python
+--8<-- "docs/examples/others/pipeline.py:example_1"
+```
diff --git a/docs/schemas.md b/docs/schemas.md
index ad0d5e90..0b4c0871 100644
--- a/docs/schemas.md
+++ b/docs/schemas.md
@@ -93,13 +93,13 @@ Fields:
 |---|---|---|
 | parserType | string | Parser type. |
 | parserID | string | Parser instance identifier. |
-| EventID | int32 | Template/event identifier. |
+| eventID | int32 | Template/event identifier. |
 | template | string | Event template text. |
 | variables | repeated string | Parameters extracted from the template. |
 | parsedLogID | string | ID assigned after parsing (optional). |
 | logID | string | Original raw log ID (link to LogSchema). |
 | log | string | Raw log text. |
-| logFormatVariables | map<string,string> | Key/value pairs from format extraction. |
+| headerVariables | map<string,string> | Key/value pairs from format extraction. |
 | receivedTimestamp | int64 | Timestamp when log was received. |
 | parsedTimestamp | int64 | Timestamp when parsing completed. |
 
@@ -113,13 +113,13 @@ Fields:
 | detectorID | string | Detector instance identifier. |
 | detectorType | string | Type/name of detector. |
 | alertID | string | Unique alert identifier. |
-| detectionTimestamp | int64 | When the alert was produced. |
+| detectedTimestamp | int64 | When the alert was produced. |
 | logIDs | repeated string | IDs of logs related to the alert. |
 | score | float | Confidence/score (if applicable). |
-| extractedTimestamps | repeated int64 | Timestamps extracted from logs. |
+| logTimestamps | repeated int64 | Timestamps extracted from logs. |
 | description | string | Human-readable description of the alert. |
 | receivedTimestamp | int64 | When inputs were received by detector. |
-| alertsObtain | map<string,string> | Additional alert metadata. |
+| alertDetails | map<string,string> | Additional alert metadata. |
 
 ### AggregateSchema
 Output from Alert Aggregations (alerts / findings).
@@ -131,11 +131,11 @@ Fields:
 | detectorIDs | repeated string | List of detector instance identifier. |
 | detectorTypes | repeated string | List of type/name of detectors. |
 | alertIDs | repeated string | List of unique alert identifiers. |
-| outputTimestamp | int64 | When the aggregation was produced. |
+| aggregatedTimestamp | int64 | When the aggregation was produced. |
 | logIDs | repeated string | IDs of logs related to the alerts. |
-| extractedTimestamps | repeated int64 | Timestamps extracted from logs. |
+| logTimestamps | repeated int64 | Timestamps extracted from logs. |
 | description | string | Human-readable description of the alert aggregation. |
-| alertsObtain | map<string,string> | Additional alert metadata from the alert aggregation. |
+| alertDetails | map<string,string> | Additional alert metadata from the alert aggregation. |
 
 ## Examples
 
diff --git a/docs/user_guide/basic_knowledge.md b/docs/user_guide/basic_knowledge.md
index f1630aa0..33fb60f5 100644
--- a/docs/user_guide/basic_knowledge.md
+++ b/docs/user_guide/basic_knowledge.md
@@ -94,10 +94,10 @@ A parsed log would contain fields like:
 
 | Field                | Value                                                  |
 |----------------------|--------------------------------------------------------|
-| `EventID`            | `0`                                                    |
+| `eventID`            | `0`                                                    |
 | `template`           | `hello I am a log about <*> and about <*>`              |
 | `variables`          | `["DetectMate getting started", "what is a log"]`      |
-| `logFormatVariables` | `{"Level": "INFO", "Time": "18-05-2005", "Content": "hello I am a log about DetectMate getting started and about what is a log"}` |
+| `headerVariables` | `{"Level": "INFO", "Time": "18-05-2005", "Content": "hello I am a log about DetectMate getting started and about what is a log"}` |
 
 Parsed logs expose structured data that downstream detection components use for
 anomaly detection.
@@ -105,24 +105,24 @@ anomaly detection.
 ### What is an EventID?
 
 Every distinct template is a different *kind* of event, and the parser gives
-each one a number: the **`EventID`**. All lines that match the same template get
-the same `EventID`, so `User alice logged in from 192.168.0.5` and
-`User bob logged in from 10.0.0.2` share one `EventID`, while a
+each one a number: the **`eventID`**. All lines that match the same template get
+the same `eventID`, so `User alice logged in from 192.168.0.5` and
+`User bob logged in from 10.0.0.2` share one `eventID`, while a
 `User bob logged out` line would get another.
 
 How the number is chosen depends on the parser. With the
 [Template Matcher](../parsers/template_matcher.md), it is the position of the
 matching template in your template file, counting from `0`: the first template is
-`EventID 0`, the second `EventID 1`, and so on. In the table above the template
-file contains just one template, so the line gets `EventID 0`. A line that
-matches no template gets `EventID -1` and the template `<Not Found>`.
+`eventID 0`, the second `eventID 1`, and so on. In the table above the template
+file contains just one template, so the line gets `eventID 0`. A line that
+matches no template gets `eventID -1` and the template `<Not Found>`.
 
-The `EventID` is what detectors build on:
+The `eventID` is what detectors build on:
 
-- Detectors that watch variable values are configured per `EventID`: their
+- Detectors that watch variable values are configured per `eventID`: their
   `events` block says which variables to monitor for which kind of event (see
   [Detectors](../detectors.md#configuration)).
-- Some detectors look at nothing but the `EventID`, for example the
-  [New Event Detector](../detectors/new_event.md) (an `EventID` never seen
+- Some detectors look at nothing but the `eventID`, for example the
+  [New Event Detector](../detectors/new_event.md) (an `eventID` never seen
   before) and the [Event Sequence Detector](../detectors/event_sequence.md) (an
-  unusual order of `EventID`s).
+  unusual order of `eventID`s).
diff --git a/docs/user_guide/tutorial.md b/docs/user_guide/tutorial.md
index 9fdc0113..08ab1216 100644
--- a/docs/user_guide/tutorial.md
+++ b/docs/user_guide/tutorial.md
@@ -24,12 +24,13 @@ this time **you write the templates yourself**. A finished template file is
 included in the repository, but only so you can check your result in step 2.
 That is the point: before you can parse a dataset, you have to look at it.
 
-> **Note:** like the Quickstart, this tutorial assumes a cloned repository and
-> runs from the repository root, the folder that contains `pyproject.toml` (see
-> [Before you start](quickstart.md#before-you-start)). The code finds its files
-> relative to that folder through `ROOT = Path.cwd()`. If you work in a notebook
-> stored somewhere else, set `ROOT` to the path of your clone instead, for example
-> `ROOT = Path("/home/me/DetectMateLibrary")`.
+!!! note
+    Like the Quickstart, this tutorial assumes a cloned repository and
+    runs from the repository root, the folder that contains `pyproject.toml` (see
+    [Before you start](quickstart.md#before-you-start)). The code finds its files
+    relative to that folder through `ROOT = Path.cwd()`. If you work in a notebook
+    stored somewhere else, set `ROOT` to the path of your clone instead, for example
+    `ROOT = Path("/home/me/DetectMateLibrary")`.
 
 ```python
 --8<-- "docs/examples/others/tutorial.py:read"
@@ -69,7 +70,7 @@ one.
 
 **Splitting off the prefix.** The `log_format` string tells the parser how to
 carve off the `type=`/`msg=audit(...)` prefix into
-`logFormatVariables` and hand the parser only the `<Content>` part to match
+`headerVariables` and hand the parser only the `<Content>` part to match
 against templates:
 
 ```text
@@ -93,7 +94,7 @@ proctitle=<*>
 
 A few things worth noticing while writing templates like these:
 
-- The line number is the `EventID`: line 1 (0-indexed: `0`) matches
+- The line number is the `eventID`: line 1 (0-indexed: `0`) matches
   `DAEMON_START`, line 2 (`1`) matches `CONFIG_CHANGE`, and so on, exactly as
   described in [EventID assignment](../parsers/template_matcher.md#eventid-assignment-preliminary).
 - The second template's `op=set <*> old=<*> ...` has only one wildcard where
@@ -113,18 +114,18 @@ A few things worth noticing while writing templates like these:
 --8<-- "docs/examples/others/tutorial.py:own_parser"
 ```
 
-> **Common pitfall: don't escape `log_format` yourself.** The Quickstart's
-> `log_format` string escapes the parentheses by hand:
-> `r"...audit\(<Time>:<Serial>\):..."`. Don't copy that; it's wrong.
-> `generate_logformat_regex()` (used internally by every parser that accepts
-> `log_format`) already escapes every literal character outside the
-> `<Placeholder>` tokens, parentheses included. Escaping them yourself asks it
-> to match a **literal backslash** followed by `(`, which never occurs in
-> real log data. The regex then silently fails to match anything, and every
-> log falls back to `<Not Found>`. Write `log_format` as plain text; only the
-> `<Placeholder>` tokens are special.
-
-Running this prints, for each of the 9 logs, the `EventID` and the matched
+!!! warning "Common pitfall: don't escape log_format yourself"
+    The Quickstart's `log_format` string escapes the parentheses by hand:
+    `r"...audit\(<Time>:<Serial>\):..."`. Don't copy that; it's wrong.
+    `generate_logformat_regex()` (used internally by every parser that accepts
+    `log_format`) already escapes every literal character outside the
+    `<Placeholder>` tokens, parentheses included. Escaping them yourself asks it
+    to match a **literal backslash** followed by `(`, which never occurs in
+    real log data. The regex then silently fails to match anything, and every
+    log falls back to `<Not Found>`. Write `log_format` as plain text; only the
+    `<Placeholder>` tokens are special.
+
+Running this prints, for each of the 9 logs, the `eventID` and the matched
 template. All four templates get used, and every line matches (nothing
 comes back as `<Not Found>`).
 
@@ -137,7 +138,7 @@ stream:
 - [**NewValueDetector**](../detectors/new_value.md) watches the *content* of
   specific fields and alerts when a value it hasn't been trained on shows up.
 - [**EventSequenceDetector**](../detectors/event_sequence.md) ignores field
-  content entirely and instead watches the *order* of `EventID`s, alerting
+  content entirely and instead watches the *order* of `eventID`s, alerting
   when a sequence of consecutive events wasn't part of what it was trained
   on.
 
@@ -150,8 +151,8 @@ Both detectors are configured with `data_use_training: 3`: the first 3 logs
 runs on the remaining 6; see [Configuration](../detectors.md#configuration)
 for how `data_use_training` and `events` interact. `NewValueDetector` is
 pointed at the two fields we identified while writing the templates in step
-2: the `key=value` pair inside `CONFIG_CHANGE` (`EventID: 1`, `pos: 0`) and
-the process name inside `SYSCALL` (`EventID: 2`, `pos: 22`, the `comm=` slot
+2: the `key=value` pair inside `CONFIG_CHANGE` (`eventID: 1`, `pos: 0`) and
+the process name inside `SYSCALL` (`eventID: 2`, `pos: 22`, the `comm=` slot
 counting `<*>` positions left to right in the third template line).
 
 Running the loop prints one row per log line:
@@ -243,14 +244,14 @@ Two details are easy to miss here, and both matter for production configs:
   `log_format` string breaks matching:
   `generate_logformat_regex()` already escapes literal text for you.
 * Detectors configured with an `events` block (such as `NewValueDetector`) only
-  check `EventID`s they have seen in training. If you configure an `EventID` that
+  check `eventID`s they have seen in training. If you configure an `eventID` that
   never appears in the training window (`data_use_training`), the detector stays
   silent for that event type: it does not alert on everything, and it does not
   raise an error. It does log a warning when training ends, for example
   `[NewValueDetector] EventID 5 is configured but was never observed in training data`,
   so check the log after training. This does not apply to every detector: the
   [New Event Detector](../detectors/new_event.md) exists to alert on exactly
-  those never-seen `EventID`s.
+  those never-seen `eventID`s.
 * Calling `.process()` on a detector or aggregator returns `None` when
   nothing fires, and the actual output schema (truthy) when it does, so check
   with `if result:` rather than assuming a boolean.
diff --git a/mkdocs.yml b/mkdocs.yml
index b5b8fa43..eb562bb5 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -43,6 +43,7 @@ nav:
       - Parsers: parsers.md
       - Detectors: detectors.md
       - Alert Aggregation: alert_aggregator.md
+      - Pipelines: pipeline.md
     - Parser types:
       - 00_JSON Parser: parsers/json_parser.md
       - 01_Template Matcher: parsers/template_matcher.md
@@ -66,8 +67,12 @@ nav:
       - 12_LogBERT Detector: detectors/logbert.md
     - Alert Aggregation methods:
       - 00_Basic Concat: alert_aggregators/basic_concatenation.md
+      - 01_LogID Count: alert_aggregators/logid_count.md
+      - 02_Density Cluster: alert_aggregators/density_cluster.md
+      - 03_Time Delta: alert_aggregators/time_delta.md
     - Helpers:
       - FromTo: helper/from_to.md
+      - Select Component: helper/select_component.md
     - Auxiliary:
       - Persistency: auxiliar/persistency.md
       - Data buffer: auxiliar/input_buffer.md
diff --git a/src/detectmatelibrary/__init__.py b/src/detectmatelibrary/__init__.py
index 3cfe8053..15479df2 100644
--- a/src/detectmatelibrary/__init__.py
+++ b/src/detectmatelibrary/__init__.py
@@ -1,4 +1,5 @@
 from . import common
+from . import alert_aggregation
 from . import detectors
 from . import parsers
 from . import schemas
@@ -10,6 +11,7 @@
     "common",
     "detectors",
     "parsers",
+    "alert_aggregation",
     "schemas",
     "utils",
     "__authors__",
diff --git a/src/detectmatelibrary/_testutils/dummy_alert_aggregator.py b/src/detectmatelibrary/_testutils/dummy_alert_aggregator.py
index ccc13058..ab84472d 100644
--- a/src/detectmatelibrary/_testutils/dummy_alert_aggregator.py
+++ b/src/detectmatelibrary/_testutils/dummy_alert_aggregator.py
@@ -1,6 +1,6 @@
 from detectmatelibrary.common.alert_aggregator import (CoreAlertAggregatorConfig, CoreAlertAggregator)
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
-from typing import Any, Optional
+from typing import Any
 
 
 class DummyAlertAggregatorConfig(CoreAlertAggregatorConfig):
@@ -12,16 +12,16 @@ class DummyAlertAggregator(CoreAlertAggregator):
     def __init__(
         self,
         name: str = "DummyAlertAggregator",
-        config: Optional[DummyAlertAggregatorConfig | dict[str, Any]] = DummyAlertAggregatorConfig(),
+        config: DummyAlertAggregatorConfig | dict[str, Any] = DummyAlertAggregatorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = DummyAlertAggregatorConfig.from_dict(config, name)
-        buffer_size: int = config.buffer_size  # type: ignore
+        buffer_size: int = config.buffer_size
         super().__init__(name=name, buffer_size=buffer_size, config=config)
 
     def aggregate_alerts(
         self, input_: list[DetectorSchema] | DetectorSchema, output_: AggregateSchema
     ) -> bool:
         output_["description"] = "Dummy alert aggregation"
-        output_["alertsObtain"]["type"] = "Anomalies aggregated by DummyAlertAggregator"
+        output_["alertDetails"]["type"] = "Anomalies aggregated by DummyAlertAggregator"
         return True
diff --git a/src/detectmatelibrary/_testutils/dummy_detector.py b/src/detectmatelibrary/_testutils/dummy_detector.py
index 4fb0e931..6ab02482 100644
--- a/src/detectmatelibrary/_testutils/dummy_detector.py
+++ b/src/detectmatelibrary/_testutils/dummy_detector.py
@@ -38,5 +38,5 @@ def detect(
         result = pattern[self._call_count % len(pattern)]
         if result:
             output_["score"] = 1.0
-            output_["alertsObtain"]["type"] = "Anomaly detected by DummyDetector"
+            output_["alertDetails"]["type"] = "Anomaly detected by DummyDetector"
         return result
diff --git a/src/detectmatelibrary/_testutils/dummy_parser.py b/src/detectmatelibrary/_testutils/dummy_parser.py
index 62285b77..a8fcdbdc 100644
--- a/src/detectmatelibrary/_testutils/dummy_parser.py
+++ b/src/detectmatelibrary/_testutils/dummy_parser.py
@@ -28,6 +28,6 @@ def parse(
         output_: schemas.ParserSchema
     ) -> None:
 
-        output_["EventID"] = 2
+        output_["eventID"] = 2
         output_["variables"].extend(["dummy_variable"])
         output_["template"] = "This is a dummy template"
diff --git a/src/detectmatelibrary/alert_aggregation/__init__.py b/src/detectmatelibrary/alert_aggregation/__init__.py
new file mode 100644
index 00000000..c292591e
--- /dev/null
+++ b/src/detectmatelibrary/alert_aggregation/__init__.py
@@ -0,0 +1,12 @@
+from .basic_concat import BasicConcatAggregation, BasicConcatAggregationConfig
+from .logid_count import LogIDCountAggegation, LogIDCountAggegationConfig
+from .time_delta import TimeDeltaAggregation, TimeDeltaAggregationConfig
+
+__all__ = [
+    "BasicConcatAggregation",
+    "BasicConcatAggregationConfig",
+    "TimeDeltaAggregation",
+    "TimeDeltaAggregationConfig",
+    "LogIDCountAggegation",
+    "LogIDCountAggegationConfig",
+]
diff --git a/src/detectmatelibrary/alert_aggregation/basic_concat.py b/src/detectmatelibrary/alert_aggregation/basic_concat.py
index e53d52ed..b03c3644 100644
--- a/src/detectmatelibrary/alert_aggregation/basic_concat.py
+++ b/src/detectmatelibrary/alert_aggregation/basic_concat.py
@@ -1,34 +1,37 @@
-from detectmatelibrary.common.alert_aggregator import (CoreAlertAggregatorConfig, CoreAlertAggregator)
+from detectmatelibrary.common.alert_aggregator import (
+    CoreAlertAggregatorConfig, CoreAlertAggregator
+)
+
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
-from typing import Any, Optional
+
+from typing import Any
+from pydantic import Field
 
 
 class BasicConcatAggregationConfig(CoreAlertAggregatorConfig):
-    method_type: str = "basic_concat_aggregator"
-    buffer_size: int = 3
-    deduplicate_values: bool = False
+    method_type: str = Field(
+        default="basic_concat_aggregator", description="Indicates what type of method it is."
+    )
+    buffer_size: int = Field(
+        default=3, description="Buffer size use in the aggregation."
+    )
 
 
 class BasicConcatAggregation(CoreAlertAggregator):
     def __init__(
         self,
         name: str = "BasicConcatAggregator",
-        config: Optional[BasicConcatAggregationConfig | dict[str, Any]] = BasicConcatAggregationConfig(),
+        config: BasicConcatAggregationConfig | dict[str, Any] = BasicConcatAggregationConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = BasicConcatAggregationConfig.from_dict(config, name)
-        buffer_size: int = config.buffer_size  # type: ignore
-        self.deduplicate_values: bool = config.deduplicate_values  # type: ignore
+
+        buffer_size: int = config.buffer_size
         super().__init__(name=name, buffer_size=buffer_size, config=config)
 
     def aggregate_alerts(
-        self, input_: list[DetectorSchema] | DetectorSchema, output_: AggregateSchema
+        self, input_: list[DetectorSchema], output_: AggregateSchema  # type: ignore
     ) -> bool:
+
         output_["description"] = "Basic aggregation by alert concatenation"
-        if self.deduplicate_values:
-            output_["detectorIDs"] = list(dict.fromkeys(output_["detectorIDs"]))
-            output_["detectorTypes"] = list(dict.fromkeys(output_["detectorTypes"]))
-            output_["alertIDs"] = list(dict.fromkeys(output_["alertIDs"]))
-            output_["logIDs"] = list(dict.fromkeys(output_["logIDs"]))
-            output_["extractedTimestamps"] = list(dict.fromkeys(output_["extractedTimestamps"]))
         return True
diff --git a/src/detectmatelibrary/alert_aggregation/logid_count.py b/src/detectmatelibrary/alert_aggregation/logid_count.py
new file mode 100644
index 00000000..335aeabd
--- /dev/null
+++ b/src/detectmatelibrary/alert_aggregation/logid_count.py
@@ -0,0 +1,96 @@
+from detectmatelibrary.common.alert_aggregator import (
+    CoreAlertAggregatorConfig, CoreAlertAggregator
+)
+
+from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
+from detectmatelibrary.utils.data_buffer import BufferMode
+
+from typing import Any
+from functools import lru_cache
+from pydantic import Field
+import polars as pl
+
+
+class Counter:
+    def __init__(self, max_count: int, overall_size: int) -> None:
+        self.max_count = max_count
+        
+        self._df = pl.DataFrame()
+        self._df = self._df.insert_column(0, pl.repeat("", n=overall_size).alias("LogID"))
+        self._df = self._df.insert_column(1, pl.zeros(overall_size, dtype=pl.UInt8).alias("Count"))
+        self._df = self._df.insert_column(2, pl.zeros(overall_size, dtype=pl.Boolean).alias("WasAlert"))
+        self._df = self._df.with_row_index(name="Index")
+
+        self._cached_search = lru_cache(maxsize=overall_size)(self.__get_idx)
+
+        self.idx = 0
+
+    def __is_new_alert(self, idx: int) -> bool:
+        if not self._df[idx, "WasAlert"] and self._df[idx, "Count"] >= self.max_count:
+            self._df[idx, "WasAlert"] = True
+            return True
+        return False
+
+    def __get_idx(self, logId: str) -> int:
+        indices = self._df.filter(pl.col("LogID") == logId).select("Index").to_series()
+
+        if indices.shape[0] == 0:
+            new_row = pl.DataFrame(
+                data=[[self.idx, logId, 0, False]], schema=self._df.schema, orient="row"
+            )
+            self._df = self._df.update(new_row, on="Index")
+            idx = self.idx
+            self.idx = self.idx + 1 if self.idx < self._df.shape[0] - 1 else 0
+        else:
+            idx = indices[0]
+
+        return idx
+
+    def add_and_check(self, logId: str) -> bool:
+        idx = self._cached_search(logId)
+        self._df[idx, "Count"] += 1
+        return self.__is_new_alert(idx)
+
+
+class LogIDCountAggegationConfig(CoreAlertAggregatorConfig):
+    method_type: str = Field(
+        default="logid_count_aggregator", description="Indicates what type of method it is."
+    )
+    max_count: int = Field(default=4, description="Max count of alerts in a specific logID.")
+    max_memory: int = Field(
+        default=5000, description="Max number of logIDs store in the count memory."
+    )
+
+
+class LogIDCountAggegation(CoreAlertAggregator):
+    def __init__(
+        self,
+        name: str = "LogIDCountAggregator",
+        config: LogIDCountAggegationConfig | dict[str, Any] = LogIDCountAggegationConfig(),
+    ) -> None:
+        if isinstance(config, dict):
+            config = LogIDCountAggegationConfig.from_dict(config, name)
+
+        super().__init__(name=name, config=config, buffer_mode=BufferMode.NO_BUF, buffer_size=None)
+        self.config: LogIDCountAggegationConfig
+
+        self.counter = Counter(
+            max_count=self.config.max_count, overall_size=self.config.max_memory
+        )
+
+    def aggregate_alerts(
+        self, input_: DetectorSchema, output_: AggregateSchema  # type: ignore
+    ) -> bool:
+
+        alert_logs = []
+        for logID in input_["logIDs"]:
+            if self.counter.add_and_check(logID):
+                alert_logs.append(logID)
+
+        if (aggreated_alerts := len(alert_logs) > 0):
+            output_["description"] = (
+                "LogID count how many times a log was count as alert."
+                f"Logs that pass the limit count: {", ".join(alert_logs)}"
+            )
+
+        return aggreated_alerts
diff --git a/src/detectmatelibrary/alert_aggregation/time_delta.py b/src/detectmatelibrary/alert_aggregation/time_delta.py
new file mode 100644
index 00000000..7c1c7b9c
--- /dev/null
+++ b/src/detectmatelibrary/alert_aggregation/time_delta.py
@@ -0,0 +1,111 @@
+from collections.abc import Callable
+from typing import Any
+
+from pydantic import Field, NonNegativeFloat
+
+from detectmatelibrary.base_alert_aggregation.density_clustering import (
+    DensityClusteringAggregation,
+    DensityClusteringAggregationConfig,
+)
+from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
+
+
+class TimeDeltaAggregationConfig(DensityClusteringAggregationConfig):
+    """Configuration of the TimeDeltaAggregation class.
+
+    Args:
+        delta (NonNegativeFloat): The time threshold below which two alerts are allocated to the same group.
+    """
+
+    method_type: str = Field(
+        default="time_delta_aggregator",
+        description="The kind of aggregation method.",
+    )
+    delta: NonNegativeFloat = Field(
+        default=10.0, description="The threshold for the clustering."
+    )
+
+
+class TimeDeltaAggregation(DensityClusteringAggregation):
+    """This class implements alert aggregation by the time-delta method introduced by
+    [Landauer et al.](https://doi.org/10.1145/3510581).
+    Two alerts will be assigned to the same group if the time difference
+    between them is below a certain threshold delta.
+    The time difference is computed based on the timestamps of the last logs associated
+    with each alert as these determine the earliest time at which the alert was detected.
+    Important: It is assumed that the alerts arrive in order of their timestamps!
+    """
+
+    def __init__(
+        self,
+        config: TimeDeltaAggregationConfig | dict[str, Any],
+        name: str = "TimeDeltaAggregator",
+    ) -> None:
+        """Initialize the TimeDeltaAggregation class.
+
+        Args:
+            name (str): The name identifying this aggregation method.
+            config (TimeDeltaAggregationConfig): The configuration of this method.
+        """
+        if isinstance(config, dict):
+            config = TimeDeltaAggregationConfig.from_dict(config, name)
+
+        super().__init__(name=name, config=config)
+        self.timestamp_extraction_fn: Callable[[DetectorSchema], float] = lambda alert: (
+            float(alert["logTimestamps"][-1])
+        )
+        self.description = "Alert aggregation by the time-delta method."
+        self.last_timestamp: float = 0.0
+
+    def aggregate_alerts(
+        self, input_: list[DetectorSchema] | DetectorSchema, output_: AggregateSchema
+    ) -> bool:
+        """Aggregate input alerts and write the results to the output.
+
+        Args:
+            input_: The alert or alerts to aggregate.
+            output_: The schema to which aggregation results are written.
+
+        Returns:
+            ``True`` after the aggregation results have been written.
+            ``False`` if no new alerts were aggregated and the output schema was not modified.
+        """
+
+        if not isinstance(input_, list):
+            input_ = [input_]
+
+        if self.timestamp_extraction_fn(input_[0]) < self.last_timestamp:
+            raise ValueError("Alerts must be aggregated in order of their timestamps!")
+        else:
+            self.last_timestamp = self.timestamp_extraction_fn(input_[-1])
+
+        return super().aggregate_alerts(input_, output_)
+
+    def single_metric(
+        self,
+        alert1: DetectorSchema,
+        alert2: DetectorSchema,
+    ) -> NonNegativeFloat:
+        """Compute the time difference between two alerts.
+
+        Args:
+            alert1 (DetectorSchema): The first alert.
+            alert2 (DetectorSchema): The second alert.
+        Returns:
+            NonNegativeFloat: The time difference between the two alerts.
+        """
+        return abs(
+            self.timestamp_extraction_fn(alert1) - self.timestamp_extraction_fn(alert2)
+        )
+
+    def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
+        """Discards all but the last alert in a list of alerts as this is the
+        only one relevant for the time-delta method.
+
+        Args:
+            alerts (list[DetectorSchema]): The list of alerts to discard from.
+
+        Returns:
+            list[bool]: A list of booleans indicating which alerts to discard.
+        """
+        return [i + 1 != len(alerts) for i in range(len(alerts))]
diff --git a/src/detectmatelibrary/base_alert_aggregation/__init__.py b/src/detectmatelibrary/base_alert_aggregation/__init__.py
new file mode 100644
index 00000000..b061cade
--- /dev/null
+++ b/src/detectmatelibrary/base_alert_aggregation/__init__.py
@@ -0,0 +1,9 @@
+from .density_clustering import (
+    DensityClusteringAggregation,
+    DensityClusteringAggregationConfig,
+)
+
+__all__ = [
+    "DensityClusteringAggregation",
+    "DensityClusteringAggregationConfig",
+]
diff --git a/src/detectmatelibrary/base_alert_aggregation/density_clustering.py b/src/detectmatelibrary/base_alert_aggregation/density_clustering.py
new file mode 100644
index 00000000..b41a587a
--- /dev/null
+++ b/src/detectmatelibrary/base_alert_aggregation/density_clustering.py
@@ -0,0 +1,429 @@
+from typing import Any
+
+from pydantic import Field, NonNegativeFloat
+
+from detectmatelibrary.common.alert_aggregator import (
+    CoreAlertAggregator,
+    CoreAlertAggregatorConfig,
+)
+from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
+from detectmatelibrary.utils.data_buffer import BufferMode
+
+
+class DensityClusteringAggregationConfig(CoreAlertAggregatorConfig):
+    """Configuration for the DensityClusteringAggregation class.
+
+    Parameters:
+        buffer_size (int): The size of the buffer.
+        buffer_mode (BufferMode): The mode of the buffer.
+        delta (NonNegativeFloat): The threshold for the clustering.
+    """
+
+    method_type: str = Field(
+        default="density_clustering_aggregator",
+        description="The kind of aggregation method.",
+    )
+    buffer_size: int = Field(default=3, description="The size of the buffer.")
+    buffer_mode: BufferMode = Field(
+        default=BufferMode.BATCH, description="The mode of the buffer."
+    )
+    delta: NonNegativeFloat = Field(
+        default=0.5, description="The threshold for the clustering."
+    )
+
+
+class DensityClusteringAggregation(CoreAlertAggregator):
+    """This class implements alert aggregation by density clustering.
+
+    Attributes:
+        config (DensityClusteringAggregationConfig): The configuration for the aggregator.
+        next_group_id (int): The next group ID to be assigned.
+        relevant_alerts (list[DetectorSchema]): The list of alerts currently relevant for aggregation.
+        alert_id_to_group_id (dict[str, int | None]): A mapping from alert IDs to group IDs.
+        active_groups (dict[int, set[int]]): A mapping from group IDs to sets of merged group IDs.
+        message_buffer (list[str]): A buffer for messages to be published in the output schema.
+
+    # Implementation Details
+
+    Creating a custom density clustering aggregator requires the implementation of 2 methods in subclasses:
+
+    1. One has to implement either the single_metric or the metric function.
+    The single_metric function computes the distance between 2 alerts,
+    while the metric function computes the distance matrix between a list of alerts.
+    If both functions are implemented, the metric function will be used.
+
+    2. The discard_alert_fn function must be implemented to determine which alerts
+    should no longer be considered for aggregation.
+    To this end, after each aggregation step, the discard_alert_fn
+    function is called with the list of relevant alerts.
+    It should return a list of booleans indicating which alerts should be discarded (True)
+    and which should be kept (False).
+
+    # Labelling of Alerts
+
+    The group labels assigned to alerts are published in the output schema as a
+    dictionary mapping alert IDs to group IDs in the "alertDetails" field.
+    Every alert is assigned a group ID immediately after it is received,
+    but as the aggregation progresses, groups may be merged.
+    This is published in the output schema as a list of messages in the "alertDetails" field.
+    Likewise, when a group is finished and no longer reachable from any active alert,
+    this is also published in the output schema as a list of messages in the "alertDetails" field.
+    """
+
+    def __init__(
+        self,
+        config: DensityClusteringAggregationConfig | dict[str, Any],
+        name: str = "DensityClusteringAggregator",
+    ) -> None:
+        """Initialize the density clustering aggregator.
+
+        Args:
+            config: The configuration for the aggregator.
+            name: The name of the aggregator.
+        """
+        if isinstance(config, dict):
+            config = DensityClusteringAggregationConfig.from_dict(config, name)
+
+        self.buffer_size = config.buffer_size
+        self.buffer_mode = config.buffer_mode
+        super().__init__(
+            name=name,
+            config=config,
+            buffer_size=config.buffer_size,
+            buffer_mode=config.buffer_mode,
+        )
+        self.config: DensityClusteringAggregationConfig  # ty: ignore[invalid-mutable-override]
+        self.next_group_id: int = 0
+        self.relevant_alerts: list[DetectorSchema] = []
+        self.alert_id_to_group_id: dict[str, int | None] = {}
+        self.active_groups: dict[int, set[int]] = {}
+        self.message_buffer: list[str] = []
+        self.description = "Alert aggregation by density clustering."
+
+    def single_metric(
+        self, alert1: DetectorSchema, alert2: DetectorSchema  # noqa: ARG002
+    ) -> NonNegativeFloat:
+        """Compute the distance between two alerts. This placeholder
+        implementation always returns 0.0, indicating that all alerts are
+        considered identical.
+
+        Args:
+            alert1: The first alert.
+            alert2: The second alert.
+
+        Returns:
+            The distance between the two alerts.
+        """
+        return 0.0
+
+    def metric(
+        self, alerts: list[DetectorSchema], return_last_rows: int = 0
+    ) -> list[list[NonNegativeFloat]]:
+        """Compute the distance matrix between a list of alerts.
+
+        Subclasses can override this method to provide a more efficient
+        implementation. If both this method and ``single_metric`` are
+        implemented, this method is used.
+
+        Args:
+            alerts: The alerts for which to compute distances.
+            return_last_rows: The number of final rows to compute. If zero,
+                compute all rows.
+
+        Returns:
+            The distance matrix between the alerts.
+        """
+        return [
+            [self.single_metric(alert1, alert2) for alert2 in alerts]
+            for alert1 in alerts[-return_last_rows:]
+        ]
+
+    def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
+        """Determine which alerts should no longer be considered for
+        aggregation. This placeholder implementation always returns a list of
+        ``True`` values, indicating that all alerts should be discarded.
+
+        Args:
+            alerts: The alerts currently relevant for aggregation.
+
+        Returns:
+            A list of booleans indicating which alerts should be discarded.
+            ``True`` values indicate alerts to discard, and ``False`` values
+            indicate alerts to keep.
+        """
+        return [True] * len(alerts)
+
+    def aggregate_alerts(
+        self, input_: list[DetectorSchema] | DetectorSchema, output_: AggregateSchema
+    ) -> bool:
+        """Aggregate input alerts and write the results to the output.
+
+        Args:
+            input_: The alert or alerts to aggregate.
+            output_: The schema to which aggregation results are written.
+
+        Returns:
+            ``True`` after the aggregation results have been written.
+            ``False`` if no new alerts were aggregated and the output schema was not modified.
+        """
+
+        if not isinstance(input_, list):
+            input_ = [input_]
+
+        # identify new alerts and add them to relevant alerts
+        new_alerts = self._add_new_alerts(input_)
+
+        if len(new_alerts) == 0:
+            return False  # no new alerts to aggregate
+
+        # check distance of new alerts to relevant alerts
+        is_same_group = self._check_threshold(
+            self.metric(
+                self.relevant_alerts,
+                len(new_alerts),
+            )
+        )
+
+        # assign groups to new alerts and merge groups if necessary
+        for new_alert, same_group in zip(new_alerts, is_same_group, strict=True):
+            self._assign_new_alert_to_group(new_alert, same_group)
+
+        # write results to output
+        self._write_output(input_, output_)
+        return True
+
+    def _write_output(
+        self, input_: list[DetectorSchema], output_: AggregateSchema
+    ) -> None:
+        """Write group assignments and discard completed alerts.
+
+        Args:
+            input_: The alerts whose group assignments should be written.
+            output_: The schema to which aggregation results are written.
+        """
+        output_["description"] = self.description
+        output_["alertDetails"].update(
+            {
+                alert["alertID"]: str(self.alert_id_to_group_id[alert["alertID"]])
+                for alert in input_
+            }
+        )
+
+        # discard alerts that are no longer relevant
+        _, affected_group_ids = self._discard_alerts()
+        self._check_and_discard_group_ids(affected_group_ids)
+        output_["alertDetails"]["messages"] = "\n".join(self.message_buffer)
+        self.message_buffer = []
+
+    def _add_new_alerts(self, input_: list[DetectorSchema]) -> list[DetectorSchema]:
+        """Add previously unseen alerts to the relevant-alert collection.
+
+        Args:
+            input_: Alerts received by the aggregator.
+
+        Returns:
+            The subset of input alerts that had not been seen before.
+        """
+        new_input = [
+            alert
+            for alert in input_
+            if alert["alertID"] not in self.alert_id_to_group_id
+        ]
+        self.relevant_alerts.extend(new_input)
+        self.alert_id_to_group_id.update(
+            {alert["alertID"]: None for alert in new_input}
+        )
+        return new_input
+
+    def _check_threshold(
+        self, distance_matrix: list[list[NonNegativeFloat]]
+    ) -> list[list[bool]]:
+        """Convert distances into threshold comparisons.
+
+        Args:
+            distance_matrix: The pairwise alert distance matrix.
+
+        Returns:
+            A matrix indicating whether each distance is within the configured
+            clustering threshold.
+        """
+        return [
+            [distance <= self.config.delta for distance in row]
+            for row in distance_matrix
+        ]
+
+    def _new_group(self, alert_id: str) -> int:
+        """Create a group containing a single alert.
+
+        Args:
+            alert_id: The identifier of the alert to place in the new group.
+
+        Returns:
+            The identifier assigned to the new group.
+        """
+        group_id = self.next_group_id
+        self.alert_id_to_group_id[alert_id] = group_id
+        self.active_groups[group_id] = {group_id}
+        self.next_group_id += 1
+        return group_id
+
+    def _check_and_merge_groups(self, close_group_ids: set[int]) -> set[int] | None:
+        """Merge distinct groups associated with nearby alerts.
+
+        Args:
+            close_group_ids: The group identifiers associated with nearby
+                alerts.
+
+        Returns:
+            The merged group when multiple groups were combined, or ``None``
+            when the groups were already merged.
+
+        Raises:
+            Exception: If no active groups can be found for the supplied
+                identifiers.
+        """
+        # check if groups are merged already
+        groups_to_merge = []
+        for group_id in close_group_ids:
+            if (full_group := self.active_groups[group_id]) not in groups_to_merge:
+                groups_to_merge.append(full_group)
+
+        if (num_groups := len(groups_to_merge)) == 0:
+            raise Exception("An error occurred while merging groups!")
+        elif num_groups == 1:
+            # all groups are merged already
+            return None
+
+        # merge groups
+        new_group = set.union(*groups_to_merge)
+        for group_id in new_group:
+            self.active_groups[group_id] = new_group
+
+        self.message_buffer.append(
+            f"Groups {groups_to_merge} are merged into {new_group}."
+        )
+        return new_group
+
+    def _assign_new_alert_to_group(
+        self, new_alert: DetectorSchema, close_relevant_alerts: list[bool]
+    ) -> None:
+        """Assign a new alert to a group based on nearby relevant alerts.
+
+        Args:
+            new_alert: The alert that should receive a group assignment.
+            close_relevant_alerts: Flags indicating which relevant alerts are
+                within the clustering threshold.
+
+        Raises:
+            Exception: If the new alert has no close alerts or if close alerts
+                have no group identifiers.
+        """
+        close_alerts = [
+            relevant_alert
+            for relevant_alert, is_close in zip(
+                self.relevant_alerts, close_relevant_alerts, strict=True
+            )
+            if is_close
+        ]
+
+        if len(close_alerts) == 0:
+            raise Exception("Alert is not close to itself!")
+
+        elif len(close_alerts) == 1:
+            # only close alert is itself, create new group
+            self._new_group(new_alert["alertID"])
+            return
+
+        # check distinct groups of close alerts
+        close_group_ids = {
+            self.alert_id_to_group_id[alert["alertID"]] for alert in close_alerts
+        }
+
+        if len(close_group_ids) == 0:
+            raise Exception("Could not find group_id's of close alerts!")
+
+        elif len(close_group_ids) == 1:
+            if (group_id := close_group_ids.pop()) is None:
+                # all close alerts are not assigned to a group, create new group
+                self._new_group(new_alert["alertID"])
+                return
+
+            # all close alerts belong to the same group, assign new alert to that group
+            self.alert_id_to_group_id[new_alert["alertID"]] = group_id
+            return
+
+        # unlabelled close alerts can be ignored now, they will be labelled in their own iteration
+        valid_group_ids: set[int] = {
+            group_id for group_id in close_group_ids if group_id is not None
+        }
+
+        # close alerts have multiple group_ids, add alert to some group_id
+        for group_id in valid_group_ids:
+            self.alert_id_to_group_id[new_alert["alertID"]] = group_id
+            break
+
+        # merge groups if necessary
+        self._check_and_merge_groups(valid_group_ids)
+
+    def _discard_alerts(self, keep_buffer: bool = True) -> tuple[list[str], set[int]]:
+        """Discard alerts no longer needed for future aggregation.
+
+        Args:
+            keep_buffer: Whether to retain the most recent window-buffer
+                alerts when using window buffering.
+
+        Returns:
+            A tuple containing discarded alert identifiers and group identifiers
+            affected by the discard operation.
+        """
+        alerts_to_discard = self.discard_alert_fn(self.relevant_alerts)
+        if keep_buffer and self.buffer_mode == BufferMode.WINDOW:
+            # set the last self.buffer_size elements of alerts_to_discard to False
+            for i in range(1, self.buffer_size + 1):
+                if i > len(alerts_to_discard):
+                    break
+                alerts_to_discard[-i] = False
+        discarded_alert_ids: list[str] = [
+            alert["alertID"]
+            for alert, discard in zip(
+                self.relevant_alerts, alerts_to_discard, strict=True
+            )
+            if discard
+        ]
+        affected_group_ids = {
+            group_id
+            for alert_id in discarded_alert_ids
+            if (group_id := self.alert_id_to_group_id.pop(alert_id)) is not None
+        }
+        self.relevant_alerts = [
+            alert
+            for alert, discard in zip(
+                self.relevant_alerts, alerts_to_discard, strict=True
+            )
+            if not discard
+        ]
+        return discarded_alert_ids, affected_group_ids
+
+    def _check_and_discard_group_ids(self, group_ids_to_check: set[int]) -> None:
+        """Remove groups that are no longer reachable from active alerts.
+
+        Args:
+            group_ids_to_check: Group identifiers affected by discarded alerts.
+        """
+        # remove groups that are unreachable anymore
+        group_ids_to_discard = {
+            group_id
+            for group_id in group_ids_to_check
+            if group_id not in self.alert_id_to_group_id.values()
+        }
+        for group_id in group_ids_to_discard:
+            self.message_buffer.append(f"Group id {group_id} is finished.")
+
+            # check if group_id has been merged with still active groups
+            full_group_to_check = self.active_groups.pop(group_id)
+            for group_id_to_check in full_group_to_check:
+                if group_id_to_check in self.active_groups:
+                    break
+            else:
+                # full_group_to_check is not reachable anymore
+                self.message_buffer.append(f"Group {full_group_to_check} is finished.")
diff --git a/src/detectmatelibrary/base_detectors/_stability.py b/src/detectmatelibrary/base_detectors/_stability.py
index bb1d4b1e..327bcff0 100644
--- a/src/detectmatelibrary/base_detectors/_stability.py
+++ b/src/detectmatelibrary/base_detectors/_stability.py
@@ -51,7 +51,7 @@ def read(self, input_: ParserSchema) -> float | None:
             )
             return None
 
-        raw = input_["logFormatVariables"].get(self._params.timestamp_variable)
+        raw = input_["headerVariables"].get(self._params.timestamp_variable)
         ts = self._handler.parse_timestamp(str(raw or ""), self._params.timestamp_format)
         if ts == "0":
             self._warn_once(
diff --git a/src/detectmatelibrary/base_detectors/deeplearning_detector.py b/src/detectmatelibrary/base_detectors/deeplearning_detector.py
index 14229b87..798551ba 100644
--- a/src/detectmatelibrary/base_detectors/deeplearning_detector.py
+++ b/src/detectmatelibrary/base_detectors/deeplearning_detector.py
@@ -43,7 +43,7 @@ class DeepLearningDetectorConfig(CoreDetectorConfig):
 
 
 def build_seq(input_: list[schemas.ParserSchema]) -> tuple[int]:
-    return tuple([in_["EventID"] for in_ in input_])
+    return tuple([in_["eventID"] for in_ in input_])
 
 
 class DeepLearningDetector(CoreDetector):
@@ -51,7 +51,7 @@ def __init__(
         self,
         model_cls: DeepModel,
         name: str = "CoreDetector",
-        config: DeepLearningDetectorConfig = DeepLearningDetectorConfig()
+        config: DeepLearningDetectorConfig | dict[str, Any] = DeepLearningDetectorConfig()
     ) -> None:
 
         if isinstance(config, dict):
diff --git a/src/detectmatelibrary/base_detectors/tracker_detector.py b/src/detectmatelibrary/base_detectors/tracker_detector.py
index 8b168a2e..1da3988e 100644
--- a/src/detectmatelibrary/base_detectors/tracker_detector.py
+++ b/src/detectmatelibrary/base_detectors/tracker_detector.py
@@ -24,13 +24,13 @@ class TrackerDetectorConfig(CoreDetectorConfig):
         default=None,
         description=(
             "Periodic state saving (path, interval_seconds, events_until_save, auto_load, "
-            "storage_options). None disables it. See the Persistency page."
+            "storage_options). None disables it. See Saving state (persist) on the Detectors page."
         ),
     )
     allow_fed: bool = Field(
         default=False,
         description=(
-            "Allow to do the federation"
+            "Builds the stores needed to take part in federation."
         ),
     )
 
diff --git a/src/detectmatelibrary/base_detectors/variable_detector.py b/src/detectmatelibrary/base_detectors/variable_detector.py
index 02dea5ec..e8bd13cb 100644
--- a/src/detectmatelibrary/base_detectors/variable_detector.py
+++ b/src/detectmatelibrary/base_detectors/variable_detector.py
@@ -125,7 +125,7 @@ class VariableDetector(TrackerDetector, VariableHooks):
     _time_handler: TimeFormatHandler = _core_time_handler
 
     def __init__(
-        self, name: str, config: VariableDetectorConfig = VariableDetectorConfig()
+        self, name: str, config: VariableDetectorConfig | dict[str, Any] = VariableDetectorConfig()
     ) -> None:
         if isinstance(config, dict):
             config = VariableDetectorConfig.from_dict(config, name)
@@ -154,7 +154,7 @@ def _event_variables(self, input_: ParserSchema) -> List[Dict[str, Any]]:
 
     def train(self, input_: ParserSchema) -> None:  # type: ignore
         for variables in self._event_variables(input_):
-            self._ingest(input_, self._prepare_variables(variables, "training"), input_["EventID"])
+            self._ingest(input_, self._prepare_variables(variables, "training"), input_["eventID"])
         if self.config.global_instances:
             global_vars = get_global_variables(input_, self.config.global_instances)
             if global_vars:
@@ -164,7 +164,7 @@ def detect(self, input_: ParserSchema, output_: DetectorSchema) -> bool:  # type
         alerts: Dict[str, str] = {}
         overall_score = 0.0
         known_events = self.persistency.get_events_data()
-        current_event_id = input_["EventID"]
+        current_event_id = input_["eventID"]
 
         if current_event_id in known_events:
             variables: Dict[str, Any] = {}
@@ -186,16 +186,16 @@ def detect(self, input_: ParserSchema, output_: DetectorSchema) -> bool:  # type
         if overall_score > 0:
             output_["score"] = overall_score
             output_["description"] = self._description()
-            output_["alertsObtain"].update(alerts)
+            output_["alertDetails"].update(alerts)
             return True
         return False
 
     def configure(self, input_: ParserSchema) -> None:  # type: ignore
         self.auto_conf_persistency.ingest_event(
-            event_id=input_["EventID"],
+            event_id=input_["eventID"],
             event_template=input_["template"],
             variables=input_["variables"],
-            named_variables=input_["logFormatVariables"],
+            named_variables=input_["headerVariables"],
             timestamp=self._timestamps.read(input_),
         )
 
diff --git a/src/detectmatelibrary/common/_config/_compile.py b/src/detectmatelibrary/common/_config/_compile.py
index 6f8ea05e..fee27e1f 100644
--- a/src/detectmatelibrary/common/_config/_compile.py
+++ b/src/detectmatelibrary/common/_config/_compile.py
@@ -256,13 +256,13 @@ def get_configured_variables(
     """Extract variables from input based on what's defined in the config.
 
     Args:
-        input_: Parser schema containing variables and logFormatVariables
+        input_: Parser schema containing variables and headerVariables
         log_variables: Config specifying which variables to extract per EventID
 
     Returns:
         Dict mapping variable names to their values from the input
     """
-    event_id = input_["EventID"]
+    event_id = input_["eventID"]
     result: Dict[str, Any] = {}
 
     # Get the config for this event
@@ -279,8 +279,8 @@ def get_configured_variables(
     # Extract header/log format variables by name
     if hasattr(event_config, "header_variables"):
         for name in event_config.header_variables:
-            if name in input_["logFormatVariables"]:
-                result[name] = input_["logFormatVariables"][name]
+            if name in input_["headerVariables"]:
+                result[name] = input_["headerVariables"][name]
 
     return result
 
@@ -296,13 +296,13 @@ def get_instance_variables(
     variables.
 
     Args:
-        input_: Parser schema containing variables and logFormatVariables
+        input_: Parser schema containing variables and headerVariables
         log_variables: Config specifying which variables to extract per EventID
 
     Returns:
         Dict mapping instance name to that instance's variable names and values
     """
-    event_id = input_["EventID"]
+    event_id = input_["eventID"]
     event_config = log_variables[event_id] if event_id in log_variables else None
     result: Dict[str, Dict[str, Any]] = {}
 
@@ -315,8 +315,8 @@ def get_instance_variables(
             else:
                 complete = False
         for name in instance.header_variables:
-            if name in input_["logFormatVariables"]:
-                values[name] = input_["logFormatVariables"][name]
+            if name in input_["headerVariables"]:
+                values[name] = input_["headerVariables"][name]
             else:
                 complete = False
         if complete and values:
@@ -332,7 +332,7 @@ def get_global_variables(
     """Extract header variables from event-ID-independent instances.
 
     Args:
-        input_: Parser schema containing logFormatVariables
+        input_: Parser schema containing headerVariables
         global_instances: Dict of instance_name -> _EventInstance configs
 
     Returns:
@@ -341,6 +341,6 @@ def get_global_variables(
     result: Dict[str, Any] = {}
     for instance in global_instances.values():
         for name in instance.header_variables:
-            if name in input_["logFormatVariables"]:
-                result[name] = input_["logFormatVariables"][name]
+            if name in input_["headerVariables"]:
+                result[name] = input_["headerVariables"][name]
     return result
diff --git a/src/detectmatelibrary/common/alert_aggregator.py b/src/detectmatelibrary/common/alert_aggregator.py
index 44d84fda..dbf776dc 100644
--- a/src/detectmatelibrary/common/alert_aggregator.py
+++ b/src/detectmatelibrary/common/alert_aggregator.py
@@ -6,8 +6,9 @@
 
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
 
-from typing import Any, Optional
 from typing_extensions import override
+from typing import Any, Optional
+from pydantic import Field
 
 
 def _extract_field(
@@ -16,23 +17,31 @@ def _extract_field(
     if not isinstance(input_, list):
         input_ = [input_]
 
-    return [str(i[field]) for i in input_]
+    return list(set([str(i[field]) for i in input_]))
 
 
-def _extract_list_field(input_: list[DetectorSchema] | DetectorSchema, field: str) -> list[str]:
+def _extract_list_fields(
+    input_: list[DetectorSchema] | DetectorSchema, field1: str, field2: str
+) -> tuple[list[str], list[str]]:
+
     if not isinstance(input_, list):
         input_ = [input_]
 
-    final = []
-    for i in input_:
-        final.extend(i[field])
+    final1, final2 = [], []
+    already_checked = set()
+    for in_ in input_:
+        for i_1, i_2 in zip(in_[field1], in_[field2]):
+            if i_1 not in already_checked:
+                final1.append(i_1)
+                final2.append(i_2)
+                already_checked.add(i_1)
 
-    return final
+    return final1, final2
 
 
 class CoreAlertAggregatorConfig(CoreConfig):
-    component_type: str = "alert_aggregators"
-    method_type: str = "core_alert_aggregator"
+    component_type: str = Field(default="alert_aggregators", description="<$IGNORE$>")
+    method_type: str = Field(default="core_alert_aggregator", description="<$IGNORE$>")
 
 
 class CoreAlertAggregator(CoreComponent):
@@ -41,15 +50,15 @@ def __init__(
         name: str = "CoreAlertAggregator",
         buffer_mode: BufferMode = BufferMode.WINDOW,
         buffer_size: Optional[int] = 1,
-        config: Optional[CoreAlertAggregatorConfig | dict[str, Any]] = CoreAlertAggregatorConfig(),
+        config: CoreAlertAggregatorConfig | dict[str, Any] = CoreAlertAggregatorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = CoreAlertAggregatorConfig.from_dict(config, name)
 
         super().__init__(
             name=name,
-            type_=config.method_type,  # type: ignore
-            config=config,  # type: ignore
+            type_=config.method_type,
+            config=config,
             args_buffer=ArgsBuffer(mode=buffer_mode, size=buffer_size),
             input_schema=DetectorSchema,
             output_schema=AggregateSchema,
@@ -63,11 +72,12 @@ def run(
         output_["detectorIDs"] = _extract_field(input_, "detectorID")
         output_["detectorTypes"] = _extract_field(input_, "detectorType")
         output_["alertIDs"] = _extract_field(input_, "alertID")
-        output_["logIDs"] = _extract_list_field(input_, "logIDs")
-        output_["extractedTimestamps"] = _extract_list_field(input_, "extractedTimestamps")
+        output_["logIDs"], output_["logTimestamps"] = _extract_list_fields(
+            input_, "logIDs", "logTimestamps"
+        )
 
         if (alert := self.aggregate_alerts(input_=input_, output_=output_)):
-            output_["outputTimestamp"] = get_timestamp()
+            output_["aggregatedTimestamp"] = get_timestamp()
 
         return alert
 
diff --git a/src/detectmatelibrary/common/core.py b/src/detectmatelibrary/common/core.py
index 3aec5409..2b5ac7ea 100644
--- a/src/detectmatelibrary/common/core.py
+++ b/src/detectmatelibrary/common/core.py
@@ -34,11 +34,11 @@ class CoreConfig(BasicConfig):
     )
     data_use_training: int | None = Field(
         default=None,
-        description="Data used for training, if None, training is not done.",
+        description="Number of logs used for training. None skips training.",
     )
     data_use_configure: int | None = Field(
         default=None,
-        description="Data used for configuration, if None, configuration is not done.",
+        description="Number of logs used for the configuration step. None skips it.",
     )
     use_config_data_as_training: bool = Field(
         default=True,
@@ -69,11 +69,14 @@ def __init__(
         self,
         name: str,
         type_: str = "Core",
-        config: CoreConfig = CoreConfig(),
+        config: CoreConfig | dict[str, Any] = CoreConfig(),
         args_buffer: ArgsBuffer = ArgsBuffer(BufferMode.NO_BUF),
         input_schema: type[BaseSchema] = BaseSchema,
         output_schema: type[BaseSchema] = BaseSchema,
     ) -> None:
+        if isinstance(config, dict):
+            config = CoreConfig.from_dict(config, name)
+
         Component.__init__(self, name=name, type_=type_, config=config)
         FedOperations.__init__(self)
         self.config: CoreConfig
diff --git a/src/detectmatelibrary/common/detector.py b/src/detectmatelibrary/common/detector.py
index fca3be7e..8e37df73 100644
--- a/src/detectmatelibrary/common/detector.py
+++ b/src/detectmatelibrary/common/detector.py
@@ -20,7 +20,7 @@ def _extract_timestamp(input_: List[ParserSchema] | ParserSchema) -> List[int]:
     if not isinstance(input_, list):
         input_ = [input_]
     return [
-        int(_time_handler.parse_timestamp(i["logFormatVariables"]["Time"]))
+        int(_time_handler.parse_timestamp(i["headerVariables"]["Time"]))
         for i in input_
     ]
 
@@ -39,7 +39,10 @@ class CoreDetectorConfig(CoreConfig):
 
     auto_config: bool = Field(
         default=True,
-        description="Runs the configuration step before the training process.",
+        description=(
+            "Runs the configuration step before the training process. "
+            "Has no effect unless data_use_configure is set."
+        ),
     )
     events: EventsConfig | dict[str, Any] = Field(
         default={},
@@ -60,15 +63,15 @@ def __init__(
         name: str = "CoreDetector",
         buffer_mode: BufferMode = BufferMode.NO_BUF,
         buffer_size: Optional[int] = None,
-        config: Optional[CoreDetectorConfig | dict[str, Any]] = CoreDetectorConfig(),
+        config: CoreDetectorConfig | dict[str, Any] = CoreDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = CoreDetectorConfig.from_dict(config, name)
 
         super().__init__(
             name=name,
-            type_=config.component_type,  # type: ignore
-            config=config,  # type: ignore
+            type_=config.component_type,
+            config=config,
             args_buffer=ArgsBuffer(mode=buffer_mode, size=buffer_size),
             input_schema=ParserSchema,
             output_schema=DetectorSchema,
@@ -84,12 +87,12 @@ def run(
         output_["detectorID"] = self.name
         output_["detectorType"] = self.config.method_type
         output_["logIDs"] = _extract_logIDs(input_)
-        output_["extractedTimestamps"] = _extract_timestamp(input_)
+        output_["logTimestamps"] = _extract_timestamp(input_)
         output_["receivedTimestamp"] = get_timestamp()
 
         if anomaly_detected := self.detect(input_=input_, output_=output_):
             output_["alertID"] = str(self.id_generator())
-            output_["detectionTimestamp"] = get_timestamp()
+            output_["detectedTimestamp"] = get_timestamp()
 
         return anomaly_detected
 
diff --git a/src/detectmatelibrary/common/parser.py b/src/detectmatelibrary/common/parser.py
index 92f87864..e805cc8b 100644
--- a/src/detectmatelibrary/common/parser.py
+++ b/src/detectmatelibrary/common/parser.py
@@ -6,7 +6,7 @@
 from detectmatelibrary.utils.aux import get_timestamp
 from detectmatelibrary import schemas
 
-from typing import Any, Optional, cast
+from typing import Any, cast
 from pydantic import model_validator
 import re
 from pydantic import Field
@@ -44,15 +44,15 @@ class CoreParser(CoreComponent):
     def __init__(
         self,
         name: str = "CoreParser",
-        config: Optional[CoreParserConfig | dict[str, Any]] = CoreParserConfig(),
+        config: CoreParserConfig | dict[str, Any] = CoreParserConfig(),
     ):
         if isinstance(config, dict):
             config = CoreParserConfig.from_dict(config, name)
 
         super().__init__(
             name=name,
-            type_=config.method_type,  # type: ignore
-            config=config,  # type: ignore
+            type_=config.method_type,
+            config=config,
             args_buffer=ArgsBuffer(mode=BufferMode.NO_BUF, size=None),
             input_schema=schemas.LogSchema,
             output_schema=schemas.ParserSchema,
@@ -73,7 +73,7 @@ def run(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> bool:
         output_["parserType"] = self.config.method_type
         output_["logID"] = input_["logID"]
         output_["log"] = input_["log"]
-        output_["logFormatVariables"].update(var)
+        output_["headerVariables"].update(var)
         input_["log"] = content
 
         output_["receivedTimestamp"] = get_timestamp()
diff --git a/src/detectmatelibrary/detectors/bigram_frequency_detector.py b/src/detectmatelibrary/detectors/bigram_frequency_detector.py
index 11ca5b03..f90bb6a3 100644
--- a/src/detectmatelibrary/detectors/bigram_frequency_detector.py
+++ b/src/detectmatelibrary/detectors/bigram_frequency_detector.py
@@ -73,7 +73,7 @@ class BigramFrequencyDetector(VariableDetector):
     def __init__(
         self,
         name: str = "BigramFrequencyDetector",
-        config: BigramFrequencyDetectorConfig = BigramFrequencyDetectorConfig(),
+        config: BigramFrequencyDetectorConfig | dict[str, Any] = BigramFrequencyDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = BigramFrequencyDetectorConfig.from_dict(config, name)
@@ -126,7 +126,7 @@ def _description(self) -> str:
     def train(self, input_: ParserSchema) -> None:  # type: ignore
         """Train the detector by updating per-variable bigram frequencies."""
         configured_variables = get_configured_variables(input_, self.config.events)
-        current_event_id = input_["EventID"]
+        current_event_id = input_["eventID"]
         known_events = self.persistency.get_events_data()
 
         pre_unique = self._snapshot_unique_sets(
diff --git a/src/detectmatelibrary/detectors/charset_detector.py b/src/detectmatelibrary/detectors/charset_detector.py
index c88e5262..5ceb010c 100644
--- a/src/detectmatelibrary/detectors/charset_detector.py
+++ b/src/detectmatelibrary/detectors/charset_detector.py
@@ -17,7 +17,7 @@ class CharsetDetector(VariableDetector):
     def __init__(
         self,
         name: str = "CharsetDetector",
-        config: CharsetDetectorConfig = CharsetDetectorConfig(),
+        config: CharsetDetectorConfig | dict[str, Any] = CharsetDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = CharsetDetectorConfig.from_dict(config, name)
diff --git a/src/detectmatelibrary/detectors/ecvc_detector.py b/src/detectmatelibrary/detectors/ecvc_detector.py
index 3aad5dfd..5e01ed23 100644
--- a/src/detectmatelibrary/detectors/ecvc_detector.py
+++ b/src/detectmatelibrary/detectors/ecvc_detector.py
@@ -23,7 +23,7 @@ class ECVCOp:
 
     @staticmethod
     def build_one_vec(input_: List[schemas.ParserSchema], n: int) -> np.ndarray:
-        events = [in_["EventID"] for in_ in input_]
+        events = [in_["eventID"] for in_ in input_]
         arr = np.zeros(n if n > (m := max(events) + 1) else m)
 
         for e in events:
diff --git a/src/detectmatelibrary/detectors/event_sequence_detector.py b/src/detectmatelibrary/detectors/event_sequence_detector.py
index 62c165c1..e6093418 100644
--- a/src/detectmatelibrary/detectors/event_sequence_detector.py
+++ b/src/detectmatelibrary/detectors/event_sequence_detector.py
@@ -9,7 +9,7 @@
 
 from collections import deque
 
-from typing_extensions import override
+from typing_extensions import override, Any
 from pydantic import Field, model_validator
 
 
@@ -71,7 +71,7 @@ class EventSequenceDetector(TrackerDetector):
     def __init__(
         self,
         name: str = "EventSequenceDetector",
-        config: EventSequenceDetectorConfig = EventSequenceDetectorConfig(),
+        config: EventSequenceDetectorConfig | dict[str, Any] = EventSequenceDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = EventSequenceDetectorConfig.from_dict(config, name)
@@ -136,7 +136,7 @@ def train(self, input_: ParserSchema) -> None:  # type: ignore
         """
         if (length := self.config.fixed_window_size) is None:
             return
-        self._train_window.append(input_["EventID"])
+        self._train_window.append(input_["eventID"])
         if len(self._train_window) < length:
             return
         self.persistency.ingest_event(
@@ -153,7 +153,7 @@ def detect(self, input_: ParserSchema, output_: DetectorSchema) -> bool:  # type
         """
         if (length := self.config.fixed_window_size) is None:
             return False
-        self._detect_window.append(input_["EventID"])
+        self._detect_window.append(input_["eventID"])
         if len(self._detect_window) < length:
             return False
 
@@ -165,7 +165,7 @@ def detect(self, input_: ParserSchema, output_: DetectorSchema) -> bool:  # type
         output_["description"] = (
             f"{self.name} detects unknown EventID sequences as anomalies."
         )
-        output_["alertsObtain"].update(
+        output_["alertDetails"].update(
             {
                 f"Sequence {sequence}": (
                     f"EventID sequence of length {len(sequence)} ending at logID "
@@ -186,7 +186,7 @@ def configure(self, input_: ParserSchema) -> None:  # type: ignore
         auto = self.config.auto_config_params
         for length in range(auto.min_window_size, auto.max_window_size + 1):
             window = self._configure_windows.setdefault(length, deque(maxlen=length))
-            window.append(input_["EventID"])
+            window.append(input_["eventID"])
             if len(window) == length:
                 self.auto_conf_persistency.ingest_event(
                     event_id=length,
diff --git a/src/detectmatelibrary/detectors/new_event_detector.py b/src/detectmatelibrary/detectors/new_event_detector.py
index 75e831a6..541317d3 100644
--- a/src/detectmatelibrary/detectors/new_event_detector.py
+++ b/src/detectmatelibrary/detectors/new_event_detector.py
@@ -10,6 +10,7 @@
 from detectmatelibrary.schemas import ParserSchema, DetectorSchema
 
 from pydantic import Field
+from typing import Any
 
 
 class NewEventDetectorConfig(TrackerDetectorConfig):
@@ -24,7 +25,7 @@ class NewEventDetector(TrackerDetector):
     def __init__(
         self,
         name: str = "NewEventDetector",
-        config: NewEventDetectorConfig = NewEventDetectorConfig()
+        config: NewEventDetectorConfig | dict[str, Any] = NewEventDetectorConfig()
     ) -> None:
 
         if isinstance(config, dict):
@@ -35,7 +36,7 @@ def __init__(
 
     def train(self, input_: ParserSchema) -> None:  # type: ignore
         """Train the detector by learning values from the input data."""
-        self._ingest(event_id=input_["EventID"], input_=input_, variables={})
+        self._ingest(event_id=input_["eventID"], input_=input_, variables={})
         if self.config.global_instances:
             global_vars = get_global_variables(input_, self.config.global_instances)
             if global_vars:
@@ -48,7 +49,7 @@ def detect(
         alerts: dict[str, str] = {}
         overall_score = 0.0
 
-        current_event_id = input_["EventID"]
+        current_event_id = input_["eventID"]
         known_events = self.persistency.get_events_seen()
 
         if self.config.global_instances and GLOBAL_EVENT_ID in known_events:
@@ -66,14 +67,14 @@ def detect(
             output_["score"] = overall_score
             output_["description"] = \
                 f"{self.name} detects event IDs not encountered in training as anomalies."
-            output_["alertsObtain"].update(alerts)
+            output_["alertDetails"].update(alerts)
             return True
 
         return False
 
     def configure(self, input_: ParserSchema) -> None:  # type: ignore
         self.auto_conf_persistency.ingest_event(
-            event_id=input_["EventID"],
+            event_id=input_["eventID"],
             event_template=input_["template"]
         )
 
diff --git a/src/detectmatelibrary/detectors/new_value_combo_detector.py b/src/detectmatelibrary/detectors/new_value_combo_detector.py
index 63145eb7..e9024f94 100644
--- a/src/detectmatelibrary/detectors/new_value_combo_detector.py
+++ b/src/detectmatelibrary/detectors/new_value_combo_detector.py
@@ -91,7 +91,7 @@ class NewValueComboDetector(VariableDetector):
     def __init__(
         self,
         name: str = "NewValueComboDetector",
-        config: NewValueComboDetectorConfig = NewValueComboDetectorConfig(),
+        config: NewValueComboDetectorConfig | dict[str, Any] = NewValueComboDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = NewValueComboDetectorConfig.from_dict(config, name)
@@ -155,7 +155,7 @@ def set_configuration(self, max_combo_size: int | None = None) -> None:
 
         Variables and combos are sorted before they are written, so the
         generated config does not depend on the order the variables arrived in
-        (a ParserSchema keeps its logFormatVariables in no fixed order).
+        (a ParserSchema keeps its headerVariables in no fixed order).
         """
         if max_combo_size is not None:
             self.config.auto_config_params.max_combo_size = max_combo_size
@@ -174,7 +174,7 @@ def set_configuration(self, max_combo_size: int | None = None) -> None:
             input_ = cast(ParserSchema, record)
             configured_variables = get_configured_variables(input_, self.config.events)
             self.auto_conf_persistency_combos.ingest_event(
-                event_id=input_["EventID"],
+                event_id=input_["eventID"],
                 event_template=input_["template"],
                 named_variables=configured_variables,
                 timestamp=self._timestamps.read(input_),
diff --git a/src/detectmatelibrary/detectors/new_value_detector.py b/src/detectmatelibrary/detectors/new_value_detector.py
index 2eed4f55..0931074b 100644
--- a/src/detectmatelibrary/detectors/new_value_detector.py
+++ b/src/detectmatelibrary/detectors/new_value_detector.py
@@ -17,7 +17,7 @@ class NewValueDetector(VariableDetector):
     def __init__(
         self,
         name: str = "NewValueDetector",
-        config: NewValueDetectorConfig = NewValueDetectorConfig(),
+        config: NewValueDetectorConfig | dict[str, Any] = NewValueDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = NewValueDetectorConfig.from_dict(config, name)
diff --git a/src/detectmatelibrary/detectors/random_detector.py b/src/detectmatelibrary/detectors/random_detector.py
index dd3bac81..1dfd5198 100644
--- a/src/detectmatelibrary/detectors/random_detector.py
+++ b/src/detectmatelibrary/detectors/random_detector.py
@@ -4,10 +4,10 @@
 
 from detectmatelibrary.utils.data_buffer import BufferMode
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 from typing_extensions import override
-from typing import List
+from typing import List, Any
 
 from pydantic import Field
 import numpy as np
@@ -26,7 +26,7 @@ class RandomDetector(CoreDetector):
     def __init__(
         self,
         name: str = "RandomDetector",
-        config: RandomDetectorConfig = RandomDetectorConfig(),
+        config: RandomDetectorConfig | dict[str, Any] = RandomDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = RandomDetectorConfig.from_dict(config, name)
@@ -34,21 +34,21 @@ def __init__(
         self.config: RandomDetectorConfig
 
     @override
-    def train(self, input_: List[schemas.ParserSchema] | schemas.ParserSchema) -> None:
+    def train(self, input_: List[sc.ParserSchema] | sc.ParserSchema) -> None:
         """Training is not applicable for RandomDetector."""
         return
 
     @override
     def detect(
         self,
-        input_: schemas.ParserSchema,  # type: ignore
-        output_: schemas.DetectorSchema,
+        input_: sc.ParserSchema,  # type: ignore
+        output_: sc.DetectorSchema,
     ) -> bool:
         """Detect anomalies randomly in the input data."""
         overall_score = 0.0
         alerts = {}
 
-        event_config = self.config.events[input_["EventID"]]
+        event_config = self.config.events[input_["eventID"]]
         if event_config is None:
             return False
 
@@ -69,7 +69,7 @@ def detect(
 
         if overall_score > 0:
             output_["score"] = overall_score
-            output_["alertsObtain"].update(alerts)
+            output_["alertDetails"].update(alerts)
             return True
 
         return False
diff --git a/src/detectmatelibrary/detectors/rule_detector.py b/src/detectmatelibrary/detectors/rule_detector.py
index 3056fe97..672c8c22 100644
--- a/src/detectmatelibrary/detectors/rule_detector.py
+++ b/src/detectmatelibrary/detectors/rule_detector.py
@@ -20,7 +20,7 @@ def template_rule(
 
 
 def template_not_found(input_: schemas.ParserSchema, *args: list[Any]) -> tuple[bool, str]:
-    raise_alert = input_["EventID"] == -1
+    raise_alert = input_["eventID"] == -1
     message = "No template found by parser"
     return raise_alert, message
 
@@ -40,7 +40,7 @@ def exceptions(input_: schemas.ParserSchema, *args: list[Any]) -> tuple[bool, st
 
 
 def error_log(input_: schemas.ParserSchema, *args: list[Any]) -> tuple[bool, str]:
-    vars_: dict[str, str] = input_["logFormatVariables"]
+    vars_: dict[str, str] = input_["headerVariables"]
     raise_alert = "Level" in vars_ and "error" == vars_["Level"].lower()
     message = "Error found"
     return raise_alert, message
@@ -103,7 +103,7 @@ def detect(
             alert, msg = rules[rule["rule"]](input_, rule["args"])  # type: ignore
 
             if alert:
-                output_["alertsObtain"][rule["rule"]] = msg
+                output_["alertDetails"][rule["rule"]] = msg
                 output_["score"] += 1
 
             anomaly = anomaly or alert
diff --git a/src/detectmatelibrary/detectors/value_range_detector.py b/src/detectmatelibrary/detectors/value_range_detector.py
index 5fda5192..09675eea 100644
--- a/src/detectmatelibrary/detectors/value_range_detector.py
+++ b/src/detectmatelibrary/detectors/value_range_detector.py
@@ -26,7 +26,7 @@ class ValueRangeDetector(VariableDetector):
     def __init__(
         self,
         name: str = "ValueRangeDetector",
-        config: ValueRangeDetectorConfig = ValueRangeDetectorConfig(),
+        config: ValueRangeDetectorConfig | dict[str, Any] = ValueRangeDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = ValueRangeDetectorConfig.from_dict(config, name)
diff --git a/src/detectmatelibrary/helper/from_to.py b/src/detectmatelibrary/helper/from_to.py
index 6ce39c22..00c36572 100644
--- a/src/detectmatelibrary/helper/from_to.py
+++ b/src/detectmatelibrary/helper/from_to.py
@@ -146,7 +146,7 @@ def __generator():  # type: ignore
             for i in range(len(df)):
                 data = df.row(i, named=True)
                 if len(df_vars) > 0:
-                    data["logFormatVariables"] = df_vars.row(i, named=True)
+                    data["headerVariables"] = df_vars.row(i, named=True)
                 data["logID"] = str(i)
                 schema = component.input_schema(data)
                 yield schema
@@ -179,7 +179,7 @@ def __generator():  # type: ignore
                     data = df_batch.row(i, named=True)
                     data_var = batch_vars.row(i, named=True)
                     if len(data_var) > 0:
-                        data["logFormatVariables"] = data_var
+                        data["headerVariables"] = data_var
                     data["logID"] = str(i)
                     schema = component.input_schema(data)
                     yield schema
@@ -266,7 +266,7 @@ def polars(
     ) -> Iterator[BaseSchema]:
 
         renames = {
-            "Content": "log", "ParamList": "variables", "EventIDs": "EventID", "Templates": "template"
+            "Content": "log", "ParamList": "variables", "EventIDs": "eventID", "Templates": "template"
         } if renames is None else renames
         columns = df.columns if isinstance(df, pl.DataFrame) else df.collect_schema().names()
         if "ParamList" not in columns and "ParamList" in renames:
diff --git a/src/detectmatelibrary/helper/select_component.py b/src/detectmatelibrary/helper/select_component.py
new file mode 100644
index 00000000..600be139
--- /dev/null
+++ b/src/detectmatelibrary/helper/select_component.py
@@ -0,0 +1,74 @@
+from detectmatelibrary.common.core import CoreConfig, CoreComponent
+from detectmatelibrary import detectors, parsers, alert_aggregation
+from detectmatelibrary.schemas import BaseSchema
+
+from typing import Optional, Any
+
+# --------------------- Auxiliar
+__types = {
+    "parsers": parsers,
+    "detectors": detectors,
+    "alert_aggregators": alert_aggregation
+}
+
+
+def _find_component_from_type(
+    method_type: str, component_type: str
+) -> Optional[type[CoreComponent[BaseSchema, BaseSchema]]]:
+
+    for obj in dir(module := __types[component_type]):
+        try:
+            if isinstance(conf := getattr(module, obj)(), CoreConfig):  # Look for config
+                if conf.method_type == method_type:
+                    for comp in dir(__types[component_type]):  # Look for Component
+                        try:
+                            if isinstance(comp_ := getattr(module, comp)(), CoreComponent):
+                                if type(comp_.config) == type(conf):  # noqa: E721
+                                    return getattr(module, comp)  # type: ignore
+                        except TypeError:
+                            pass
+        except TypeError:
+            pass
+
+    return None
+
+
+# --------------------------------- Main methods
+def selectComponent(
+    config: CoreConfig | dict[str, Any], component_type: str, name: Optional[str] = None
+) -> CoreComponent:
+    """Component, I pick you!!!
+
+    If name=None, it will check in the config
+    """
+
+    if isinstance(config, CoreConfig):
+        method_type = config.method_type
+        name = name if name is not None else "pickedComponent"
+
+    else:
+        if name is None:
+            name = list(config[component_type].keys())[0]
+
+        method_type = config[component_type][name]["method_type"]
+
+    component = _find_component_from_type(method_type, component_type=component_type)
+    if component is None:
+        raise ValueError(f"{method_type} form {component_type} not found.")
+
+    return component(name=name, config=config)
+
+
+def selectComponents(
+    configs: list[CoreConfig | dict[str, Any]],
+    component_type: str,
+    names: Optional[list[str | None]] = None
+) -> list[CoreComponent]:
+
+    if names is None:
+        names = [None for _ in configs]
+
+    return [
+        selectComponent(config=config, component_type=component_type, name=name)
+        for config, name in zip(configs, names)
+    ]
diff --git a/src/detectmatelibrary/metadata.py b/src/detectmatelibrary/metadata.py
index 4543d24a..8dfd6571 100644
--- a/src/detectmatelibrary/metadata.py
+++ b/src/detectmatelibrary/metadata.py
@@ -1,5 +1,5 @@
 __authors__ = ["André García Gómez", "Viktor Beck", "Thorina Boenke", "Wolfgang Hotwagner", "Anna Erdi",
-               "Ernst Leierzopf", "Leonhard Kaufmann"]
+               "Ernst Leierzopf", "Leonhard Kaufmann", "Lukas Karner"]
 __contact__ = "aecid@ait.ac.at"
 __copyright__ = "Copyright 2026, AIT Austrian Institute of Technology GmbH"
 __date__ = "2026/05/18"
@@ -7,6 +7,6 @@
 __website__ = "https://aecid.ait.ac.at"
 __license__ = "EUPL-1.2"
 __status__ = "Development"
-__version__ = "0.6.1"
+__version__ = "0.6.2"
 __all__ = ['__authors__', '__contact__', '__copyright__', '__date__', '__deprecated__', '__website__',
            '__license__', '__status__', '__version__']
diff --git a/src/detectmatelibrary/parsers/__init__.py b/src/detectmatelibrary/parsers/__init__.py
index e69de29b..889c74ca 100644
--- a/src/detectmatelibrary/parsers/__init__.py
+++ b/src/detectmatelibrary/parsers/__init__.py
@@ -0,0 +1,23 @@
+from .drain import DrainParser, DrainConfig
+from .autoparser import AutoParser, AutoParserConfig
+from .json_parser import JsonParser, JsonParserConfig
+from .tree_matcher import TemplateCppTreeMatcher, TemplateCppTreeMatcherConfig
+# from .logbatcher import LogBatcherParser, LogBatcherParserConfig
+# TODO: logbacther does not pass the mypy
+from .template_matcher import MatcherParser, MatcherParserConfig
+
+
+__all__ = [
+    "DrainParser",
+    "DrainConfig",
+    "AutoParser",
+    "AutoParserConfig",
+    "JsonParser",
+    "JsonParserConfig",
+    "TemplateCppTreeMatcher",
+    "TemplateCppTreeMatcherConfig",
+    # "LogBatcherParser",
+    # "LogBatcherParserConfig",
+    "MatcherParser",
+    "MatcherParserConfig",
+]
diff --git a/src/detectmatelibrary/parsers/autoparser.py b/src/detectmatelibrary/parsers/autoparser.py
index d83093c4..5fefdd25 100644
--- a/src/detectmatelibrary/parsers/autoparser.py
+++ b/src/detectmatelibrary/parsers/autoparser.py
@@ -49,11 +49,11 @@ def post_train(self) -> None:
     def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> None:
 
         if self.tree_match is None:
-            output_["EventID"] = -1
+            output_["eventID"] = -1
             output_["template"] = "templates not yet generated"
         else:
             parsed = self.tree_match.match_log(input_["log"], get_var=True)[0]
 
-            output_["EventID"] = parsed["EventID"]
+            output_["eventID"] = parsed["EventID"]
             output_["variables"].extend(parsed["ParamList"])
             output_["template"] = parsed["Template"]
diff --git a/src/detectmatelibrary/parsers/drain.py b/src/detectmatelibrary/parsers/drain.py
index fbcd75af..17547e3f 100644
--- a/src/detectmatelibrary/parsers/drain.py
+++ b/src/detectmatelibrary/parsers/drain.py
@@ -108,11 +108,11 @@ def post_train(self) -> None:
     def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> None:
 
         if self.tree_match is None:
-            output_["EventID"] = -1
+            output_["eventID"] = -1
             output_["template"] = "templates not yet generated"
         else:
             parsed = self.tree_match.match_log(input_["log"], get_var=True)[0]
 
-            output_["EventID"] = parsed["EventID"]
+            output_["eventID"] = parsed["EventID"]
             output_["variables"].extend(parsed["ParamList"])
             output_["template"] = parsed["Template"]
diff --git a/src/detectmatelibrary/parsers/json_parser.py b/src/detectmatelibrary/parsers/json_parser.py
index f3d9d412..c6519b04 100644
--- a/src/detectmatelibrary/parsers/json_parser.py
+++ b/src/detectmatelibrary/parsers/json_parser.py
@@ -4,6 +4,7 @@
 )
 from detectmatelibrary.common.parser import CoreParser, CoreParserConfig
 from detectmatelibrary.utils.key_extractor import KeyExtractor
+from detectmatelibrary.tools.logging import logger
 from detectmatelibrary import schemas
 
 from collections.abc import Mapping
@@ -11,6 +12,9 @@
 import json
 from pydantic import Field
 
+# eventID of a log without a message field (-1 is a message that matches no template)
+NO_MESSAGE_EVENT_ID = -2
+
 
 def iter_flatten(obj: dict[str, Any], sep: str = ".") -> Iterable[tuple[str, Any]]:
     """Iteratively flattens a nested dict/list JSON-like object. Yields
@@ -74,8 +78,12 @@ def __init__(
             )
             self.content_parser = MatcherParser(config=content_parser_config)
             config = cfg_dict
+        else:
+            # a config object cannot define the content parser: use one without templates
+            self.content_parser = MatcherParser()
         super().__init__(name=name, config=config)
         self.config: JsonParserConfig
+        self._warn_no_templates = self.content_parser.config.path_templates is None
 
         self.time_extractor = KeyExtractor(key_substr=config.timestamp_name)
         self.content_extractor = KeyExtractor(key_substr=config.content_name)
@@ -86,22 +94,28 @@ def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> Non
         timestamp = self.time_extractor.extract(obj=log, delete=True)
         content = self.content_extractor.extract(obj=log, delete=True)
 
-        parsed = {"EventTemplate": "", "Params": [], "EventId": 0}
+        parsed = {"EventTemplate": "", "Params": [], "EventId": NO_MESSAGE_EVENT_ID}
         # if the json also contains a message field, parse it for template and parameters
         if content:
+            if self._warn_no_templates:
+                logger.warning(
+                    f"<<{self.name}>> the content parser has no templates, so every message gets "
+                    "eventID -1. Define the content parser with path_templates in a config dict."
+                )
+                self._warn_no_templates = False
             log_ = schemas.LogSchema({"log": content})
             parsed_content = self.content_parser.process(log_)
             parsed["EventTemplate"] = parsed_content["template"]  # type: ignore
             parsed["Params"] = parsed_content["variables"]  # type: ignore
-            parsed["EventId"] = parsed_content["EventID"]  # type: ignore
+            parsed["EventId"] = parsed_content["eventID"]  # type: ignore
 
         log_flat = flatten_dict(log)
-        output_["logFormatVariables"].clear()  # ensure it's empty before updating
-        output_["logFormatVariables"].update({k: str(v) for k, v in log_flat.items()})
+        output_["headerVariables"].clear()  # ensure it's empty before updating
+        output_["headerVariables"].update({k: str(v) for k, v in log_flat.items()})
         time = self.time_format_handler.parse_timestamp(
             str(timestamp), self.config.time_format
         )
-        output_["logFormatVariables"].update({"Time": time})
+        output_["headerVariables"].update({"Time": time})
         output_["template"] = parsed["EventTemplate"]
         output_["variables"].extend(parsed["Params"])
-        output_["EventID"] = parsed["EventId"]
+        output_["eventID"] = parsed["EventId"]
diff --git a/src/detectmatelibrary/parsers/logbatcher/parser.py b/src/detectmatelibrary/parsers/logbatcher/parser.py
index ecfecdd7..2c6a51de 100644
--- a/src/detectmatelibrary/parsers/logbatcher/parser.py
+++ b/src/detectmatelibrary/parsers/logbatcher/parser.py
@@ -73,4 +73,4 @@ def parse(
 
         output_["template"] = template
         output_["variables"].extend(list(variables))
-        output_["EventID"] = event_id
+        output_["eventID"] = event_id
diff --git a/src/detectmatelibrary/parsers/template_matcher/_parser.py b/src/detectmatelibrary/parsers/template_matcher/_parser.py
index 8565cf32..7e74bbdc 100644
--- a/src/detectmatelibrary/parsers/template_matcher/_parser.py
+++ b/src/detectmatelibrary/parsers/template_matcher/_parser.py
@@ -159,4 +159,4 @@ def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> Non
 
         output_["template"] = parsed["EventTemplate"]
         output_["variables"] = parsed["Params"]
-        output_["EventID"] = parsed["EventId"]
+        output_["eventID"] = parsed["EventId"]
diff --git a/src/detectmatelibrary/parsers/tree_matcher.py b/src/detectmatelibrary/parsers/tree_matcher.py
index fbdf185d..c6a3a299 100644
--- a/src/detectmatelibrary/parsers/tree_matcher.py
+++ b/src/detectmatelibrary/parsers/tree_matcher.py
@@ -38,6 +38,6 @@ def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> Non
 
         parsed = self.tree.match_log(input_["log"], get_var=True)[0]
 
-        output_["EventID"] = parsed["EventID"]
+        output_["eventID"] = parsed["EventID"]
         output_["variables"].extend(parsed["ParamList"])
         output_["template"] = parsed["Template"]
diff --git a/src/detectmatelibrary/pipeline.py b/src/detectmatelibrary/pipeline.py
new file mode 100644
index 00000000..c8d46e44
--- /dev/null
+++ b/src/detectmatelibrary/pipeline.py
@@ -0,0 +1,174 @@
+
+from detectmatelibrary.common.core import CoreComponent, CoreConfig
+
+from detectmatelibrary.common.alert_aggregator import CoreAlertAggregator, CoreAlertAggregatorConfig
+from detectmatelibrary.common.detector import CoreDetector, CoreDetectorConfig
+from detectmatelibrary.common.parser import CoreParser, CoreParserConfig
+
+from detectmatelibrary.utils.data_buffer import ArgsBuffer, BufferMode
+import detectmatelibrary.helper.select_component as selc
+
+import detectmatelibrary.schemas as sc
+
+from concurrent.futures import ThreadPoolExecutor
+
+from typing import Any, overload, Optional, override
+from pydantic import Field
+
+
+class PipelineConfig(CoreConfig):
+    component_type: str = Field(default="main_pipeline", description="<$IGNORE$>")
+    method_type: str = Field(default="pipeline", description="<$IGNORE$>")
+
+    do_parsing: bool = Field(default=True, description="Run parser in the pipeline.")
+    do_aggregation: bool = Field(default=True, description="Run aggregator in the pipeline.")
+    n_workers: int = Field(default=1, description="Workers use to run the detectors in parallel.")
+
+    parser: CoreParserConfig | dict[str, Any] | None = Field(
+        default=None, description="Parser configuration use, if do_parsing=False keep empty."
+    )
+    detectors: list[CoreDetectorConfig | dict[str, Any]] | None = Field(
+        default=None, description="Detectors configuration use."
+    )
+    aggregator: CoreAlertAggregatorConfig | dict[str, Any] | None = Field(
+        default=None, description="Aggregator configuration use, if do_aggregation=False keep empty."
+    )
+
+# ------------- Auxiliar methods
+
+
+def _select_input(config: PipelineConfig) -> type[sc.BaseSchema]:
+    return sc.LogSchema if config.do_parsing else sc.ParserSchema
+
+
+def _select_output(config: PipelineConfig) -> type[sc.BaseSchema]:
+    return sc.DetectorSchema if config.do_aggregation else sc.AggregateSchema
+
+
+def _check_output(in_: sc.BaseSchema, method: CoreComponent) -> Optional[bytes | sc.BaseSchema]:
+    return method.process(in_)
+
+
+def _multiprocess(
+    methods: list[CoreComponent], in_: sc.BaseSchema, n_workers: int = 4
+) -> list[sc.BaseSchema]:
+
+    with ThreadPoolExecutor(max_workers=n_workers) as executor:
+        outputs = list(executor.map(lambda fn: _check_output(in_, fn), methods))
+
+    return list(filter(lambda x: x is not None, outputs))  # type: ignore
+
+
+def _run_pipeline(
+    config: PipelineConfig,
+    input_: sc.ParserSchema | bytes | sc.LogSchema,
+    parser: Optional[CoreParser],
+    detectors: list[CoreDetector],
+    alert_aggreator: Optional[CoreAlertAggregator],
+    n_workers: int = 1,
+) -> list[sc.DetectorSchema] | list[sc.AggregateSchema]:
+
+    input_ = input_ if isinstance(input_, list) else [input_]  # type: ignore
+    if config.do_parsing:
+        aux = []
+        for in_ in input_:  # type: ignore
+            if (out_ := _check_output(in_, parser)) is not None:  # type: ignore
+                aux.append(out_)
+        input_ = aux   # type: ignore
+
+    output_ = []
+    for in_ in input_:  # type: ignore
+        if n_workers > 1:
+            output_.extend(_multiprocess(detectors, in_=in_, n_workers=n_workers))  # type: ignore
+        else:
+            for detector in detectors:
+                if (out_ := _check_output(in_, detector)) is not None:  # type: ignore
+                    output_.append(out_)  # type: ignore
+
+    if not config.do_aggregation:
+        return output_   # type: ignore
+
+    last_output_ = []
+    for in_ in output_:
+        if (out_ := _check_output(in_, alert_aggreator)) is not None:  # type: ignore
+            last_output_.append(out_)
+
+    return last_output_  # type: ignore
+
+
+# ------------- Nain pipeline
+
+class Pipeline(CoreComponent):
+    def __init__(
+        self,
+        name: str = "MainPipeline",
+        config: PipelineConfig | dict[str, Any] = PipelineConfig(),
+    ) -> None:
+        if isinstance(config, dict):
+            config = PipelineConfig.from_dict(config, name)
+
+        super().__init__(
+            name=name,
+            type_=config.method_type,
+            config=config,
+            args_buffer=ArgsBuffer(mode=BufferMode.NO_BUF, size=None),
+            input_schema=_select_input(config),
+            output_schema=_select_output(config),
+        )
+        self.config: PipelineConfig
+
+        self.parser: CoreParser | None = selc.selectComponent(  # type: ignore
+            self.config.parser, component_type="parsers"
+        ) if self.config.do_parsing else None
+
+        self.detectors: list[CoreDetector] = selc.selectComponents(  # type: ignore
+            self.config.detectors, component_type="detectors"
+        )
+
+        self.alert_aggregator: CoreAlertAggregator | None = selc.selectComponent(  # type: ignore
+            self.config.aggregator, component_type="alert_aggregators"
+        ) if self.config.do_aggregation else None
+
+    @overload  # type: ignore
+    @override
+    def process(self, data: sc.LogSchema | bytes) -> sc.AggregateSchema | bytes | None:  # type: ignore
+        pass
+
+    @override
+    @overload
+    def process(  # type: ignore
+        self, data: sc.LogSchema | bytes
+    ) -> sc.DetectorSchema | bytes | None | list[sc.DetectorSchema] | list[bytes]:
+        pass
+
+    @overload
+    @override
+    def process(self, data: sc.ParserSchema | bytes) -> sc.AggregateSchema | bytes | None:
+        pass
+
+    @overload
+    @override
+    def process(  # type: ignore
+        self, data: sc.ParserSchema | bytes
+    ) -> sc.DetectorSchema | bytes | None | list[sc.DetectorSchema] | list[bytes]:
+        pass
+
+    @override
+    def process(
+        self, data: sc.ParserSchema | bytes | sc.LogSchema
+    ) -> sc.DetectorSchema | bytes | None | list[sc.DetectorSchema] | list[bytes] | sc.AggregateSchema:
+
+        out_ = _run_pipeline(
+            self.config,
+            input_=data,
+            parser=self.parser,
+            detectors=self.detectors,
+            alert_aggreator=self.alert_aggregator,
+            n_workers=self.config.n_workers,
+        )
+
+        if len(out_) == 0:
+            return None
+        if len(out_) == 1:
+            return out_[0]
+        return out_  # type: ignore
diff --git a/src/detectmatelibrary/schemas/_op.py b/src/detectmatelibrary/schemas/_op.py
index d2c92015..7c2f97c3 100644
--- a/src/detectmatelibrary/schemas/_op.py
+++ b/src/detectmatelibrary/schemas/_op.py
@@ -15,7 +15,7 @@
 DETECTOR_SCHEMA: SchemaT = s.DetectorSchema  # type: ignore
 AGGREGATE_SCHEMA: SchemaT = s.AggregateSchema  # type: ignore
 
-__current_version = "1.0.0"
+__current_version = "2.0.0"
 
 
 #  Exceptions ****************************************
diff --git a/src/detectmatelibrary/schemas/schemas.proto b/src/detectmatelibrary/schemas/schemas.proto
index 95459477..fda74cc3 100644
--- a/src/detectmatelibrary/schemas/schemas.proto
+++ b/src/detectmatelibrary/schemas/schemas.proto
@@ -16,13 +16,13 @@ message ParserSchema {
     optional string __version__ = 1;
     optional string parserType = 2;
     optional string parserID = 3;
-    optional int32 EventID = 4;
+    optional int32 eventID = 4;
     optional string template = 5;
     repeated string variables = 6;
     optional string parsedLogID = 7;
     optional string logID = 8;
     optional string log = 9;
-    map<string, string> logFormatVariables = 10;
+    map<string, string> headerVariables = 10;
     optional int64 receivedTimestamp = 11;
     optional int64 parsedTimestamp = 12;
 }
@@ -32,13 +32,13 @@ message DetectorSchema {
     optional string detectorID = 2;
     optional string detectorType = 3;
     optional string alertID = 4;
-    optional int64 detectionTimestamp = 5;
+    optional int64 detectedTimestamp = 5;
     repeated string logIDs = 6;
     optional float score = 8;
-    repeated int64 extractedTimestamps = 9;
+    repeated int64 logTimestamps = 9;
     optional string description = 10;
     optional int64 receivedTimestamp = 11;
-    map<string, string> alertsObtain = 12;
+    map<string, string> alertDetails = 12;
 }
 
 message AggregateSchema {
@@ -46,9 +46,9 @@ message AggregateSchema {
     repeated string detectorIDs = 2;
     repeated string detectorTypes = 3;
     repeated string alertIDs = 4;
-    optional int64 outputTimestamp = 5;
+    optional int64 aggregatedTimestamp = 5;
     repeated string logIDs = 6;
-    repeated int64 extractedTimestamps = 9;
+    repeated int64 logTimestamps = 9;
     optional string description = 10;
-    map<string, string> alertsObtain = 12;
+    map<string, string> alertDetails = 12;
 }
diff --git a/src/detectmatelibrary/schemas/schemas_pb2.py b/src/detectmatelibrary/schemas/schemas_pb2.py
index fd62de35..5874c4af 100644
--- a/src/detectmatelibrary/schemas/schemas_pb2.py
+++ b/src/detectmatelibrary/schemas/schemas_pb2.py
@@ -13,33 +13,33 @@
 
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\rschemas.proto\"\x1d\n\x06Schema\x12\x13\n\x0b__version__\x18\x01 \x01(\t\"\xb7\x01\n\tLogSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05logID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x10\n\x03log\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x16\n\tlogSource\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x15\n\x08hostname\x18\x05 \x01(\tH\x04\x88\x01\x01\x42\x0e\n\x0cX__version__B\x08\n\x06_logIDB\x06\n\x04_logB\x0c\n\n_logSourceB\x0b\n\t_hostname\"\xa5\x04\n\x0cParserSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\nparserType\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x15\n\x08parserID\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x45ventID\x18\x04 \x01(\x05H\x03\x88\x01\x01\x12\x15\n\x08template\x18\x05 \x01(\tH\x04\x88\x01\x01\x12\x11\n\tvariables\x18\x06 \x03(\t\x12\x18\n\x0bparsedLogID\x18\x07 \x01(\tH\x05\x88\x01\x01\x12\x12\n\x05logID\x18\x08 \x01(\tH\x06\x88\x01\x01\x12\x10\n\x03log\x18\t \x01(\tH\x07\x88\x01\x01\x12\x41\n\x12logFormatVariables\x18\n \x03(\x0b\x32%.ParserSchema.LogFormatVariablesEntry\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x08\x88\x01\x01\x12\x1c\n\x0fparsedTimestamp\x18\x0c \x01(\x03H\t\x88\x01\x01\x1a\x39\n\x17LogFormatVariablesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\r\n\x0b_parserTypeB\x0b\n\t_parserIDB\n\n\x08_EventIDB\x0b\n\t_templateB\x0e\n\x0c_parsedLogIDB\x08\n\x06_logIDB\x06\n\x04_logB\x14\n\x12_receivedTimestampB\x12\n\x10_parsedTimestamp\"\x81\x04\n\x0e\x44\x65tectorSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\ndetectorID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x19\n\x0c\x64\x65tectorType\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x61lertID\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x1f\n\x12\x64\x65tectionTimestamp\x18\x05 \x01(\x03H\x04\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x12\n\x05score\x18\x08 \x01(\x02H\x05\x88\x01\x01\x12\x1b\n\x13\x65xtractedTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x06\x88\x01\x01\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x07\x88\x01\x01\x12\x37\n\x0c\x61lertsObtain\x18\x0c \x03(\x0b\x32!.DetectorSchema.AlertsObtainEntry\x1a\x33\n\x11\x41lertsObtainEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\r\n\x0b_detectorIDB\x0f\n\r_detectorTypeB\n\n\x08_alertIDB\x15\n\x13_detectionTimestampB\x08\n\x06_scoreB\x0e\n\x0c_descriptionB\x14\n\x12_receivedTimestamp\"\xf1\x02\n\x0f\x41ggregateSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x13\n\x0b\x64\x65tectorIDs\x18\x02 \x03(\t\x12\x15\n\rdetectorTypes\x18\x03 \x03(\t\x12\x10\n\x08\x61lertIDs\x18\x04 \x03(\t\x12\x1c\n\x0foutputTimestamp\x18\x05 \x01(\x03H\x01\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x1b\n\x13\x65xtractedTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x02\x88\x01\x01\x12\x38\n\x0c\x61lertsObtain\x18\x0c \x03(\x0b\x32\".AggregateSchema.AlertsObtainEntry\x1a\x33\n\x11\x41lertsObtainEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\x12\n\x10_outputTimestampB\x0e\n\x0c_descriptionb\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\rschemas.proto\"\x1d\n\x06Schema\x12\x13\n\x0b__version__\x18\x01 \x01(\t\"\xb7\x01\n\tLogSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05logID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x10\n\x03log\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x16\n\tlogSource\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x15\n\x08hostname\x18\x05 \x01(\tH\x04\x88\x01\x01\x42\x0e\n\x0cX__version__B\x08\n\x06_logIDB\x06\n\x04_logB\x0c\n\n_logSourceB\x0b\n\t_hostname\"\x9c\x04\n\x0cParserSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\nparserType\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x15\n\x08parserID\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x65ventID\x18\x04 \x01(\x05H\x03\x88\x01\x01\x12\x15\n\x08template\x18\x05 \x01(\tH\x04\x88\x01\x01\x12\x11\n\tvariables\x18\x06 \x03(\t\x12\x18\n\x0bparsedLogID\x18\x07 \x01(\tH\x05\x88\x01\x01\x12\x12\n\x05logID\x18\x08 \x01(\tH\x06\x88\x01\x01\x12\x10\n\x03log\x18\t \x01(\tH\x07\x88\x01\x01\x12;\n\x0fheaderVariables\x18\n \x03(\x0b\x32\".ParserSchema.HeaderVariablesEntry\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x08\x88\x01\x01\x12\x1c\n\x0fparsedTimestamp\x18\x0c \x01(\x03H\t\x88\x01\x01\x1a\x36\n\x14HeaderVariablesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\r\n\x0b_parserTypeB\x0b\n\t_parserIDB\n\n\x08_eventIDB\x0b\n\t_templateB\x0e\n\x0c_parsedLogIDB\x08\n\x06_logIDB\x06\n\x04_logB\x14\n\x12_receivedTimestampB\x12\n\x10_parsedTimestamp\"\xf9\x03\n\x0e\x44\x65tectorSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\ndetectorID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x19\n\x0c\x64\x65tectorType\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x61lertID\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x1e\n\x11\x64\x65tectedTimestamp\x18\x05 \x01(\x03H\x04\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x12\n\x05score\x18\x08 \x01(\x02H\x05\x88\x01\x01\x12\x15\n\rlogTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x06\x88\x01\x01\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x07\x88\x01\x01\x12\x37\n\x0c\x61lertDetails\x18\x0c \x03(\x0b\x32!.DetectorSchema.AlertDetailsEntry\x1a\x33\n\x11\x41lertDetailsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\r\n\x0b_detectorIDB\x0f\n\r_detectorTypeB\n\n\x08_alertIDB\x14\n\x12_detectedTimestampB\x08\n\x06_scoreB\x0e\n\x0c_descriptionB\x14\n\x12_receivedTimestamp\"\xf3\x02\n\x0f\x41ggregateSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x13\n\x0b\x64\x65tectorIDs\x18\x02 \x03(\t\x12\x15\n\rdetectorTypes\x18\x03 \x03(\t\x12\x10\n\x08\x61lertIDs\x18\x04 \x03(\t\x12 \n\x13\x61ggregatedTimestamp\x18\x05 \x01(\x03H\x01\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x15\n\rlogTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x02\x88\x01\x01\x12\x38\n\x0c\x61lertDetails\x18\x0c \x03(\x0b\x32\".AggregateSchema.AlertDetailsEntry\x1a\x33\n\x11\x41lertDetailsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\x16\n\x14_aggregatedTimestampB\x0e\n\x0c_descriptionb\x06proto3')
 
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, globals())
 _builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'schemas_pb2', globals())
 if _descriptor._USE_C_DESCRIPTORS == False:
 
   DESCRIPTOR._options = None
-  _PARSERSCHEMA_LOGFORMATVARIABLESENTRY._options = None
-  _PARSERSCHEMA_LOGFORMATVARIABLESENTRY._serialized_options = b'8\001'
-  _DETECTORSCHEMA_ALERTSOBTAINENTRY._options = None
-  _DETECTORSCHEMA_ALERTSOBTAINENTRY._serialized_options = b'8\001'
-  _AGGREGATESCHEMA_ALERTSOBTAINENTRY._options = None
-  _AGGREGATESCHEMA_ALERTSOBTAINENTRY._serialized_options = b'8\001'
+  _PARSERSCHEMA_HEADERVARIABLESENTRY._options = None
+  _PARSERSCHEMA_HEADERVARIABLESENTRY._serialized_options = b'8\001'
+  _DETECTORSCHEMA_ALERTDETAILSENTRY._options = None
+  _DETECTORSCHEMA_ALERTDETAILSENTRY._serialized_options = b'8\001'
+  _AGGREGATESCHEMA_ALERTDETAILSENTRY._options = None
+  _AGGREGATESCHEMA_ALERTDETAILSENTRY._serialized_options = b'8\001'
   _SCHEMA._serialized_start=17
   _SCHEMA._serialized_end=46
   _LOGSCHEMA._serialized_start=49
   _LOGSCHEMA._serialized_end=232
   _PARSERSCHEMA._serialized_start=235
-  _PARSERSCHEMA._serialized_end=784
-  _PARSERSCHEMA_LOGFORMATVARIABLESENTRY._serialized_start=582
-  _PARSERSCHEMA_LOGFORMATVARIABLESENTRY._serialized_end=639
-  _DETECTORSCHEMA._serialized_start=787
-  _DETECTORSCHEMA._serialized_end=1300
-  _DETECTORSCHEMA_ALERTSOBTAINENTRY._serialized_start=1118
-  _DETECTORSCHEMA_ALERTSOBTAINENTRY._serialized_end=1169
-  _AGGREGATESCHEMA._serialized_start=1303
-  _AGGREGATESCHEMA._serialized_end=1672
-  _AGGREGATESCHEMA_ALERTSOBTAINENTRY._serialized_start=1118
-  _AGGREGATESCHEMA_ALERTSOBTAINENTRY._serialized_end=1169
+  _PARSERSCHEMA._serialized_end=775
+  _PARSERSCHEMA_HEADERVARIABLESENTRY._serialized_start=576
+  _PARSERSCHEMA_HEADERVARIABLESENTRY._serialized_end=630
+  _DETECTORSCHEMA._serialized_start=778
+  _DETECTORSCHEMA._serialized_end=1283
+  _DETECTORSCHEMA_ALERTDETAILSENTRY._serialized_start=1102
+  _DETECTORSCHEMA_ALERTDETAILSENTRY._serialized_end=1153
+  _AGGREGATESCHEMA._serialized_start=1286
+  _AGGREGATESCHEMA._serialized_end=1657
+  _AGGREGATESCHEMA_ALERTDETAILSENTRY._serialized_start=1102
+  _AGGREGATESCHEMA_ALERTDETAILSENTRY._serialized_end=1153
 # @@protoc_insertion_point(module_scope)
diff --git a/src/detectmatelibrary/tools/workspace/templates/CustomAlertAggregator.py b/src/detectmatelibrary/tools/workspace/templates/CustomAlertAggregator.py
index fdfa9d4b..f691f5ba 100644
--- a/src/detectmatelibrary/tools/workspace/templates/CustomAlertAggregator.py
+++ b/src/detectmatelibrary/tools/workspace/templates/CustomAlertAggregator.py
@@ -1,8 +1,9 @@
 from detectmatelibrary.common.alert_aggregator import (CoreAlertAggregatorConfig, CoreAlertAggregator)
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
-from typing import Any, Optional
 from detectmatelibrary.helper.from_to import From
 
+from typing import Any
+
 
 class CustomAlertAggregatorConfig(CoreAlertAggregatorConfig):
     method_type: str = "custom_alert_aggregator"
@@ -13,18 +14,18 @@ class CustomAlertAggregator(CoreAlertAggregator):
     def __init__(
         self,
         name: str = "CustomAlertAggregator",
-        config: Optional[CustomAlertAggregatorConfig | dict[str, Any]] = CustomAlertAggregatorConfig(),
+        config: CustomAlertAggregatorConfig | dict[str, Any] = CustomAlertAggregatorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = CustomAlertAggregatorConfig.from_dict(config, name)
-        buffer_size: int = config.buffer_size  # type: ignore
+        buffer_size: int = config.buffer_size
         super().__init__(name=name, buffer_size=buffer_size, config=config)
 
     def aggregate_alerts(
         self, input_: list[DetectorSchema] | DetectorSchema, output_: AggregateSchema
     ) -> bool:
         output_["description"] = "Custom alert aggregation"
-        output_["alertsObtain"]["type"] = "Anomalies aggregated by CustomAlertAggregator"
+        output_["alertDetails"]["type"] = "Anomalies aggregated by CustomAlertAggregator"
         return True
 
 
diff --git a/src/detectmatelibrary/tools/workspace/templates/CustomDetector.py b/src/detectmatelibrary/tools/workspace/templates/CustomDetector.py
index c36aea09..d8aeff82 100644
--- a/src/detectmatelibrary/tools/workspace/templates/CustomDetector.py
+++ b/src/detectmatelibrary/tools/workspace/templates/CustomDetector.py
@@ -48,7 +48,7 @@ def detect(
         result = pattern[self._call_count % len(pattern)]
         if result:
             output_["score"] = 1.0  # Score of the detector
-            output_["alertsObtain"]["type"] = "Anomaly detected by CustomDetector"  # Additional info
+            output_["alertDetails"]["type"] = "Anomaly detected by CustomDetector"  # Additional info
         return result
 
 
diff --git a/src/detectmatelibrary/tools/workspace/templates/CustomParser.py b/src/detectmatelibrary/tools/workspace/templates/CustomParser.py
index fd7f98a4..164ad9ea 100644
--- a/src/detectmatelibrary/tools/workspace/templates/CustomParser.py
+++ b/src/detectmatelibrary/tools/workspace/templates/CustomParser.py
@@ -38,7 +38,7 @@ def parse(
             place
         """
         # Dummy implementation example (replace with real logic)
-        output_["EventID"] = 2  # Number of the log template
+        output_["eventID"] = 2  # Number of the log template
         output_["variables"].extend(["dummy_variable"])  # Variables found in the log
         output_["template"] = "This is a dummy template"  # Log template
 
diff --git a/src/detectmatelibrary/tools/workspace/templates/data/alerts.json b/src/detectmatelibrary/tools/workspace/templates/data/alerts.json
index cc8fd2e2..4fdacde4 100644
--- a/src/detectmatelibrary/tools/workspace/templates/data/alerts.json
+++ b/src/detectmatelibrary/tools/workspace/templates/data/alerts.json
@@ -1,192 +1,192 @@
 {
   "0": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_10",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["0"],
     "score": 1,
-    "extractedTimestamps": [1642723741],
+    "logTimestamps": [1642723741],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
   },
   "1": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_11",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["1"],
     "score": 1,
-    "extractedTimestamps": [1642723741],
+    "logTimestamps": [1642723741],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
   },
   "2": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_12",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["2"],
     "score": 1,
-    "extractedTimestamps": [1642723741],
+    "logTimestamps": [1642723741],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
   },
   "3": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_13",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["3"],
     "score": 1,
-    "extractedTimestamps": [1642723741],
+    "logTimestamps": [1642723741],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
   },
   "4": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_14",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["4"],
     "score": 1,
-    "extractedTimestamps": [1642723741],
+    "logTimestamps": [1642723741],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
   },
   "5": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_15",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["5"],
     "score": 1,
-    "extractedTimestamps": [1642723741],
+    "logTimestamps": [1642723741],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
   },
   "6": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_16",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["6"],
     "score": 1,
-    "extractedTimestamps": [1642723752],
+    "logTimestamps": [1642723752],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
   },
   "7": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_17",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["7"],
     "score": 1,
-    "extractedTimestamps": [1642723752],
+    "logTimestamps": [1642723752],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
   },
   "8": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_18",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["8"],
     "score": 1,
-    "extractedTimestamps": [1642724221],
+    "logTimestamps": [1642724221],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
   },
   "9": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_19",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["9"],
     "score": 1,
-    "extractedTimestamps": [1642724221],
+    "logTimestamps": [1642724221],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
   },
   "10": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_20",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["10"],
     "score": 1,
-    "extractedTimestamps": [1642724221],
+    "logTimestamps": [1642724221],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
   },
   "11": {
-    "__version__": "1.0.0",
+    "__version__": "2.0.0",
     "detectorID": "MyCoolThing",
     "detectorType": "MyCoolThing_detector",
     "alertID": "MyCoolThing_21",
-    "detectionTimestamp": 1790969620,
+    "detectedTimestamp": 1790969620,
     "logIDs": ["11"],
     "score": 1,
-    "extractedTimestamps": [1642724221],
+    "logTimestamps": [1642724221],
     "description": "Dummy detection process",
     "receivedTimestamp": 1790969620,
-    "alertsObtain": {
+    "alertDetails": {
       "key": "type",
       "value": "Anomaly detected by MyCoolThing"
     }
diff --git a/src/detectmatelibrary/tools/workspace/templates/data/logs.json b/src/detectmatelibrary/tools/workspace/templates/data/logs.json
index bdcda278..f646e103 100644
--- a/src/detectmatelibrary/tools/workspace/templates/data/logs.json
+++ b/src/detectmatelibrary/tools/workspace/templates/data/logs.json
@@ -1,84 +1,84 @@
 {
     "0": {
         "log": "type=USER_ACCT msg=audit(1642723741.072:375): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "0"
     },
     "1": {
         "log": "type=CRED_ACQ msg=audit(1642723741.072:376): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "1"
     },
     "2": {
         "log": "type=LOGIN msg=audit(1642723741.076:377): pid=10125 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=65 res=1",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "2"
     },
     "3": {
         "log": "type=USER_START msg=audit(1642723741.080:378): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "3"
     },
     "4": {
         "log": "type=CRED_DISP msg=audit(1642723741.084:379): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "4"
     },
     "5": {
         "log": "type=USER_END msg=audit(1642723741.084:380): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "5"
     },
     "6": {
         "log": "type=SERVICE_START msg=audit(1642723752.624:381): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "6"
     },
     "7": {
         "log": "type=SERVICE_STOP msg=audit(1642723752.624:382): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "7"
     },
     "8": {
         "log": "type=USER_ACCT msg=audit(1642724221.094:383): pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "8"
     },
     "9": {
         "log": "type=CRED_ACQ msg=audit(1642724221.098:384): pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "9"
     },
     "10": {
         "log": "type=LOGIN msg=audit(1642724221.098:385): pid=10197 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=66 res=1",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "10"
     },
     "11": {
         "log": "type=USER_START msg=audit(1642724221.102:386): pid=10197 uid=0 auid=0 ses=66 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "11"
diff --git a/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json b/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json
index 412fd631..2e5d6d8b 100644
--- a/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json
+++ b/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json
@@ -4,13 +4,13 @@
         "parsedLogID": "10",
         "logID": "0",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "USER_ACCT",
             "Serial": "375",
             "Time": "1642723741.072",
             "Content": "pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -27,7 +27,7 @@
         ],
         "log": "type=USER_ACCT msg=audit(1642723741.072:375): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "1": {
@@ -35,13 +35,13 @@
         "parsedLogID": "11",
         "logID": "1",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "CRED_ACQ",
             "Serial": "376",
             "Time": "1642723741.072",
             "Content": "pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -58,7 +58,7 @@
         ],
         "log": "type=CRED_ACQ msg=audit(1642723741.072:376): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "2": {
@@ -66,13 +66,13 @@
         "parsedLogID": "12",
         "logID": "2",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "LOGIN",
             "Serial": "377",
             "Time": "1642723741.076",
             "Content": "pid=10125 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=65 res=1"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -86,7 +86,7 @@
         ],
         "log": "type=LOGIN msg=audit(1642723741.076:377): pid=10125 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=65 res=1",
         "parserType": "matcher_parser",
-        "EventID": 2,
+        "eventID": 2,
         "template": "pid=<*> uid=<*> old-auid=<*> auid=<*> tty=<*> old-ses=<*> ses=<*> res=<*>"
     },
     "3": {
@@ -94,13 +94,13 @@
         "parsedLogID": "13",
         "logID": "3",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "USER_START",
             "Serial": "378",
             "Time": "1642723741.080",
             "Content": "pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -117,7 +117,7 @@
         ],
         "log": "type=USER_START msg=audit(1642723741.080:378): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "4": {
@@ -125,13 +125,13 @@
         "parsedLogID": "14",
         "logID": "4",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "CRED_DISP",
             "Serial": "379",
             "Time": "1642723741.084",
             "Content": "pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -148,7 +148,7 @@
         ],
         "log": "type=CRED_DISP msg=audit(1642723741.084:379): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "5": {
@@ -156,13 +156,13 @@
         "parsedLogID": "15",
         "logID": "5",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "USER_END",
             "Serial": "380",
             "Time": "1642723741.084",
             "Content": "pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -179,7 +179,7 @@
         ],
         "log": "type=USER_END msg=audit(1642723741.084:380): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "6": {
@@ -187,13 +187,13 @@
         "parsedLogID": "16",
         "logID": "6",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "SERVICE_START",
             "Serial": "381",
             "Time": "1642723752.624",
             "Content": "pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "1",
@@ -210,7 +210,7 @@
         ],
         "log": "type=SERVICE_START msg=audit(1642723752.624:381): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'",
         "parserType": "matcher_parser",
-        "EventID": 1,
+        "eventID": 1,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='unit=<*> comm=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "7": {
@@ -218,13 +218,13 @@
         "parsedLogID": "17",
         "logID": "7",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "SERVICE_STOP",
             "Serial": "382",
             "Time": "1642723752.624",
             "Content": "pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "1",
@@ -241,7 +241,7 @@
         ],
         "log": "type=SERVICE_STOP msg=audit(1642723752.624:382): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'",
         "parserType": "matcher_parser",
-        "EventID": 1,
+        "eventID": 1,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='unit=<*> comm=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "8": {
@@ -249,13 +249,13 @@
         "parsedLogID": "18",
         "logID": "8",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "USER_ACCT",
             "Serial": "383",
             "Time": "1642724221.094",
             "Content": "pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
@@ -272,7 +272,7 @@
         ],
         "log": "type=USER_ACCT msg=audit(1642724221.094:383): pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "9": {
@@ -280,13 +280,13 @@
         "parsedLogID": "19",
         "logID": "9",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "CRED_ACQ",
             "Serial": "384",
             "Time": "1642724221.098",
             "Content": "pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
@@ -303,7 +303,7 @@
         ],
         "log": "type=CRED_ACQ msg=audit(1642724221.098:384): pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "10": {
@@ -311,13 +311,13 @@
         "parsedLogID": "20",
         "logID": "10",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "LOGIN",
             "Serial": "385",
             "Time": "1642724221.098",
             "Content": "pid=10197 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=66 res=1"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
@@ -331,7 +331,7 @@
         ],
         "log": "type=LOGIN msg=audit(1642724221.098:385): pid=10197 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=66 res=1",
         "parserType": "matcher_parser",
-        "EventID": 2,
+        "eventID": 2,
         "template": "pid=<*> uid=<*> old-auid=<*> auid=<*> tty=<*> old-ses=<*> ses=<*> res=<*>"
     },
     "11": {
@@ -339,13 +339,13 @@
         "parsedLogID": "21",
         "logID": "11",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "USER_START",
             "Serial": "386",
             "Time": "1642724221.102",
             "Content": "pid=10197 uid=0 auid=0 ses=66 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
@@ -362,7 +362,7 @@
         ],
         "log": "type=USER_START msg=audit(1642724221.102:386): pid=10197 uid=0 auid=0 ses=66 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     }
 }
\ No newline at end of file
diff --git a/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomAlertAggregator.py b/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomAlertAggregator.py
index ff111148..ac7ceaa2 100644
--- a/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomAlertAggregator.py
+++ b/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomAlertAggregator.py
@@ -39,11 +39,12 @@ def test_run_aggregate_alerts_method(self) -> None:
             output = alert_aggregator.process(data)
             if i % 3 == 2:
                 assert getattr(output, "description") == "Custom alert aggregation"
-                assert getattr(output, "detectorIDs") == ["MyCoolThing"]*3
-                assert getattr(output, "alertsObtain")["type"] == \
+                assert getattr(output, "detectorIDs") == ["MyCoolThing"]
+                assert getattr(output, "alertDetails")["type"] == \
                        "Anomalies aggregated by CustomAlertAggregator"
-                assert getattr(output, "detectorTypes") == ["MyCoolThing_detector"]*3
-                assert getattr(output, "alertIDs") == [
-                    f"MyCoolThing_{i + 8}", f"MyCoolThing_{i + 9}", f"MyCoolThing_{i + 10}"]
-                assert getattr(output, "logIDs") == [str(i-2), str(i-1), str(i)]
+                assert getattr(output, "detectorTypes") == ["MyCoolThing_detector"]
+                assert set(getattr(output, "alertIDs")) == set([
+                    f"MyCoolThing_{i + 8}", f"MyCoolThing_{i + 9}", f"MyCoolThing_{i + 10}"
+                ])
+                assert set(getattr(output, "logIDs")) == set([str(i-2), str(i-1), str(i)])
             i += 1
diff --git a/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomDetector.py b/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomDetector.py
index 48685722..38460b4c 100644
--- a/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomDetector.py
+++ b/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomDetector.py
@@ -38,7 +38,7 @@ def test_run_detect_method(self) -> None:
             output = detector.process(data)
             assert getattr(output, "description") == "Dummy detection process"
             assert getattr(output, "score") == 1.0
-            assert getattr(output, "alertsObtain")["type"] == "Anomaly detected by CustomDetector"
+            assert getattr(output, "alertDetails")["type"] == "Anomaly detected by CustomDetector"
             assert getattr(output, "detectorID") == "CustomDetector"
             assert getattr(output, "detectorType") == "custom_detector"
             assert getattr(output, "alertID") == f"CustomDetector_{i + 10}"
diff --git a/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomParser.py b/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomParser.py
index e7328a09..8035073d 100644
--- a/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomParser.py
+++ b/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomParser.py
@@ -35,9 +35,9 @@ def test_run_parse_method(self) -> None:
             except StopIteration:
                 break
             output = parser.process(data)
-            assert getattr(output, "EventID") == 2
+            assert getattr(output, "eventID") == 2
             assert getattr(output, "template") == "This is a dummy template"
-            assert getattr(output, "logFormatVariables")["Time"] == "0"
+            assert getattr(output, "headerVariables")["Time"] == "0"
             assert getattr(output, "parserID") == "CustomParser"
             assert getattr(output, "parserType") == "custom_parser"
             assert getattr(output, "variables") == ["dummy_variable"]
diff --git a/src/detectmatelibrary/utils/data_normalizer.py b/src/detectmatelibrary/utils/data_normalizer.py
index 167ec481..a79a225d 100644
--- a/src/detectmatelibrary/utils/data_normalizer.py
+++ b/src/detectmatelibrary/utils/data_normalizer.py
@@ -1,4 +1,4 @@
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 from typing import Any
 import pandas as pd
@@ -13,8 +13,8 @@ class DataNormalizer:
     def __init__(
         self,
         data: pd.DataFrame | dict[str, Any] | list[Any],
-        input_schema: schemas.BaseSchema,
-        output_schema: schemas.BaseSchema
+        input_schema: sc.BaseSchema,
+        output_schema: sc.BaseSchema
     ) -> None:
         self.data = data
         self.input_schema = input_schema
diff --git a/src/detectmatelibrary/utils/persistency/__init__.py b/src/detectmatelibrary/utils/persistency/__init__.py
index 228197eb..a8a24db7 100644
--- a/src/detectmatelibrary/utils/persistency/__init__.py
+++ b/src/detectmatelibrary/utils/persistency/__init__.py
@@ -1,5 +1,12 @@
 from .event_persistency import EventPersistency
-from .persistency_saver import PersistencySaver, PersistencySaverConfig, PersistencyLoadError, save, load
+from .persistency_saver import (
+    PersistencySaver,
+    PersistencySaverConfig,
+    PersistencyLoadError,
+    PersistencySaveError,
+    save,
+    load,
+)
 from .data_structures.base import EventDataset
 from .data_structures.trackers.stability.stability_tracker import EventStabilityTracker
 
diff --git a/src/detectmatelibrary/utils/sequence_encoding.py b/src/detectmatelibrary/utils/sequence_encoding.py
index 49f83ecd..21feece8 100644
--- a/src/detectmatelibrary/utils/sequence_encoding.py
+++ b/src/detectmatelibrary/utils/sequence_encoding.py
@@ -28,7 +28,7 @@ def build_count_vec(input_: List[schemas.ParserSchema]) -> tuple[int, ...]:
     """Count how often each EventID occurs in a window, indexed by EventID."""
     sequence, n = [0], 0
     for in_ in input_:
-        event = in_["EventID"]
+        event = in_["eventID"]
         if n < event:
             for _ in range(n, event):
                 sequence.append(0)
diff --git a/tests/test_alert_aggregators/test_basic_concat.py b/tests/test_alert_aggregators/test_basic_concat.py
index 221c14ff..46a7c52f 100644
--- a/tests/test_alert_aggregators/test_basic_concat.py
+++ b/tests/test_alert_aggregators/test_basic_concat.py
@@ -1,96 +1,58 @@
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation
-from detectmatelibrary.schemas import AggregateSchema
+
+
 from detectmatelibrary.utils.aux import time_test_mode
+
 import detectmatelibrary.schemas as schemas
-from datetime import datetime
 
 
 time_test_mode()
 
 aggregations_config = {
     "alert_aggregators": {
-        "Buffer_4": {
+        "Buffer_3": {
             "method_type": "basic_concat_aggregator",
-            "buffer_size": 4,
-            "auto_config": False,
-            "params": {},
+            "buffer_size": 3,
         },
-        "Buffer_6": {
+        "Buffer_5": {
             "method_type": "basic_concat_aggregator",
-            "buffer_size": 6,
-            "deduplicate_values": True,
-            "auto_config": False,
-            "params": {},
+            "buffer_size": 5,
         },
-    },
-    "auto_config": False
+    }
 }
 
 
-data_global = [schemas.DetectorSchema({
-    "detectorID": str(i),
-    "detectorType": "dummy",
-    "alertID": str(i),
-    "detectionTimestamp": 0,
-    "logIDs": [f"logID{i}"],
-    "score": 0.2 + i / 10,
-    "extractedTimestamps": [int(datetime.now().timestamp() + i)],
-    "description": "hello there",
-    "receivedTimestamp": 1,
-    "alertsObtain": {"99 problems": "but logs aint one"}
-}) for i in range(1, 4)]
-
-data_global += [schemas.DetectorSchema({
+dummy_schema = {
     "detectorID": "1",
     "detectorType": "dummy",
-    "alertID": "1",
-    "detectionTimestamp": 0,
-    "logIDs": [f"logID{1}"],
-    "score": 0.3,
-    "extractedTimestamps": [int(datetime.now().timestamp() + 1)],
+    "alertID": "2",
+    "detectedTimestamp": 0,
+    "logIDs": ["logID1"],
+    "score": 0.2,
+    "logTimestamps": [-1],
     "description": "hello there",
     "receivedTimestamp": 1,
-    "alertsObtain": {"99 problems": "but logs aint one"}
-}) for i in range(1, 4)]
+    "alertDetails": {"99 problems": "but logs aint one"}
+}
 
 
 class TestBasicAggregation:
-    def test_with_buffer_4(self):
-        alert_aggregator = BasicConcatAggregation("Buffer_4", aggregations_config)
-        data = data_global
-
-        assert alert_aggregator.process(data[0]) is None
-        assert alert_aggregator.process(data[1]) is None
-        assert alert_aggregator.process(data[2]) is None
-        result = alert_aggregator.process(data[3])
-        assert result is not None
-        assert isinstance(result, AggregateSchema)
-        res_dict = result.as_dict()
-        assert res_dict["detectorIDs"] == ["1", "2", "3", "1"]
-        assert res_dict["alertIDs"] == ["1", "2", "3", "1"]
-        assert res_dict["outputTimestamp"] == 0
-        assert res_dict["logIDs"] == ["logID1", "logID2", "logID3", "logID1"]
-        assert len(res_dict["extractedTimestamps"]) == 4
-        assert res_dict["description"] == "Basic aggregation by alert concatenation"
-        assert res_dict["detectorTypes"] == ["dummy"]*4
-
-    def test_with_buffer_6(self):
-        alert_aggregator = BasicConcatAggregation("Buffer_6", aggregations_config)
-        data = data_global
-
-        assert alert_aggregator.process(data[0]) is None
-        assert alert_aggregator.process(data[1]) is None
-        assert alert_aggregator.process(data[2]) is None
-        assert alert_aggregator.process(data[3]) is None
-        assert alert_aggregator.process(data[4]) is None
-        result = alert_aggregator.process(data[5])
-        assert result is not None
-        assert isinstance(result, AggregateSchema)
-        res_dict = result.as_dict()
-        assert res_dict["detectorIDs"] == ["1", "2", "3"]
-        assert res_dict["alertIDs"] == ["1", "2", "3"]
-        assert res_dict["outputTimestamp"] == 0
-        assert res_dict["logIDs"] == ["logID1", "logID2", "logID3"]
-        assert len(res_dict["extractedTimestamps"]) == 3
-        assert res_dict["description"] == "Basic aggregation by alert concatenation"
-        assert res_dict["detectorTypes"] == ["dummy"]
+    def test_with_buffer_3(self):
+        alert_aggregator = BasicConcatAggregation("Buffer_3", aggregations_config)
+        data = schemas.DetectorSchema(dummy_schema).serialize()
+
+        assert alert_aggregator.process(data) is None
+        assert alert_aggregator.process(data) is None
+        assert (result := alert_aggregator.process(data)) is not None
+        assert isinstance(result, bytes)
+
+    def test_with_buffer_5(self):
+        alert_aggregator = BasicConcatAggregation("Buffer_5", aggregations_config)
+        data = schemas.DetectorSchema(dummy_schema).serialize()
+
+        assert alert_aggregator.process(data) is None
+        assert alert_aggregator.process(data) is None
+        assert alert_aggregator.process(data) is None
+        assert alert_aggregator.process(data) is None
+        assert (result := alert_aggregator.process(data)) is not None
+        assert isinstance(result, bytes)
diff --git a/tests/test_alert_aggregators/test_logid_count.py b/tests/test_alert_aggregators/test_logid_count.py
new file mode 100644
index 00000000..7fbd6b93
--- /dev/null
+++ b/tests/test_alert_aggregators/test_logid_count.py
@@ -0,0 +1,96 @@
+
+from detectmatelibrary.alert_aggregation.logid_count import (
+    Counter, LogIDCountAggegation, LogIDCountAggegationConfig
+)
+import detectmatelibrary.schemas as schemas
+
+
+class TestCounter:
+    def test_basic_count(self) -> None:
+        counter = Counter(max_count=2, overall_size=10)
+
+        assert not counter.add_and_check("a")
+        assert not counter.add_and_check("b")
+        assert counter.add_and_check("a")
+        assert counter.add_and_check("b")
+
+        assert not counter.add_and_check("a")  # should not generate new ones
+        assert not counter.add_and_check("b")  # should not generate new ones
+
+    def test_surpass_memory(self) -> None:
+        counter = Counter(max_count=2, overall_size=2)
+
+        assert not counter.add_and_check("a")
+        assert not counter.add_and_check("b")
+        assert not counter.add_and_check("c")
+
+        assert counter.add_and_check("b")
+        assert not counter.add_and_check("a")  # was rename by c 
+        assert counter.add_and_check("c")
+        assert counter.add_and_check("a")  
+
+        assert not counter.add_and_check("a")  # should not generate new ones
+        assert not counter.add_and_check("c")  # should not generate new ones
+
+
+def generate_schema(log_id: str | list[str]) -> schemas.DetectorSchema:
+    log_id = log_id if isinstance(log_id, list) else [log_id]
+    return schemas.DetectorSchema({
+        "detectorID": "1",
+        "detectorType": "dummy",
+        "alertID": "2",
+        "detectedTimestamp": 0,
+        "logIDs": log_id,
+        "score": 0.2,
+        "logTimestamps": [-1],
+        "description": "hello there",
+        "receivedTimestamp": 1,
+        "alertDetails": {"99 problems": "but logs aint one"}
+    })
+
+
+class TestLogIDCount:
+    def test_basic_count(self):
+        aggregator = LogIDCountAggegation(config=LogIDCountAggegationConfig(max_count=2))
+
+        assert aggregator.process(generate_schema("a")) is None
+        assert aggregator.process(generate_schema("b")) is None
+
+        assert aggregator.process(generate_schema("a")) is not None
+        assert aggregator.process(generate_schema("b")) is not None
+
+        assert aggregator.process(generate_schema("a")) is None
+        assert aggregator.process(generate_schema("b")) is None
+
+    def test_basic_count_as_list(self):
+        aggregator = LogIDCountAggegation(config=LogIDCountAggegationConfig(max_count=2))
+
+        assert aggregator.process(generate_schema(["a", "b"])) is None
+        assert aggregator.process(generate_schema(["a", "b"])) is not None
+        assert aggregator.process(generate_schema(["a", "b"])) is None
+
+    def test_surpass_memory(self):
+        aggregator = LogIDCountAggegation(
+            config=LogIDCountAggegationConfig(max_count=2, max_memory=2)
+        )
+
+        assert aggregator.process(generate_schema("a")) is None
+        assert aggregator.process(generate_schema("b")) is None
+        assert aggregator.process(generate_schema("c")) is None
+
+        assert aggregator.process(generate_schema("b")) is not None
+        assert aggregator.process(generate_schema("a")) is None  # was rename by c 
+        assert aggregator.process(generate_schema("c")) is not None
+        assert aggregator.process(generate_schema("a")) is not None
+
+        assert aggregator.process(generate_schema("a")) is None  # should not generate new ones
+        assert aggregator.process(generate_schema("c")) is None # should not generate new ones
+
+    def test_description(self):
+        aggregator = LogIDCountAggegation(config=LogIDCountAggegationConfig(max_count=1))
+        alert = aggregator.process(generate_schema(["a", "b"]))
+
+        expected = "LogID count how many times a log was count as alert."
+        expected += "Logs that pass the limit count: a, b"
+
+        assert alert["description"] == expected
\ No newline at end of file
diff --git a/tests/test_alert_aggregators/test_time_delta.py b/tests/test_alert_aggregators/test_time_delta.py
new file mode 100644
index 00000000..1389bb6e
--- /dev/null
+++ b/tests/test_alert_aggregators/test_time_delta.py
@@ -0,0 +1,93 @@
+from detectmatelibrary.alert_aggregation.time_delta import (
+    TimeDeltaAggregation,
+    TimeDeltaAggregationConfig,
+)
+from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
+
+
+def make_alert(alert_id: str, timestamp: int) -> DetectorSchema:
+    return DetectorSchema(
+        {
+            "detectorID": "detector",
+            "detectorType": "dummy",
+            "alertID": alert_id,
+            "detectedTimestamp": timestamp,
+            "logIDs": [f"log-{alert_id}"],
+            "score": 0.0,
+            "logTimestamps": [timestamp],
+            "description": "test alert",
+            "receivedTimestamp": timestamp,
+            "alertDetails": {},
+        }
+    )
+
+
+def create_aggregator(*, delta: float = 10.0) -> TimeDeltaAggregation:
+    return TimeDeltaAggregation(
+        config=TimeDeltaAggregationConfig(buffer_size=3, delta=delta)
+    )
+
+
+class TestTimeDeltaAggregation:
+    def test_default_configuration(self) -> None:
+        config = TimeDeltaAggregationConfig()
+
+        assert config.method_type == "time_delta_aggregator"
+        assert config.delta == 10.0
+
+    def test_single_metric_returns_absolute_timestamp_delta(self) -> None:
+        aggregator = create_aggregator()
+        first = make_alert("first", 100)
+        second = make_alert("second", 93)
+
+        assert aggregator.single_metric(first, second) == 7.0
+        assert aggregator.single_metric(second, first) == 7.0
+
+    def test_single_metric_uses_last_extracted_timestamp(self) -> None:
+        aggregator = create_aggregator()
+        first = make_alert("first", 100)
+        second = make_alert("second", 106)
+        first["logTimestamps"] = [90, 100]
+        second["logTimestamps"] = [101, 106]
+
+        assert aggregator.single_metric(first, second) == 6.0
+
+    def test_discard_alert_fn_keeps_only_latest_alert(self) -> None:
+        aggregator = create_aggregator()
+        alerts = [
+            make_alert("first", 1),
+            make_alert("second", 2),
+            make_alert("third", 3),
+        ]
+
+        assert aggregator.discard_alert_fn(alerts) == [True, True, False]
+
+    def test_alerts_within_delta_are_assigned_to_same_group(self) -> None:
+        aggregator = create_aggregator(delta=10.0)
+        first_output = AggregateSchema()
+        second_output = AggregateSchema()
+
+        assert aggregator.aggregate_alerts(make_alert("first", 100), first_output)
+        assert aggregator.aggregate_alerts(make_alert("second", 110), second_output)
+
+        assert first_output["alertDetails"]["first"] == "0"
+        assert second_output["alertDetails"]["second"] == "0"
+        assert second_output["description"] == (
+            "Alert aggregation by the time-delta method."
+        )
+
+    def test_alerts_outside_delta_are_assigned_to_different_groups(self) -> None:
+        aggregator = create_aggregator(delta=10.0)
+        aggregator.aggregate_alerts(make_alert("first", 100), AggregateSchema())
+        second_output = AggregateSchema()
+
+        assert aggregator.aggregate_alerts(make_alert("second", 111), second_output)
+
+        assert second_output["alertDetails"]["second"] == "1"
+
+    def test_only_latest_alert_remains_relevant_after_aggregation(self) -> None:
+        aggregator = create_aggregator()
+        aggregator.aggregate_alerts(make_alert("first", 100), AggregateSchema())
+        aggregator.aggregate_alerts(make_alert("second", 105), AggregateSchema())
+
+        assert [alert["alertID"] for alert in aggregator.relevant_alerts] == ["second"]
diff --git a/tests/test_base_alert_aggregators/test_density_clustering.py b/tests/test_base_alert_aggregators/test_density_clustering.py
new file mode 100644
index 00000000..d2ecd737
--- /dev/null
+++ b/tests/test_base_alert_aggregators/test_density_clustering.py
@@ -0,0 +1,127 @@
+from detectmatelibrary.base_alert_aggregation.density_clustering import (
+    DensityClusteringAggregation,
+    DensityClusteringAggregationConfig,
+)
+from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
+from detectmatelibrary.utils.data_buffer import BufferMode
+
+
+def make_alert(alert_id: str, score: float) -> DetectorSchema:
+    return DetectorSchema(
+        {
+            "detectorID": "detector",
+            "detectorType": "dummy",
+            "alertID": alert_id,
+            "detectedTimestamp": 0,
+            "logIDs": [f"log-{alert_id}"],
+            "score": score,
+            "logTimestamps": [0],
+            "description": "test alert",
+            "receivedTimestamp": 0,
+            "alertDetails": {},
+        }
+    )
+
+
+class ConcreteDensityClusteringAggregation(DensityClusteringAggregation):
+    def single_metric(self, alert1: DetectorSchema, alert2: DetectorSchema) -> float:
+        return abs(alert1["score"] - alert2["score"])
+
+    def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
+        return [alert["alertID"].startswith("discard") for alert in alerts]
+
+
+def create_aggregator(
+    *,
+    buffer_mode: BufferMode = BufferMode.BATCH,
+    buffer_size: int = 3,
+    delta: float = 1.0,
+) -> ConcreteDensityClusteringAggregation:
+    return ConcreteDensityClusteringAggregation(
+        config=DensityClusteringAggregationConfig(
+            buffer_mode=buffer_mode,
+            buffer_size=buffer_size,
+            delta=delta,
+        )
+    )
+
+
+class TestDensityClusteringAggregation:
+    def test_metric_and_threshold(self) -> None:
+        aggregator = create_aggregator(delta=2.0)
+        alerts = [make_alert("a", 1.0), make_alert("b", 4.0)]
+
+        assert aggregator.metric(alerts) == [[0.0, 3.0], [3.0, 0.0]]
+        assert aggregator.metric(alerts, return_last_rows=1) == [[3.0, 0.0]]
+        assert aggregator._check_threshold([[0.0, 2.0], [2.1, 0.0]]) == [
+            [True, True],
+            [False, True],
+        ]
+
+    def test_aggregate_assigns_and_merges_groups(self) -> None:
+        aggregator = create_aggregator(delta=1.0)
+        first = make_alert("a", 0.0)
+        second = make_alert("b", 10.0)
+        bridge = make_alert("c", 5.0)
+
+        first_output = AggregateSchema()
+        assert aggregator.aggregate_alerts(first, first_output)
+        assert first_output["alertDetails"]["a"] == "0"
+
+        second_output = AggregateSchema()
+        aggregator.aggregate_alerts(second, second_output)
+        assert second_output["alertDetails"]["b"] == "1"
+
+        bridge_output = AggregateSchema()
+        aggregator.config.delta = 6.0
+        aggregator.aggregate_alerts(bridge, bridge_output)
+
+        assert bridge_output["alertDetails"]["c"] == "0"
+        assert aggregator.active_groups == {0: {0, 1}, 1: {0, 1}}
+        assert "Groups" in bridge_output["alertDetails"]["messages"]
+
+    def test_duplicate_alert_is_not_reassigned(self) -> None:
+        aggregator = create_aggregator()
+        alert = make_alert("same", 0.0)
+
+        first_output = AggregateSchema()
+        aggregator.aggregate_alerts(alert, first_output)
+        duplicate_output = AggregateSchema()
+        aggregator.aggregate_alerts(alert, duplicate_output)
+
+        assert "same" not in duplicate_output["alertDetails"]
+        assert aggregator.next_group_id == 1
+        assert len(aggregator.relevant_alerts) == 1
+
+    def test_window_buffer_keeps_latest_alerts(self) -> None:
+        aggregator = create_aggregator(
+            buffer_mode=BufferMode.WINDOW,
+            buffer_size=2,
+        )
+        alerts = [
+            make_alert("discard-1", 0.0),
+            make_alert("keep-1", 0.0),
+            make_alert("keep-2", 0.0),
+        ]
+        aggregator.relevant_alerts.extend(alerts)
+        aggregator.alert_id_to_group_id.update(
+            {alert["alertID"]: 0 for alert in alerts}
+        )
+
+        discarded, affected_groups = aggregator._discard_alerts()
+
+        assert discarded == ["discard-1"]
+        assert affected_groups == {0}
+        assert [alert["alertID"] for alert in aggregator.relevant_alerts] == [
+            "keep-1",
+            "keep-2",
+        ]
+
+    def test_default_hooks_return_dummy_values(self) -> None:
+        aggregator = DensityClusteringAggregation(
+            config=DensityClusteringAggregationConfig(delta=1.0)
+        )
+        alert = make_alert("a", 0.0)
+
+        assert aggregator.single_metric(alert, alert) == 0.0
+        assert aggregator.discard_alert_fn([alert]) == [True]
diff --git a/tests/test_base_detectors/test_deeplearning_detectors.py b/tests/test_base_detectors/test_deeplearning_detectors.py
index 585e835f..9adb0432 100644
--- a/tests/test_base_detectors/test_deeplearning_detectors.py
+++ b/tests/test_base_detectors/test_deeplearning_detectors.py
@@ -35,7 +35,7 @@ def test_normal_run_configure(self):
 
         for i in range(10):
             deep_learning_detector.configure(
-                [schemas.ParserSchema({"EventID": i})]
+                [schemas.ParserSchema({"eventID": i})]
             )
 
         for i in range(10):
@@ -51,7 +51,7 @@ def test_normal_run_train(self):
 
         for i in range(10):
             deep_learning_detector.train(
-                [schemas.ParserSchema({"EventID": i})]
+                [schemas.ParserSchema({"eventID": i})]
             )
 
         for i in range(10):
@@ -66,4 +66,4 @@ def test_check_that_check_anomaly_is_call(self):
         )
 
         with pytest.raises(Flag):
-            deep_learning_detector.process(schemas.ParserSchema({"EventID": 0}))
+            deep_learning_detector.process(schemas.ParserSchema({"eventID": 0}))
diff --git a/tests/test_base_detectors/test_tracker_detector.py b/tests/test_base_detectors/test_tracker_detector.py
index 9e42a3fa..4912d1cb 100644
--- a/tests/test_base_detectors/test_tracker_detector.py
+++ b/tests/test_base_detectors/test_tracker_detector.py
@@ -34,14 +34,14 @@
 def _event(event_id: int) -> schemas.ParserSchema:
     return schemas.ParserSchema({
         "parserType": "test",
-        "EventID": event_id,
+        "eventID": event_id,
         "template": "test template",
         "variables": [],
         "logID": str(event_id),
         "parsedLogID": str(event_id),
         "parserID": "test_parser",
         "log": "test log message",
-        "logFormatVariables": {},
+        "headerVariables": {},
     })
 
 
@@ -61,7 +61,7 @@ def _sync_from_state(self) -> None:
         self.synced += 1
 
     def train(self, input_: schemas.ParserSchema) -> None:  # type: ignore[override]
-        self._ingest(input_, {}, input_["EventID"])
+        self._ingest(input_, {}, input_["eventID"])
 
 
 class TestSyncFromState:
diff --git a/tests/test_base_detectors/test_variable_detector.py b/tests/test_base_detectors/test_variable_detector.py
index 81eaa19e..52eca4d0 100644
--- a/tests/test_base_detectors/test_variable_detector.py
+++ b/tests/test_base_detectors/test_variable_detector.py
@@ -1,6 +1,6 @@
 
 from detectmatelibrary.base_detectors import VariableDetector
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import os
 
@@ -28,10 +28,10 @@
 
 def train(detector: VariableDetector, *users) -> None:
     for u in users:
-        detector.train(schemas.ParserSchema({
-            "parserType": "t", "EventID": 1, "template": "t", "variables": [u],
+        detector.train(sc.ParserSchema({
+            "parserType": "t", "eventID": 1, "template": "t", "variables": [u],
             "logID": "1", "parsedLogID": "1", "parserID": "p", "log": "l",
-            "logFormatVariables": {},
+            "headerVariables": {},
         }))
 
 
diff --git a/tests/test_common/test_core.py b/tests/test_common/test_core.py
index 0cb2d515..914ee2ab 100644
--- a/tests/test_common/test_core.py
+++ b/tests/test_common/test_core.py
@@ -6,7 +6,7 @@
 from detectmatelibrary.utils.data_buffer import ArgsBuffer, BufferMode
 
 import detectmatelibrary.schemas._op as op_schemas
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import logging
 import os
@@ -41,9 +41,9 @@ class MockConfigWithTraining(CoreConfig):
 }
 
 
-def _make_log(i: int) -> schemas.LogSchema:
-    return schemas.LogSchema({
-        "__version__": "1.0.0",
+def _make_log(i: int) -> sc.LogSchema:
+    return sc.LogSchema({
+        "__version__": "2.0.0",
         "logID": str(i),
         "logSource": "test",
         "hostname": "test_hostname"
@@ -60,7 +60,7 @@ def __init__(
         self, name: str, config: MockConfigWithTraining = MockConfigWithTraining()
     ) -> None:
         super().__init__(
-            name=name, type_="Dummy", config=config, input_schema=schemas.LogSchema
+            name=name, type_="Dummy", config=config, input_schema=sc.LogSchema
         )
         self.train_data = []
 
@@ -83,7 +83,7 @@ def __init__(
         self, name: str, config: MockConfigWithConfigure = MockConfigWithConfigure()
     ) -> None:
         super().__init__(
-            name=name, type_="Dummy", config=config, input_schema=schemas.LogSchema
+            name=name, type_="Dummy", config=config, input_schema=sc.LogSchema
         )
         self.configure_data: list = []
         self.set_configuration_called: int = 0
@@ -101,7 +101,7 @@ def run(self, input_, output_) -> bool:
 class MockComponentWithConfigureAndTraining(CoreComponent):
     def __init__(self, name: str, config: CoreConfig = CoreConfig()) -> None:
         super().__init__(
-            name=name, type_="Dummy", config=config, input_schema=schemas.LogSchema
+            name=name, type_="Dummy", config=config, input_schema=sc.LogSchema
         )
         self.configure_data: list = []
         self.train_data: list = []
@@ -240,8 +240,8 @@ def test_training(self) -> None:
 
         for i in range(10):
             component.process(
-                schemas.LogSchema({
-                    "__version__": "1.0.0",
+                sc.LogSchema({
+                    "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
@@ -250,8 +250,8 @@ def test_training(self) -> None:
 
         assert len(component.train_data) == component.fitlogic.train_state.data_used
         for i, log in enumerate(component.train_data):
-            expected = schemas.LogSchema({
-                "__version__": "1.0.0",
+            expected = sc.LogSchema({
+                "__version__": "2.0.0",
                 "logID": str(i),
                 "logSource": "test",
                 "hostname": "test_hostname"
@@ -266,8 +266,8 @@ def test_training_use_config_data(self) -> None:
 
         for i in range(10):
             component.process(
-                schemas.LogSchema({
-                    "__version__": "1.0.0",
+                sc.LogSchema({
+                    "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
@@ -277,8 +277,8 @@ def test_training_use_config_data(self) -> None:
         total += component.fitlogic.config_state.total_need_data
         assert len(component.train_data) == total
         for i, log in enumerate(component.train_data):
-            expected = schemas.LogSchema({
-                "__version__": "1.0.0",
+            expected = sc.LogSchema({
+                "__version__": "2.0.0",
                 "logID": str(i),
                 "logSource": "test",
                 "hostname": "test_hostname"
@@ -292,8 +292,8 @@ def test_training_force_stop(self) -> None:
             if i == 2:
                 component.update_state("stop_training")
             component.process(
-                schemas.LogSchema({
-                    "__version__": "1.0.0",
+                sc.LogSchema({
+                    "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
@@ -308,8 +308,8 @@ def test_training_keep_training(self) -> None:
 
         for i in range(10):
             component.process(
-                schemas.LogSchema({
-                    "__version__": "1.0.0",
+                sc.LogSchema({
+                    "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
@@ -477,7 +477,7 @@ class MockConfigWithPostTrain(CoreConfig):
 class MockComponentWithPostTrain(CoreComponent):
     def __init__(self, name: str, config: CoreConfig = MockConfigWithPostTrain()) -> None:
         super().__init__(
-            name=name, type_="Dummy", config=config, input_schema=schemas.LogSchema
+            name=name, type_="Dummy", config=config, input_schema=sc.LogSchema
         )
         self.post_train_called: int = 0
 
@@ -612,7 +612,7 @@ def test_has_no_saver(self):
 class MockWindowComponent(CoreComponent):
     def __init__(self, name: str, config: CoreConfig) -> None:
         super().__init__(
-            name=name, type_="Dummy", config=config, input_schema=schemas.LogSchema,
+            name=name, type_="Dummy", config=config, input_schema=sc.LogSchema,
             args_buffer=ArgsBuffer(mode=BufferMode.WINDOW, size=2),
         )
         self.train_data: list = []
diff --git a/tests/test_common/test_core_alert_aggregator.py b/tests/test_common/test_core_alert_aggregator.py
index 1aa180dd..0ab17c09 100644
--- a/tests/test_common/test_core_alert_aggregator.py
+++ b/tests/test_common/test_core_alert_aggregator.py
@@ -1,9 +1,9 @@
 from detectmatelibrary.common.alert_aggregator import (
-    CoreAlertAggregatorConfig, CoreAlertAggregator, BufferMode
+    CoreAlertAggregatorConfig, CoreAlertAggregator, BufferMode, _extract_field, _extract_list_fields
 )
 
 from detectmatelibrary.utils.aux import time_test_mode
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pydantic
 import pytest
@@ -52,13 +52,13 @@ def aggregate_alerts(self, input_, output_):
     "detectorID": "1",
     "detectorType": "dummy",
     "alertID": "2",
-    "detectionTimestamp": 0,
+    "detectedTimestamp": 0,
     "logIDs": ["logID1"],
     "score": 0.2,
-    "extractedTimestamps": [-1],
+    "logTimestamps": [-1],
     "description": "hello there",
     "receivedTimestamp": 1,
-    "alertsObtain": {"99 problems": "but logs aint one"}
+    "alertDetails": {"99 problems": "but logs aint one"}
 }
 
 
@@ -74,6 +74,59 @@ def aggregate_alerts(self, input_, output_):
 time_test_mode()
 
 
+class TestAuxiliar:
+    def test_get_field_single(self) -> None:
+        expected = {"dummy"}
+        input_ = sc.DetectorSchema(dummy_schema)
+
+        assert len(field := _extract_field(input_, "detectorType")) == 1
+        assert expected == set(field)
+
+    def test_get_field_multiple(self) -> None:
+        expected = {"dummy2", "dummy"}
+
+        dummy_schema2 = dummy_schema.copy()
+        dummy_schema2["detectorType"] = "dummy2"
+        input_ = [dummy_schema, dummy_schema2]
+        input_ = [sc.DetectorSchema(in_) for in_ in input_]
+
+        assert len(field := _extract_field(input_, "detectorType")) == 2
+        assert expected == set(field)
+
+    def test_get_logID_timestamp_single(self) -> None:
+        expected_logID = ["logID1", "logID2", "logID3"]
+        expected_times = [-1, 0, 1]
+
+        dummy_schema2 = dummy_schema.copy()
+        dummy_schema2["logIDs"] = ["logID1", "logID2", "logID3", "logID1"]
+        dummy_schema2["logTimestamps"] = [-1, 0, 1, 3]
+        input_ = sc.DetectorSchema(dummy_schema2)
+
+        logids, times = _extract_list_fields(
+            input_, field1="logIDs", field2="logTimestamps"
+        )
+
+        assert expected_logID == logids
+        assert times == expected_times
+
+    def test_get_logID_timestamp_multiple(self) -> None:
+        expected_logID = ["logID1", "logID2", "logID3"]
+        expected_times = [-1, 0, 1]
+
+        dummy_schema2 = dummy_schema.copy()
+        dummy_schema2["logIDs"] = ["logID2", "logID3", "logID1"]
+        dummy_schema2["logTimestamps"] = [0, 1, 3]
+        input_ = [dummy_schema, dummy_schema2]
+        input_ = [sc.DetectorSchema(in_) for in_ in input_]
+
+        logids, times = _extract_list_fields(
+            input_, field1="logIDs", field2="logTimestamps"
+        )
+
+        assert expected_logID == logids
+        assert times == expected_times
+
+
 class TestCoreAlertAggregator:
     def test_initialize_default(self) -> None:
         detector = MockupAlertAggregator(name="TestAAG", config=dummy_config)
@@ -81,8 +134,8 @@ def test_initialize_default(self) -> None:
         assert isinstance(detector, CoreAlertAggregator)
         assert detector.name == "TestAAG"
         assert isinstance(detector.config, CoreAlertAggregatorConfig)
-        assert detector.input_schema == schemas.DetectorSchema
-        assert detector.output_schema == schemas.AggregateSchema
+        assert detector.input_schema == sc.DetectorSchema
+        assert detector.output_schema == sc.AggregateSchema
 
     def test_incorrect_config_type(self) -> None:
         dummy_config2 = {
@@ -100,41 +153,41 @@ def test_incorrect_config_type(self) -> None:
 
     def test_process_correct_input_schema(self) -> None:
         detector = MockupAlertAggregator(name="TestAAG", config=dummy_config)
-        data = schemas.DetectorSchema(dummy_schema).serialize()
+        data = sc.DetectorSchema(dummy_schema).serialize()
         result = detector.process(data)  # no error should be produced
         assert isinstance(result, bytes)  # and result should be bytes
 
     def test_process_input_schema_not_serialized(self) -> None:
         alert_aggregator = MockupAlertAggregator(name="TestAAG", config=MockupConfig())
-        expected_result = schemas.AggregateSchema({
-            "__version__": "1.0.0",
+        expected_result = sc.AggregateSchema({
+            "__version__": "2.0.0",
             "detectorIDs": ["1"],
             "detectorTypes": ["dummy"],
             "alertIDs": ["2"],
-            "outputTimestamp": 0,
+            "aggregatedTimestamp": 0,
             "logIDs": ["logID1"],
             "description": "Mockup aggregator",
-            "extractedTimestamps": [-1],
-            "alertsObtain": {}
+            "logTimestamps": [-1],
+            "alertDetails": {}
         })
-        data = schemas.DetectorSchema(dummy_schema)
+        data = sc.DetectorSchema(dummy_schema)
         result = alert_aggregator.process(data)
         assert result == expected_result, f"result -> {result}"
 
     def test_process_input_schema_not_serialized_window_3(self) -> None:
         alert_aggregator = MockupAlertAggregator(name="TestDetector", config=MockupConfig(), buffer_size=3)
-        expected_result = schemas.AggregateSchema({
+        expected_result = sc.AggregateSchema({
             "__version__": "1.0.0",
-            "detectorIDs": ["1", "1", "1"],
-            "detectorTypes": ["dummy", "dummy", "dummy"],
-            "alertIDs": ["2", "2", "2"],
-            "outputTimestamp": 0,
-            "logIDs": ["logID1", "logID1", "logID1"],
+            "detectorIDs": ["1"],
+            "detectorTypes": ["dummy"],
+            "alertIDs": ["2"],
+            "aggregatedTimestamp": 0,
+            "logIDs": ["logID1"],
             "description": "Mockup aggregator",
-            "extractedTimestamps": [-1, -1, -1],
-            "alertsObtain": {}
+            "logTimestamps": [-1],
+            "alertDetails": {}
         })
-        data = schemas.DetectorSchema(dummy_schema)
+        data = sc.DetectorSchema(dummy_schema)
 
         assert alert_aggregator.process(data) is None
         assert alert_aggregator.process(data) is None
@@ -146,18 +199,18 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
         alert_aggregator = MockupAlertAggregatorBuffer(
             name="TestDetector", config=MockupConfig(), buffer_size=3
         )
-        expected_result = schemas.AggregateSchema({
+        expected_result = sc.AggregateSchema({
             "__version__": "1.0.0",
-            "detectorIDs": ["1", "1", "1"],
-            "detectorTypes": ["dummy", "dummy", "dummy"],
-            "alertIDs": ["2", "2", "2"],
-            "outputTimestamp": 0,
-            "logIDs": ["logID1", "logID1", "logID1"],
+            "detectorIDs": ["1"],
+            "detectorTypes": ["dummy"],
+            "alertIDs": ["2"],
+            "aggregatedTimestamp": 0,
+            "logIDs": ["logID1"],
             "description": "Mockup aggregator",
-            "extractedTimestamps": [-1, -1, -1],
-            "alertsObtain": {}
+            "logTimestamps": [-1],
+            "alertDetails": {}
         })
-        data = schemas.DetectorSchema(dummy_schema)
+        data = sc.DetectorSchema(dummy_schema)
 
         assert alert_aggregator.process(data) is None
         assert alert_aggregator.process(data) is None
@@ -167,7 +220,7 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
 
     def test_none_detector(self) -> None:
         alert_aggregator = NoneMockupAlertAggregator(name="TestDetector", config=MockupConfig())
-        data = schemas.DetectorSchema(dummy_schema)
+        data = sc.DetectorSchema(dummy_schema)
 
         assert alert_aggregator.process(data) is None
         assert alert_aggregator.process(data) is not None
diff --git a/tests/test_common/test_core_detector.py b/tests/test_common/test_core_detector.py
index 1c0fa308..3ca12189 100644
--- a/tests/test_common/test_core_detector.py
+++ b/tests/test_common/test_core_detector.py
@@ -1,7 +1,7 @@
 from detectmatelibrary.common.detector import CoreDetectorConfig, BufferMode
 from detectmatelibrary.common.detector import CoreDetector
 from detectmatelibrary.utils.aux import time_test_mode
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pydantic
 import pytest
@@ -72,14 +72,14 @@ def detect(self, input_, output_):
 
 dummy_schema = {
     "parserType": "a",
-    "EventID": 0,
+    "eventID": 0,
     "template": "asd",
     "variables": [""],
     "logID": "0",
     "parsedLogID": "22",
     "parserID": "test",
     "log": "This is a parsed log.",
-    "logFormatVariables": {"Time": "12121.12"},
+    "headerVariables": {"Time": "12121.12"},
 }
 
 
@@ -103,8 +103,8 @@ def test_initialize_default(self) -> None:
         assert isinstance(detector, CoreDetector)
         assert detector.name == "TestDetector"
         assert isinstance(detector.config, CoreDetectorConfig)
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
 
     def test_incorrect_config_type(self) -> None:
         dummy_config2 = {
@@ -122,43 +122,43 @@ def test_incorrect_config_type(self) -> None:
 
     def test_process_correct_input_schema(self) -> None:
         detector = MockupDetector(name="TestDetector", config=dummy_config)
-        data = schemas.ParserSchema(dummy_schema).serialize()
+        data = sc.ParserSchema(dummy_schema).serialize()
         result = detector.process(data)  # no error should be produced
         assert isinstance(result, bytes)  # and result should be bytes
 
     def test_process_input_schema_not_serialized(self) -> None:
         detector = MockupDetector(name="TestDetector", config=MockupConfig())
-        expected_result = schemas.DetectorSchema({
-            "__version__": "1.0.0",
+        expected_result = sc.DetectorSchema({
+            "__version__": "2.0.0",
             "detectorID": "TestDetector",
             "detectorType": "core_detector",
             "alertID": "TestDetector_10",
-            "detectionTimestamp": 0,
+            "detectedTimestamp": 0,
             "logIDs": ["0"],
             "score": 0.9,
             "description": "hii",
-            "extractedTimestamps": [12121],
+            "logTimestamps": [12121],
             "receivedTimestamp": 0,
         })
-        data = schemas.ParserSchema(dummy_schema)
+        data = sc.ParserSchema(dummy_schema)
         result = detector.process(data)
         assert result == expected_result, f"result -> {result}"
 
     def test_process_input_schema_not_serialized_window_3(self) -> None:
         detector = MockupDetector_window(name="TestDetector", config=MockupConfig())
-        expected_result = schemas.DetectorSchema({
-            "__version__": "1.0.0",
+        expected_result = sc.DetectorSchema({
+            "__version__": "2.0.0",
             "detectorID": "TestDetector",
             "detectorType": "core_detector",
             "alertID": "TestDetector_10",
-            "detectionTimestamp": 0,
+            "detectedTimestamp": 0,
             "logIDs": ["0", "0", "0"],
             "score": 0.9,
             "description": "hii",
-            "extractedTimestamps": [12121, 12121, 12121],
+            "logTimestamps": [12121, 12121, 12121],
             "receivedTimestamp": 0
         })
-        data = schemas.ParserSchema(dummy_schema)
+        data = sc.ParserSchema(dummy_schema)
 
         assert detector.process(data) is None
         assert detector.process(data) is None
@@ -168,19 +168,19 @@ def test_process_input_schema_not_serialized_window_3(self) -> None:
 
     def test_process_input_schema_not_serialized_buffer_3(self) -> None:
         detector = MockupDetector_window(name="TestDetector01", config=MockupConfig())
-        expected_result = schemas.DetectorSchema({
-            "__version__": "1.0.0",
+        expected_result = sc.DetectorSchema({
+            "__version__": "2.0.0",
             "detectorID": "TestDetector01",
             "detectorType": "core_detector",
             "alertID": "TestDetector01_10",
-            "detectionTimestamp": 0,
+            "detectedTimestamp": 0,
             "logIDs": ["0", "0", "0"],
             "score": 0.9,
             "description": "hii",
-            "extractedTimestamps": [12121, 12121, 12121],
+            "logTimestamps": [12121, 12121, 12121],
             "receivedTimestamp": 0,
         })
-        data = schemas.ParserSchema(dummy_schema)
+        data = sc.ParserSchema(dummy_schema)
 
         assert detector.process(data) is None
         assert detector.process(data) is None
@@ -190,7 +190,7 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
 
     def test_none_detector(self) -> None:
         detector = NoneMockupDetector(name="TestDetector", config=MockupConfig())
-        data = schemas.ParserSchema(dummy_schema)
+        data = sc.ParserSchema(dummy_schema)
 
         assert detector.process(data) is None
         assert detector.process(data) is not None
diff --git a/tests/test_common/test_core_parser.py b/tests/test_common/test_core_parser.py
index 18e34f28..3d4cc05b 100644
--- a/tests/test_common/test_core_parser.py
+++ b/tests/test_common/test_core_parser.py
@@ -1,6 +1,6 @@
 from detectmatelibrary.common.parser import CoreParser, CoreParserConfig, get_format_variables
 from detectmatelibrary.utils.aux import time_test_mode
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pydantic
 import pytest
@@ -16,7 +16,7 @@ def __init__(self, name: str, config: CoreParserConfig) -> None:
         super().__init__(name=name, config=config)
 
     def parse(self, input_, output_):
-        output_.EventID = 1
+        output_.eventID = 1
         output_.template = "hello"
         output_.variables = ["a", "b"]
 
@@ -26,7 +26,7 @@ def __init__(self, name: str, config: CoreParserConfig) -> None:
         super().__init__(name=name, config=config)
 
     def parse(self, input_, output_):
-        output_.EventID = 1
+        output_.eventID = 1
         output_.variables = ["a", "b"]
 
 
@@ -38,7 +38,7 @@ def __init__(self, name: str, config: CoreParserConfig) -> None:
     def parse(self, input_, output_):
         self.value = not self.value
 
-        output_.EventID = 1
+        output_.eventID = 1
         output_.template = "hello"
         output_.variables = ["a", "b"]
 
@@ -64,8 +64,8 @@ def test_initialize_default(self) -> None:
         assert isinstance(parser, CoreParser)
         assert parser.name == "TestParser"
         assert isinstance(parser.config, CoreParserConfig)
-        assert parser.input_schema == schemas.LogSchema
-        assert parser.output_schema == schemas.ParserSchema
+        assert parser.input_schema == sc.LogSchema
+        assert parser.output_schema == sc.ParserSchema
 
     def test_incorrect_config_type(self) -> None:
         invalid_args = {
@@ -82,17 +82,17 @@ def test_incorrect_config_type(self) -> None:
 
     def test_process_correct_input_schema(self) -> None:
         parser = MockupParser(name="TestParser", config=default_args)
-        data = schemas.LogSchema({"logID": "1", "log": "This is a log."}).serialize()
+        data = sc.LogSchema({"logID": "1", "log": "This is a log."}).serialize()
         result = parser.process(data)  # no error should be produced
         assert isinstance(result, bytes)  # and result should be bytes
 
     def test_process_correct_input_schema_not_serialize(self) -> None:
         parser = MockupParser(name="TestParser", config=MockupConfig())
-        expected_result = schemas.ParserSchema({
-            "__version__": "1.0.0",
+        expected_result = sc.ParserSchema({
+            "__version__": "2.0.0",
             "parserType": "core_parser",
             "parserID": "TestParser",
-            "EventID": 1,
+            "eventID": 1,
             "template": "hello",
             "parsedLogID": "TestParser_10",
             "logID": "1",
@@ -101,16 +101,16 @@ def test_process_correct_input_schema_not_serialize(self) -> None:
             "parsedTimestamp": 0,
         })
         expected_result.variables = ["a", "b"]
-        expected_result.logFormatVariables["Time"] = "0"
+        expected_result.headerVariables["Time"] = "0"
 
-        data = schemas.LogSchema({"logID": "1", "log": "This is a log."})
+        data = sc.LogSchema({"logID": "1", "log": "This is a log."})
         result = parser.process(data)
 
         assert result == expected_result, f"results {result} and expected {expected_result}"
 
     def test_process_ids(self) -> None:
         parser = MockupParser(name="TestParser", config=MockupConfig())
-        data = schemas.LogSchema({
+        data = sc.LogSchema({
             "logID": "1", "log": "This is a log.", "logSource": "", "hostname": ""
         })
 
@@ -122,7 +122,7 @@ def test_process_ids(self) -> None:
 
     def test_none_parser(self) -> None:
         parser = NoneMockupParser(name="TestParser", config=MockupConfig())
-        data = schemas.LogSchema({
+        data = sc.LogSchema({
             "logID": "1", "log": "This is a log.", "logSource": "", "hostname": ""
         })
 
diff --git a/tests/test_common/test_extract_timestamp.py b/tests/test_common/test_extract_timestamp.py
index 304a3401..f441851e 100644
--- a/tests/test_common/test_extract_timestamp.py
+++ b/tests/test_common/test_extract_timestamp.py
@@ -1,5 +1,5 @@
 from detectmatelibrary.common.detector import _extract_timestamp
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 
 class TestCoreDetector:
@@ -8,14 +8,14 @@ def test_various_time_formats(self) -> None:
         formats."""
         dummy_schema = {
             "parserType": "a",
-            "EventID": 0,
+            "eventID": 0,
             "template": "asd",
             "variables": [""],
             "logID": "0",
             "parsedLogID": "22",
             "parserID": "test",
             "log": "This is a parsed log.",
-            "logFormatVariables": {"Time": "12121"},
+            "headerVariables": {"Time": "12121"},
         }
         # Compute expected value for timezone-naive formats at runtime
         EXPECTED_UTC = 1772633880
@@ -50,7 +50,7 @@ def test_various_time_formats(self) -> None:
             ("Wednesday, March 4, 2026 14:18:00", EXPECTED_UTC),
         ]
         for time_str, expected in test_cases:
-            schema = schemas.ParserSchema({**dummy_schema, "logFormatVariables": {"Time": time_str}})
+            schema = sc.ParserSchema({**dummy_schema, "headerVariables": {"Time": time_str}})
             result = _extract_timestamp(schema)
             assert result == [expected], (
                 f"Format '{time_str}': expected [{expected}], got {result}"
@@ -59,23 +59,23 @@ def test_various_time_formats(self) -> None:
     def test_microsecond_epoch_fits_the_schema(self) -> None:
         """Issue #271: a microsecond epoch folded only once landed in
         milliseconds and overflowed the int32 timestamp fields."""
-        schema = schemas.DetectorSchema({
-            "extractedTimestamps": _extract_timestamp(
-                schemas.ParserSchema({"logFormatVariables": {"Time": "1643114452000000"}})
+        schema = sc.DetectorSchema({
+            "logTimestamps": _extract_timestamp(
+                sc.ParserSchema({"headerVariables": {"Time": "1643114452000000"}})
             ),
         })
         assert str(schema)  # rebuilds the protobuf -- used to raise ValueError
-        assert schema["extractedTimestamps"] == [1643114452]
+        assert schema["logTimestamps"] == [1643114452]
 
     def test_timestamp_fields_hold_more_than_int32(self) -> None:
         """Timestamps are int64, so they survive 2038 (and a stray ms
         value)."""
         for schema, field, value in [
-            (schemas.ParserSchema(), "receivedTimestamp", 2**31),
-            (schemas.ParserSchema(), "parsedTimestamp", 2**31),
-            (schemas.DetectorSchema(), "detectionTimestamp", 2**31),
-            (schemas.DetectorSchema(), "receivedTimestamp", 1643114452000),
-            (schemas.AggregateSchema(), "outputTimestamp", 2**31),
+            (sc.ParserSchema(), "receivedTimestamp", 2**31),
+            (sc.ParserSchema(), "parsedTimestamp", 2**31),
+            (sc.DetectorSchema(), "detectedTimestamp", 2**31),
+            (sc.DetectorSchema(), "receivedTimestamp", 1643114452000),
+            (sc.AggregateSchema(), "aggregatedTimestamp", 2**31),
         ]:
             schema[field] = value
             assert getattr(schema.get_schema(), field) == value
diff --git a/tests/test_common/test_train_buffer.py b/tests/test_common/test_train_buffer.py
index 4f1fa4c2..665e49ae 100644
--- a/tests/test_common/test_train_buffer.py
+++ b/tests/test_common/test_train_buffer.py
@@ -5,19 +5,19 @@
 
 import pytest
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.common._core_op._train_buffer import TrainBuffer
 from detectmatelibrary.utils.data_buffer import ArgsBuffer, BufferMode, DataBuffer
 
 _MOD = "detectmatelibrary.common._core_op._train_buffer"
 
 
-def _log(i: int) -> schemas.BaseSchema:
+def _log(i: int) -> sc.BaseSchema:
     # .copy() gives the BaseSchema that CoreComponent actually buffers
-    return schemas.LogSchema({"logID": str(i), "logSource": "test", "hostname": "h"}).copy()
+    return sc.LogSchema({"logID": str(i), "logSource": "test", "hostname": "h"}).copy()
 
 
-def _windows(n: int, size: int, start: int = 0) -> list[list[schemas.BaseSchema]]:
+def _windows(n: int, size: int, start: int = 0) -> list[list[sc.BaseSchema]]:
     """Sliding windows over logs start..start+n-1, as a WINDOW-mode
     CoreComponent buffers them."""
     data_buffer = DataBuffer(ArgsBuffer(BufferMode.WINDOW, size=size))
@@ -26,13 +26,13 @@ def _windows(n: int, size: int, start: int = 0) -> list[list[schemas.BaseSchema]
 
 def _count_serialize(monkeypatch) -> dict[str, int]:
     calls = {"n": 0}
-    real = schemas.BaseSchema.serialize
+    real = sc.BaseSchema.serialize
 
     def counting(self):
         calls["n"] += 1
         return real(self)
 
-    monkeypatch.setattr(schemas.BaseSchema, "serialize", counting)
+    monkeypatch.setattr(sc.BaseSchema, "serialize", counting)
     return calls
 
 
@@ -46,7 +46,7 @@ def _ids(records) -> list[str]:
 
 def _buffer(tmp_path: Path, max_records: int, window: int | None = None, name: str = "c") -> TrainBuffer:
     return TrainBuffer(
-        schemas.LogSchema, max_records=max_records, spill_dir=str(tmp_path), window=window, name=name
+        sc.LogSchema, max_records=max_records, spill_dir=str(tmp_path), window=window, name=name
     )
 
 
@@ -73,7 +73,7 @@ def test_spill_replays_all_records_in_order(self, tmp_path):
         assert len(list(run.glob("*.parquet"))) == 3
         out = list(buf)
         assert _ids(out) == [str(i) for i in range(10)]
-        assert all(r.schema_class is schemas.LogSchema().schema_class for r in out)
+        assert all(r.schema_class is sc.LogSchema().schema_class for r in out)
         assert _run_dirs(tmp_path) == []
 
     def test_spilled_batches_replay_in_order(self, tmp_path):
@@ -126,7 +126,7 @@ def records(start):
 
     def test_default_dir_is_the_system_temp_dir(self, tmp_path, monkeypatch):
         monkeypatch.setattr(tempfile, "tempdir", str(tmp_path))
-        buf = TrainBuffer(schemas.LogSchema, max_records=1, name="c")
+        buf = TrainBuffer(sc.LogSchema, max_records=1, name="c")
         buf.add(_log(0))
         assert len(_run_dirs(tmp_path)) == 1
         assert _ids(buf) == ["0"]
diff --git a/tests/test_detectors/test_auto_config_params_survive.py b/tests/test_detectors/test_auto_config_params_survive.py
index 32fb0147..f2a62439 100644
--- a/tests/test_detectors/test_auto_config_params_survive.py
+++ b/tests/test_detectors/test_auto_config_params_survive.py
@@ -30,10 +30,10 @@
 def _schema(event_id: int, level: str, log_id: str):
     return {
         "logID": log_id,
-        "EventID": event_id,
+        "eventID": event_id,
         "template": "user <*> from <*>",
         "variables": ["alice", "10.0.0.1"],
-        "logFormatVariables": {"user": "alice", "src": "10.0.0.1", "level": level},
+        "headerVariables": {"user": "alice", "src": "10.0.0.1", "level": level},
     }
 
 
diff --git a/tests/test_detectors/test_bigram_frequency_detector.py b/tests/test_detectors/test_bigram_frequency_detector.py
index b92f0b77..e52a6b78 100644
--- a/tests/test_detectors/test_bigram_frequency_detector.py
+++ b/tests/test_detectors/test_bigram_frequency_detector.py
@@ -17,7 +17,7 @@
 from detectmatelibrary.constants import GLOBAL_EVENT_ID
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 # Set time test mode for consistent timestamps
@@ -107,8 +107,8 @@ def test_default_initialization(self):
         assert detector.name == "BigramFrequencyDetector"
         assert hasattr(detector, 'config')
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, 'persistency')
 
     def test_custom_config_initialization(self):
@@ -129,16 +129,16 @@ def test_train_multiple_values(self):
         # Train with multiple values (only event 1 should be tracked per config)
         for event in range(3):
             for level in ["INFO", "WARNING", "ERROR"]:
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["0", "assa"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {"level": level}
+                    "headerVariables": {"level": level}
                 })
                 detector.train(parser_data)
 
@@ -161,32 +161,32 @@ def test_detect_known_value_no_alert(self):
         detector = BigramFrequencyDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 12,
+            "eventID": 12,
             "template": "test template",
             "variables": ["adsasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -197,32 +197,32 @@ def test_detect_known_value_alert(self):
         detector = BigramFrequencyDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -271,7 +271,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -314,7 +314,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -389,9 +389,9 @@ def test_global_instance_detects_new_type(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
-                assert all(key.startswith("Global -") for key in output["alertsObtain"])
+                assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
 
         assert len(detected_ids) > 0
@@ -417,16 +417,16 @@ def test_set_configuration_preserves_persist(self):
 
 
 def _parser_data(event_id, level, var_value):
-    return schemas.ParserSchema({
+    return sc.ParserSchema({
         "parserType": "test",
-        "EventID": event_id,
+        "eventID": event_id,
         "template": "test template",
         "variables": ["0", var_value],
         "logID": "1",
         "parsedLogID": "1",
         "parserID": "test_parser",
         "log": "test log message",
-        "logFormatVariables": {"level": level},
+        "headerVariables": {"level": level},
     })
 
 
@@ -478,18 +478,18 @@ def test_detect_helper_survives_missing_variable(self):
         detector.train(_parser_data(1, "INFO", "abc"))
 
         # Detect with a parser line that lacks the 'test' variable
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["0"],  # only pos 0 — no value at pos 1
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"},
+            "headerVariables": {"level": "INFO"},
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         # Must not raise TypeError
         result = detector.detect(test_data, output)
         assert isinstance(result, bool)
@@ -504,7 +504,7 @@ def test_default_freqs_false_does_not_consult_fallback(self):
         # Detect a typical English-looking value. Without fallback, sparse
         # per-var table → low prob → alert expected.
         test_data = _parser_data(1, "INFO", "the")
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(test_data, output)
         assert result is True
 
@@ -535,7 +535,7 @@ def test_default_freqs_true_consults_fallback(self):
 
         # Detect a common English word — fallback should produce non-zero probs
         test_data = _parser_data(1, "INFO", "the")
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(test_data, output)
         assert result is False
 
@@ -625,16 +625,16 @@ def test_two_variables_have_independent_freq_tables(self):
             }
         }
         detector = BigramFrequencyDetector(config=cfg, name="TwoVarDetector")
-        parser_data = schemas.ParserSchema({
+        parser_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["abc", "xyz"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {},
+            "headerVariables": {},
         })
         detector.train(parser_data)
 
diff --git a/tests/test_detectors/test_charset_detector.py b/tests/test_detectors/test_charset_detector.py
index 2aabd081..0a49b03c 100644
--- a/tests/test_detectors/test_charset_detector.py
+++ b/tests/test_detectors/test_charset_detector.py
@@ -15,7 +15,7 @@
 from detectmatelibrary.constants import GLOBAL_EVENT_ID
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 
@@ -74,8 +74,8 @@ def test_default_initialization(self):
         assert detector.name == "CharsetDetector"
         assert hasattr(detector, 'config')
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, 'persistency')
 
     def test_custom_config_initialization(self):
@@ -120,16 +120,16 @@ def test_train_multiple_values(self):
         # Train with multiple values (only event 1 should be tracked per config)
         for event in range(3):
             for level in ["INFO", "WARNING", "ERROR"]:
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["0", "assa"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {"level": level}
+                    "headerVariables": {"level": level}
                 })
                 detector.train(parser_data)
 
@@ -151,32 +151,32 @@ def test_detect_known_value_no_alert(self):
         detector = CharsetDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 12,
+            "eventID": 12,
             "template": "test template",
             "variables": ["adsasddddddaaa"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -187,32 +187,32 @@ def test_detect_known_value_alert(self):
         detector = CharsetDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["asas", "adsd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -241,33 +241,33 @@ def test_detect_unknown_chars_reported_per_variable(self):
         }
         detector = CharsetDetector(config=cfg, name="Single")
 
-        train = schemas.ParserSchema({
-            "parserType": "test", "EventID": 1, "template": "t",
+        train = sc.ParserSchema({
+            "parserType": "test", "eventID": 1, "template": "t",
             "variables": ["abc"], "logID": "1", "parsedLogID": "1",
-            "parserID": "p", "log": "l", "logFormatVariables": {},
+            "parserID": "p", "log": "l", "headerVariables": {},
         })
         detector.train(train)
 
         # All known chars
-        ok = schemas.ParserSchema({
-            "parserType": "test", "EventID": 1, "template": "t",
+        ok = sc.ParserSchema({
+            "parserType": "test", "eventID": 1, "template": "t",
             "variables": ["cba"], "logID": "2", "parsedLogID": "2",
-            "parserID": "p", "log": "l", "logFormatVariables": {},
+            "parserID": "p", "log": "l", "headerVariables": {},
         })
-        out = schemas.DetectorSchema()
+        out = sc.DetectorSchema()
         assert not detector.detect(ok, out)
         assert out.score == 0.0
 
         # Unknown chars 'x' and 'y'
-        bad = schemas.ParserSchema({
-            "parserType": "test", "EventID": 1, "template": "t",
+        bad = sc.ParserSchema({
+            "parserType": "test", "eventID": 1, "template": "t",
             "variables": ["axy"], "logID": "3", "parsedLogID": "3",
-            "parserID": "p", "log": "l", "logFormatVariables": {},
+            "parserID": "p", "log": "l", "headerVariables": {},
         })
-        out = schemas.DetectorSchema()
+        out = sc.DetectorSchema()
         assert detector.detect(bad, out)
         assert out.score == 1.0
-        assert any("'x'" in msg and "'y'" in msg for msg in out["alertsObtain"].values())
+        assert any("'x'" in msg and "'y'" in msg for msg in out["alertDetails"].values())
 
 
 _PARSER_CONFIG = {
@@ -307,7 +307,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -335,7 +335,7 @@ def test_audit_log_anomalies_to_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector2.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -443,9 +443,9 @@ def test_global_instance_detects_new_type(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
-                assert all(key.startswith("Global -") for key in output["alertsObtain"])
+                assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
 
         assert len(detected_ids) > 0
@@ -459,11 +459,11 @@ def test_persist_flag_survives_set_configuration(self):
 
         # Feed configure() with a couple of stable-variable samples
         for _ in range(5):
-            sample = schemas.ParserSchema({
-                "parserType": "test", "EventID": 1, "template": "t",
+            sample = sc.ParserSchema({
+                "parserType": "test", "eventID": 1, "template": "t",
                 "variables": ["abc"], "logID": "x", "parsedLogID": "x",
                 "parserID": "p", "log": "l",
-                "logFormatVariables": {"level": "INFO"},
+                "headerVariables": {"level": "INFO"},
             })
             detector.configure(sample)
 
diff --git a/tests/test_detectors/test_deeplog_detector.py b/tests/test_detectors/test_deeplog_detector.py
index c4b9d8ad..5d8ebc08 100644
--- a/tests/test_detectors/test_deeplog_detector.py
+++ b/tests/test_detectors/test_deeplog_detector.py
@@ -10,7 +10,7 @@
 
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pytest
 
@@ -35,7 +35,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                deeplog.process(schemas.ParserSchema({"EventID": i}))
+                deeplog.process(sc.ParserSchema({"eventID": i}))
 
             if j == 0:
                 assert deeplog.get_state() == "Configuring"
@@ -44,7 +44,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for _ in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                deeplog.process(schemas.ParserSchema({"EventID": i}))
+                deeplog.process(sc.ParserSchema({"eventID": i}))
         assert deeplog.get_state() == "Default"
 
     @pytest.mark.ignored
@@ -79,7 +79,7 @@ def test_end2end_no_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                deeplog.process(schemas.ParserSchema({"EventID": i}))
+                deeplog.process(sc.ParserSchema({"eventID": i}))
             if j == 0:
                 assert deeplog.get_state() == "Training"
 
diff --git a/tests/test_detectors/test_ecvc_detector.py b/tests/test_detectors/test_ecvc_detector.py
index f2b4e380..b48fe650 100644
--- a/tests/test_detectors/test_ecvc_detector.py
+++ b/tests/test_detectors/test_ecvc_detector.py
@@ -15,7 +15,7 @@
 class TestECVCOP:
     def test_build_count_vec(self):
         input_ = [
-            schemas.ParserSchema({"EventID": i}) for i in [0, 1, 4, 0]
+            schemas.ParserSchema({"eventID": i}) for i in [0, 1, 4, 0]
         ]
         expected = tuple([2, 1, 0, 0, 1])
 
@@ -23,7 +23,7 @@ def test_build_count_vec(self):
 
     def test_build_one_vec(self):
         input_ = [
-            schemas.ParserSchema({"EventID": i}) for i in [0, 1, 4, 0]
+            schemas.ParserSchema({"eventID": i}) for i in [0, 1, 4, 0]
         ]
 
         expected = np.array([2, 1, 0, 0, 1, 0, 0, 0])
@@ -93,7 +93,7 @@ def test_ecvc(self):
 
         input_ = []
         for _ in range(10):
-            input_.extend([schemas.ParserSchema({"EventID": i}) for i in [0, 1, 4, 0]])
+            input_.extend([schemas.ParserSchema({"eventID": i}) for i in [0, 1, 4, 0]])
 
         for in_ in input_:
             ecvc.process(in_)
@@ -103,7 +103,7 @@ def test_ecvc(self):
             alert = ecvc.process(in_)
         assert alert is None
 
-        for in_ in [schemas.ParserSchema({"EventID": i}) for i in [4, 4, 4, 4, 4, 4, 1, 0, 1, 1]]:
+        for in_ in [schemas.ParserSchema({"eventID": i}) for i in [4, 4, 4, 4, 4, 4, 1, 0, 1, 1]]:
             alert = ecvc.process(in_)
         assert alert is not None
 
@@ -209,7 +209,7 @@ def test_audit_log_anomalie_fed(self):
 
 
 def _window(event_ids):
-    return [schemas.ParserSchema({"EventID": i}) for i in event_ids]
+    return [schemas.ParserSchema({"eventID": i}) for i in event_ids]
 
 
 def _fed_detector(window_size):
diff --git a/tests/test_detectors/test_event_sequence_detector.py b/tests/test_detectors/test_event_sequence_detector.py
index 614ab0f9..6c2c6a8a 100644
--- a/tests/test_detectors/test_event_sequence_detector.py
+++ b/tests/test_detectors/test_event_sequence_detector.py
@@ -17,7 +17,7 @@
 )
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.base_detectors import PersistConfig
 from detectmatelibrary.common._core_op._fit_logic import EnumState
 from detectmatelibrary.utils.aux import time_test_mode
@@ -48,16 +48,16 @@
 
 
 def _make_schema(event_id, template="test template", log_id="1", log_format_variables=None):
-    return schemas.ParserSchema({
+    return sc.ParserSchema({
         "parserType": "test",
-        "EventID": event_id,
+        "eventID": event_id,
         "template": template,
         "variables": ["adsasd", "asdasd"],
         "logID": log_id,
         "parsedLogID": log_id,
         "parserID": "test_parser",
         "log": "test log message",
-        "logFormatVariables": log_format_variables or {"level": "INFO"}
+        "headerVariables": log_format_variables or {"level": "INFO"}
     })
 
 
@@ -70,8 +70,8 @@ def test_default_initialization(self):
         assert detector.name == "EventSequenceDetector"
         assert hasattr(detector, "config")
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, "persistency")
         # unconfigured until auto-config picks a length
         assert detector.config.fixed_window_size is None
@@ -121,8 +121,8 @@ def test_detect_known_sequence_no_alert(self):
             detector.train(_make_schema(event_id))
         # The detection window is independent of the training one, so prime it
         # with a 3 before appending the 1 that completes the known (3, 1)
-        detector.detect(_make_schema(3, log_id="6"), schemas.DetectorSchema())
-        output = schemas.DetectorSchema()
+        detector.detect(_make_schema(3, log_id="6"), sc.DetectorSchema())
+        output = sc.DetectorSchema()
         result = detector.detect(_make_schema(1, log_id="7"), output)
 
         assert not result
@@ -135,19 +135,19 @@ def test_detect_unknown_sequence_alert(self):
             detector.train(_make_schema(event_id))
 
         # (3, 9) was never seen during training
-        detector.detect(_make_schema(3, log_id="6"), schemas.DetectorSchema())
-        output = schemas.DetectorSchema()
+        detector.detect(_make_schema(3, log_id="6"), sc.DetectorSchema())
+        output = sc.DetectorSchema()
         result = detector.detect(_make_schema(9, log_id="7"), output)
 
         assert result
         assert output.score == 1.0
-        assert any("Sequence" in key for key in output["alertsObtain"])
+        assert any("Sequence" in key for key in output["alertDetails"])
 
     def test_detect_below_window_length_no_alert(self):
         detector = EventSequenceDetector(config=config, name="MultipleDetector")
 
         # First event with an empty detector: window not yet full, can't be an anomaly
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(_make_schema(1), output)
 
         assert not result
@@ -161,7 +161,7 @@ def test_reset_window_clears_state(self):
         detector = EventSequenceDetector(config=config, name="MultipleDetector")
 
         detector.train(_make_schema(1))
-        detector.detect(_make_schema(1), schemas.DetectorSchema())
+        detector.detect(_make_schema(1), sc.DetectorSchema())
         assert len(detector._train_window) == 1
         assert len(detector._detect_window) == 1
 
@@ -223,7 +223,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -266,7 +266,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -305,7 +305,7 @@ def test_audit_log_anomalie_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -458,7 +458,7 @@ def test_no_stable_window_size_generates_no_instance(self):
         for event_id in [4, 5, 6, 7]:
             detector.train(_make_schema(event_id))
         assert detector.get_known_sequences() == set()
-        assert not detector.detect(_make_schema(9), schemas.DetectorSchema())
+        assert not detector.detect(_make_schema(9), sc.DetectorSchema())
 
     def test_unstable_stream_generates_no_instance(self):
         """The other route to 'no stable candidate': every window fills and
@@ -488,7 +488,7 @@ def test_unstable_stream_generates_no_instance(self):
         for event_id in [1, 2, 3, 1, 2, 3]:
             detector.train(_make_schema(event_id))
         assert detector.get_known_sequences() == set()
-        assert not detector.detect(_make_schema(9), schemas.DetectorSchema())
+        assert not detector.detect(_make_schema(9), sc.DetectorSchema())
 
     def test_auto_config_off_without_fixed_window_size_is_inert(self):
         detector = EventSequenceDetector(
@@ -500,7 +500,7 @@ def test_auto_config_off_without_fixed_window_size_is_inert(self):
             detector.train(_make_schema(event_id))
 
         assert detector.get_known_sequences() == set()
-        assert not detector.detect(_make_schema(9), schemas.DetectorSchema())
+        assert not detector.detect(_make_schema(9), sc.DetectorSchema())
 
     def test_auto_config_off_stays_inert_through_a_configure_phase(self):
         """A configure window alone must not pick a length: auto_config=False
@@ -598,7 +598,7 @@ def test_reload_adopts_persisted_sequence_length(self):
 
         # the known cycle must not alert under the restored model
         alerted = [
-            det2.detect(_make_schema(event_id), schemas.DetectorSchema())
+            det2.detect(_make_schema(event_id), sc.DetectorSchema())
             for event_id in [1, 2, 3, 1, 2, 3]
         ]
         assert not any(alerted)
diff --git a/tests/test_detectors/test_logbert_detector.py b/tests/test_detectors/test_logbert_detector.py
index 55124a37..1b2859cc 100644
--- a/tests/test_detectors/test_logbert_detector.py
+++ b/tests/test_detectors/test_logbert_detector.py
@@ -10,7 +10,7 @@
 
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pytest
 
@@ -35,7 +35,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                logbert.process(schemas.ParserSchema({"EventID": i}))
+                logbert.process(sc.ParserSchema({"eventID": i}))
 
             if j == 0:
                 assert logbert.get_state() == "Configuring"
@@ -44,7 +44,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for _ in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                logbert.process(schemas.ParserSchema({"EventID": i}))
+                logbert.process(sc.ParserSchema({"eventID": i}))
         assert logbert.get_state() == "Default"
         
     @pytest.mark.ignored
@@ -84,7 +84,7 @@ def test_end2end_no_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                logbert.process(schemas.ParserSchema({"EventID": i}))
+                logbert.process(sc.ParserSchema({"eventID": i}))
             if j == 0:
                 assert logbert.get_state() == "Training"
 
diff --git a/tests/test_detectors/test_mismatch_warnings.py b/tests/test_detectors/test_mismatch_warnings.py
index 40242b0b..a2aec88e 100644
--- a/tests/test_detectors/test_mismatch_warnings.py
+++ b/tests/test_detectors/test_mismatch_warnings.py
@@ -9,7 +9,7 @@
 
 import logging
 import pytest
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.detectors.new_value_detector import NewValueDetector
 from detectmatelibrary.detectors.new_value_combo_detector import NewValueComboDetector
 
@@ -18,17 +18,17 @@ def _make_parser_schema(
     event_id: int,
     variables: list,
     log_format_variables: dict,
-) -> schemas.ParserSchema:
-    return schemas.ParserSchema({
+) -> sc.ParserSchema:
+    return sc.ParserSchema({
         "parserType": "test",
-        "EventID": event_id,
+        "eventID": event_id,
         "template": "test template",
         "variables": variables,
         "logID": "1",
         "parsedLogID": "1",
         "parserID": "test_parser",
         "log": "test log message",
-        "logFormatVariables": log_format_variables,
+        "headerVariables": log_format_variables,
     })
 
 
diff --git a/tests/test_detectors/test_new_event_detector.py b/tests/test_detectors/test_new_event_detector.py
index ebffb4bd..ca02ccbe 100644
--- a/tests/test_detectors/test_new_event_detector.py
+++ b/tests/test_detectors/test_new_event_detector.py
@@ -12,7 +12,7 @@
     BufferMode
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from detectmatelibrary.common._core_op._fit_logic import EnumState
 from detectmatelibrary.constants import GLOBAL_EVENT_ID
@@ -55,8 +55,8 @@ def test_default_initialization(self):
         assert detector.name == "NewEventDetector"
         assert hasattr(detector, 'config')
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, 'persistency')
 
     def test_custom_config_initialization(self):
@@ -76,16 +76,16 @@ def test_train_multiple_event_ids(self):
         detector = NewEventDetector(config=config, name="MultipleDetector")
         event_ids = {0, 3, 8, 9}
         for event in event_ids:
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
-                "EventID": event,
+                "eventID": event,
                 "template": "test template",
                 "variables": ["0", "assa"],
                 "logID": "1",
                 "parsedLogID": "1",
                 "parserID": "test_parser",
                 "log": "test log message",
-                "logFormatVariables": {"level": "INFO"}
+                "headerVariables": {"level": "INFO"}
             })
             detector.train(parser_data)
 
@@ -101,32 +101,32 @@ def test_detect_known_event_id_no_alert(self):
         detector = NewEventDetector(config=config, name="MultipleDetector")
 
         # Train with an event_id
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same event_id
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -171,7 +171,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for i, log in enumerate(logs[TRAIN_UNTIL:]):
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -204,7 +204,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -229,7 +229,7 @@ def test_audit_log_anomalie_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector2.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -303,9 +303,9 @@ def test_global_instance_detects_new_type(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
-                assert all(key.startswith("Global -") for key in output["alertsObtain"])
+                assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
 
         assert len(detected_ids) > 0
@@ -315,7 +315,7 @@ class TestNewEventDetectorFederationCleanup:
     def test_finalize_federation_removes_the_slow_table(self, tmp_path, monkeypatch):
         monkeypatch.chdir(tmp_path)  # the slow store writes .temp/ CSVs here
         detector = NewEventDetector(config=NewEventDetectorConfig(allow_fed=True))
-        detector.train(schemas.ParserSchema({"EventID": 1, "template": "test template"}))
+        detector.train(sc.ParserSchema({"eventID": 1, "template": "test template"}))
         assert (tmp_path / ".temp").exists()
 
         detector.finalize_federation()
diff --git a/tests/test_detectors/test_new_value_combo_detector.py b/tests/test_detectors/test_new_value_combo_detector.py
index 8cdce9c3..c7729a96 100644
--- a/tests/test_detectors/test_new_value_combo_detector.py
+++ b/tests/test_detectors/test_new_value_combo_detector.py
@@ -11,7 +11,7 @@
 from detectmatelibrary.common._config import generate_detector_config
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 
@@ -71,8 +71,8 @@ def test_default_initialization(self):
 
         assert detector.name == "NewValueComboDetector"
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
 
     def test_custom_config_initialization(self):
         detector = NewValueComboDetector(name="CustomInit", config=config)
@@ -89,16 +89,16 @@ def test_train_multiple_values(self):
         # Train with multiple values
         for event in range(3):
             for level in ["INFO", "WARNING", "ERROR"]:
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["0", "assa"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {"level": level}
+                    "headerVariables": {"level": level}
                 })
                 detector.train(parser_data)
 
@@ -113,45 +113,45 @@ def test_detect_known_value_no_alert(self):
         detector = NewValueComboDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "other_value"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 12,
+            "eventID": 12,
             "template": "test template",
             "variables": ["adsasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -162,45 +162,45 @@ def test_detect_known_value_alert(self):
         detector = NewValueComboDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "other_value"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         detector.train(train_data)
 
         # Detect with an unknown combination (pos 1 has a new value)
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "new_unknown_value"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -253,16 +253,16 @@ def test_configure_method_ingests_events(self):
 
         # Configure with sample events
         for event_id in [1, 2, 3]:
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
-                "EventID": event_id,
+                "eventID": event_id,
                 "template": f"Template {event_id}",
                 "variables": ["val1", "val2", "val3"],
                 "logID": str(event_id),
                 "parsedLogID": str(event_id),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {"level": "INFO"}
+                "headerVariables": {"level": "INFO"}
             })
             detector.configure(parser_data)
 
@@ -279,16 +279,16 @@ def test_set_configuration_updates_config(self):
 
         # Configure with events that have varying stability
         for i in range(10):
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Template 1",
                 "variables": ["constant", f"varying_{i}", "another_constant"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {"level": "INFO"}
+                "headerVariables": {"level": "INFO"}
             })
             detector.configure(parser_data)
 
@@ -307,16 +307,16 @@ def test_configuration_workflow(self):
         training_data = []
         for i in range(20):
             for event_id in [1, 2]:
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
-                    "EventID": event_id,
+                    "eventID": event_id,
                     "template": f"Template {event_id}",
                     "variables": ["stable_val", f"var_{i % 3}", "another_stable"],
                     "logID": str(len(training_data)),
                     "parsedLogID": str(len(training_data)),
                     "parserID": "test_parser",
                     "log": "test log",
-                    "logFormatVariables": {"level": "INFO"}
+                    "headerVariables": {"level": "INFO"}
                 })
                 training_data.append(parser_data)
                 detector.configure(parser_data)
@@ -329,18 +329,18 @@ def test_configuration_workflow(self):
             detector.train(data)
 
         # Step 4: Verify detector can detect anomalies
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "Template 1",
             "variables": ["stable_val", "new_value", "another_stable"],
             "logID": "999",
             "parsedLogID": "999",
             "parserID": "test_parser",
             "log": "test log",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         # Should detect anomaly due to new combination
         result = detector.detect(test_data, output)
@@ -352,16 +352,16 @@ def test_set_configuration_with_combo_size(self):
 
         # Configure with multiple variable events
         for i in range(15):
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Multi-var template",
                 "variables": ["v1", "v2", "v3", "v4", "v5"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {}
+                "headerVariables": {}
             })
             detector.configure(parser_data)
 
@@ -377,16 +377,16 @@ def test_configuration_with_no_stable_variables(self):
 
         # Configure with highly variable data
         for i in range(10):
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Variable template",
                 "variables": [f"val_{i}_0", f"val_{i}_1"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {}
+                "headerVariables": {}
             })
             detector.configure(parser_data)
 
@@ -404,16 +404,16 @@ class TestNewValueComboDetectorEndToEnd:
 
     @staticmethod
     def _make_schema(event_id, template, variables, log_format_variables, log_id="1"):
-        return schemas.ParserSchema({
+        return sc.ParserSchema({
             "parserType": "test",
-            "EventID": event_id,
+            "eventID": event_id,
             "template": template,
             "variables": variables,
             "logID": log_id,
             "parsedLogID": log_id,
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": log_format_variables,
+            "headerVariables": log_format_variables,
         })
 
     def test_configure_train_detect_anomalous_combo(self):
@@ -457,7 +457,7 @@ def test_configure_train_detect_anomalous_combo(self):
             ["MALICIOUS_USER", "MALICIOUS_IP"],
             {"username": "MALICIOUS_USER", "src_ip": "MALICIOUS_IP"},
         )
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(anomalous, output)
 
         assert result is True
@@ -501,7 +501,7 @@ def test_configure_train_detect_benign_combo(self):
             ["user1", "192.168.1.100"],
             {"username": "user1", "src_ip": "192.168.1.100"},
         )
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(benign, output)
 
         assert result is False
@@ -547,7 +547,7 @@ def test_configure_only_selects_stable_event_types(self):
             ["hacker", "/etc/shadow"],
             {"username": "hacker", "filepath": "/etc/shadow"},
         )
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(file_event, output)
         assert result is False
 
@@ -583,7 +583,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -610,7 +610,7 @@ def test_audit_log_anomalies_to_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector2.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -644,7 +644,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -670,16 +670,16 @@ def test_classification_fields_survive_set_configuration(self):
         assert detector.config.auto_config is True  # the default (set_configuration-first) path
 
         for i in range(10):
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Template 1",
                 "variables": ["constant", f"varying_{i}", "another_constant"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {"level": "081109 203615"},
+                "headerVariables": {"level": "081109 203615"},
             })
             detector.configure(parser_data)
 
@@ -696,16 +696,16 @@ def _configured(classification: ClassificationMethods) -> NewValueComboDetector:
         )
         detector = NewValueComboDetector(config=cfg, name="NewValueComboDetector")
         for i in range(10):
-            detector.configure(schemas.ParserSchema({
+            detector.configure(sc.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Template 1",
                 "variables": ["constant", f"varying_{i}", "another_constant"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {},
+                "headerVariables": {},
             }))
         return detector
 
@@ -753,16 +753,16 @@ def _records(classification=None):
         for i in range(12):
             # var_0 and var_1 both cycle over 3 values -> both STABLE in pass 1,
             # so pass 2 gets a ("var_0", "var_1") combo tracker to look at.
-            detector.configure(schemas.ParserSchema({
+            detector.configure(sc.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Template 1",
                 "variables": [f"a{i % 3}", f"b{i % 3}", "constant"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {"ts": str(1700000000 + i * 60)},
+                "headerVariables": {"ts": str(1700000000 + i * 60)},
             }))
         return detector
 
@@ -837,10 +837,10 @@ class TestNewValueComboDetectorConfigureSpill:
     afterwards."""
 
     @staticmethod
-    def _record(i: int) -> schemas.ParserSchema:
-        return schemas.ParserSchema({
+    def _record(i: int) -> sc.ParserSchema:
+        return sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "Template 1",
             "variables": [f"a{min(i, 3)}", f"b{min(i, 4)}", f"c{min(i, 2)}"],
             "logID": str(i),
@@ -913,16 +913,16 @@ class TestNewValueComboDetectorAllCombos:
 
     @staticmethod
     def _record(variables, log_format_variables=None, event_id=1, log_id="1"):
-        return schemas.ParserSchema({
+        return sc.ParserSchema({
             "parserType": "test",
-            "EventID": event_id,
+            "eventID": event_id,
             "template": "Template 1",
             "variables": variables,
             "logID": log_id,
             "parsedLogID": log_id,
             "parserID": "test_parser",
             "log": "test log",
-            "logFormatVariables": log_format_variables or {},
+            "headerVariables": log_format_variables or {},
         })
 
     @staticmethod
@@ -959,10 +959,10 @@ def test_unseen_value_pair_in_a_later_combo_alerts(self):
         detector.train(self._record(["b", "y"], {"level": "ERROR"}))
 
         # ("a", "x") is known to the first combo; ("a", "ERROR") is new to the second
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         assert detector.detect(self._record(["a", "x"], {"level": "ERROR"}), output)
         assert output.score == 1.0
-        assert list(output.alertsObtain) == ["EventID 1 - ('var_0', 'level')"]
+        assert list(output.alertDetails) == ["EventID 1 - ('var_0', 'level')"]
 
     def test_every_combo_is_trained(self):
         detector = self._two_combos()
@@ -971,7 +971,7 @@ def test_every_combo_is_trained(self):
         trackers = detector.persistency.get_events_data()[1].get_data()
         assert list(trackers) == [("var_0", "var_1"), ("var_0", "level")]
         assert not detector.detect(
-            self._record(["a", "x"], {"level": "INFO"}), schemas.DetectorSchema()
+            self._record(["a", "x"], {"level": "INFO"}), sc.DetectorSchema()
         )
 
     def test_combo_with_a_missing_variable_is_skipped(self):
@@ -984,7 +984,7 @@ def test_combo_with_a_missing_variable_is_skipped(self):
         assert list(trackers) == [("var_0", "var_1"), ("var_0", "level")]
         assert trackers[("var_0", "level")].unique_set == {("a", "INFO")}
 
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         assert not detector.detect(self._record(["b", "y"]), output)
         assert not detector.detect(self._record(["new"]), output)
 
@@ -1000,7 +1000,7 @@ def test_every_combo_survives_federation(self, tmp_path, monkeypatch):
         assert trackers[("var_0", "var_1")].unique_set == {("a", "x"), ("b", "y")}
         assert trackers[("var_0", "level")].unique_set == {("a", "INFO"), ("b", "ERROR")}
         assert received.detect(
-            self._record(["a", "x"], {"level": "ERROR"}), schemas.DetectorSchema()
+            self._record(["a", "x"], {"level": "ERROR"}), sc.DetectorSchema()
         )
 
     @staticmethod
@@ -1008,7 +1008,7 @@ def _configured(header_order):
         """Configure a detector whose header variables reach the first pass in
         ``header_order``.
 
-        ParserSchema keeps logFormatVariables in a protobuf map, whose
+        ParserSchema keeps headerVariables in a protobuf map, whose
         iteration order changes from process to process, so the order is
         fixed here by feeding the first-pass store directly.
         """
diff --git a/tests/test_detectors/test_new_value_detector.py b/tests/test_detectors/test_new_value_detector.py
index 283c4fbf..acb39231 100644
--- a/tests/test_detectors/test_new_value_detector.py
+++ b/tests/test_detectors/test_new_value_detector.py
@@ -14,7 +14,7 @@
 from detectmatelibrary.constants import GLOBAL_EVENT_ID
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 
@@ -75,8 +75,8 @@ def test_default_initialization(self):
         assert detector.name == "NewValueDetector"
         assert hasattr(detector, 'config')
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, 'persistency')
 
     def test_custom_config_initialization(self):
@@ -97,16 +97,16 @@ def test_train_multiple_values(self):
         # Train with multiple values (only event 1 should be tracked per config)
         for event in range(3):
             for level in ["INFO", "WARNING", "ERROR"]:
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["0", "assa"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {"level": level}
+                    "headerVariables": {"level": level}
                 })
                 detector.train(parser_data)
 
@@ -129,32 +129,32 @@ def test_detect_known_value_no_alert(self):
         detector = NewValueDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 12,
+            "eventID": 12,
             "template": "test template",
             "variables": ["adsasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -165,32 +165,32 @@ def test_detect_known_value_alert(self):
         detector = NewValueDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -235,7 +235,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -263,7 +263,7 @@ def test_audit_log_anomalies_to_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector2.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -297,7 +297,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -347,16 +347,16 @@ def test_auto_config_off_keeps_explicit_events_through_configure_phase(self):
         explicit_events = detector.config.events.model_dump()
 
         for i in range(20):
-            detector.process(schemas.ParserSchema({
+            detector.process(sc.ParserSchema({
                 "parserType": "test",
-                "EventID": [1, 2, 3][i % 3],
+                "eventID": [1, 2, 3][i % 3],
                 "template": "test template",
                 "variables": ["same", str(i)],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log message",
-                "logFormatVariables": {"level": "INFO", "Time": str(1_700_000_000 + i)},
+                "headerVariables": {"level": "INFO", "Time": str(1_700_000_000 + i)},
             }))
 
         assert detector.config.events.model_dump() == explicit_events
@@ -398,9 +398,9 @@ def test_global_instance_detects_new_type(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
-                assert all(key.startswith("Global -") for key in output["alertsObtain"])
+                assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
 
         assert len(detected_ids) > 0
diff --git a/tests/test_detectors/test_persist_integration.py b/tests/test_detectors/test_persist_integration.py
index 0564a595..a31412c3 100644
--- a/tests/test_detectors/test_persist_integration.py
+++ b/tests/test_detectors/test_persist_integration.py
@@ -289,7 +289,7 @@ def ingest_loop():
 
 
 def _window(event_ids):
-    return [schemas.ParserSchema({"EventID": i}) for i in event_ids]
+    return [schemas.ParserSchema({"eventID": i}) for i in event_ids]
 
 
 class TestStatelessComponents:
diff --git a/tests/test_detectors/test_pre_tracker_state.py b/tests/test_detectors/test_pre_tracker_state.py
index 988d3912..8631c138 100644
--- a/tests/test_detectors/test_pre_tracker_state.py
+++ b/tests/test_detectors/test_pre_tracker_state.py
@@ -36,7 +36,7 @@
 
 def _event(event_id: int, variables: list[str] | None = None) -> schemas.ParserSchema:
     return schemas.ParserSchema({
-        "EventID": event_id, "template": "login <*>", "variables": variables or [], "logID": "1",
+        "eventID": event_id, "template": "login <*>", "variables": variables or [], "logID": "1",
     })
 
 
diff --git a/tests/test_detectors/test_random_detector.py b/tests/test_detectors/test_random_detector.py
index 886ef1d4..af12e915 100644
--- a/tests/test_detectors/test_random_detector.py
+++ b/tests/test_detectors/test_random_detector.py
@@ -1,5 +1,5 @@
 from detectmatelibrary.detectors.random_detector import RandomDetector
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 
 from copy import deepcopy
@@ -49,24 +49,24 @@ class TestRandomDetectorEdgeCases:
     def test_random_seed_consistency(self):
 
         detector = RandomDetector(name="TestDetector", config=deepcopy(config))
-        parser_data = schemas.ParserSchema({
+        parser_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["var1"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"timestamp": "123456"}
+            "headerVariables": {"timestamp": "123456"}
         })
-        detector_output = schemas.DetectorSchema()
+        detector_output = sc.DetectorSchema()
 
         # Multiple calls should return consistent results when mocked
         result1 = detector.detect(parser_data, detector_output)
 
         # Reset output for second call
-        detector_output = schemas.DetectorSchema()
+        detector_output = sc.DetectorSchema()
         result2 = detector.detect(parser_data, detector_output)
 
         assert result1 == result2
diff --git a/tests/test_detectors/test_rule_detector.py b/tests/test_detectors/test_rule_detector.py
index 5cb023f0..7c34de29 100644
--- a/tests/test_detectors/test_rule_detector.py
+++ b/tests/test_detectors/test_rule_detector.py
@@ -1,62 +1,62 @@
 import detectmatelibrary.detectors.rule_detector as rd
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pytest
 
 
 class TestCaseRules:
     def test_template_not_found(self) -> None:
-        parsed_log = schemas.ParserSchema({"EventID": -1})
+        parsed_log = sc.ParserSchema({"eventID": -1})
         alert, msg = rd.template_not_found(parsed_log)
         assert alert
         assert "No template found by parser" == msg
 
-        parsed_log = schemas.ParserSchema({"EventID": 2})
+        parsed_log = sc.ParserSchema({"eventID": 2})
         alert, _ = rd.template_not_found(parsed_log)
         assert not alert
 
     def test_find_keyword(self) -> None:
         keywords = ["hello", "ciao"]
 
-        parsed_log = schemas.ParserSchema({"log": "hello world"})
+        parsed_log = sc.ParserSchema({"log": "hello world"})
         alert, msg = rd.find_keyword(parsed_log, keywords)
         assert alert
         assert "Found word 'hello' in the logs" == msg
 
-        parsed_log = schemas.ParserSchema({"log": "ciao world"})
+        parsed_log = sc.ParserSchema({"log": "ciao world"})
         alert, msg = rd.find_keyword(parsed_log, keywords)
         assert alert
         assert "Found word 'ciao' in the logs" == msg
 
-        parsed_log = schemas.ParserSchema({"log": "world"})
+        parsed_log = sc.ParserSchema({"log": "world"})
         alert, _ = rd.find_keyword(parsed_log, keywords)
         assert not alert
 
     def test_find_exceptions(self) -> None:
-        parsed_log = schemas.ParserSchema({"log": "hello Exception"})
+        parsed_log = sc.ParserSchema({"log": "hello Exception"})
         alert, msg = rd.exceptions(parsed_log)
         assert alert
         assert "Found word 'exception' in the logs" == msg
 
-        parsed_log = schemas.ParserSchema({"log": "world"})
+        parsed_log = sc.ParserSchema({"log": "world"})
         alert, _ = rd.exceptions(parsed_log)
         assert not alert
 
     def test_error_log(self) -> None:
-        parsed_log = schemas.ParserSchema(
-            {"logFormatVariables": {"Level": "Error"}}
+        parsed_log = sc.ParserSchema(
+            {"headerVariables": {"Level": "Error"}}
         )
         alert, msg = rd.error_log(parsed_log)
         assert alert
         assert "Error found" == msg
 
-        parsed_log = schemas.ParserSchema(
-            {"logFormatVariables": {"Level": "Info"}}
+        parsed_log = sc.ParserSchema(
+            {"headerVariables": {"Level": "Info"}}
         )
         alert, _ = rd.error_log(parsed_log)
         assert not alert
 
-        parsed_log = schemas.ParserSchema({"log": "hello world"})
+        parsed_log = sc.ParserSchema({"log": "hello world"})
         alert, _ = rd.error_log(parsed_log)
         assert not alert
 
@@ -65,17 +65,17 @@ class TestCaseRuleDetector:
     def test_run_all_rules(self) -> None:
         rule_detector = rd.RuleDetector()
 
-        assert rule_detector.process(schemas.ParserSchema()) is None
+        assert rule_detector.process(sc.ParserSchema()) is None
 
-        alert1 = rule_detector.process(schemas.ParserSchema(
+        alert1 = rule_detector.process(sc.ParserSchema(
             {
-                "EventID": -1,
+                "eventID": -1,
                 "log": "fail exception",
-                "logFormatVariables": {"Level": "Error"}
+                "headerVariables": {"Level": "Error"}
             }
         ))
         assert alert1 is not None
-        assert alert1["alertsObtain"] == {
+        assert alert1["alertDetails"] == {
             "R001 - TemplateNotFound": "No template found by parser",
             "R003 - CheckForExceptions": "Found word 'exception' in the logs",
             "R004 - ErrorLevelFound": "Error found",
@@ -85,19 +85,19 @@ def test_run_all_rules(self) -> None:
     def test_all_rules_serialize(self) -> None:
         rule_detector = rd.RuleDetector()
 
-        assert rule_detector.process(schemas.ParserSchema().serialize()) is None
+        assert rule_detector.process(sc.ParserSchema().serialize()) is None
 
-        alert1 = rule_detector.process(schemas.ParserSchema(
+        alert1 = rule_detector.process(sc.ParserSchema(
             {
-                "EventID": -1,
+                "eventID": -1,
                 "log": "fail exception",
-                "logFormatVariables": {"Level": "Error"}
+                "headerVariables": {"Level": "Error"}
             }
         ).serialize())
         assert alert1 is not None
 
-        (alert := schemas.DetectorSchema()).deserialize(alert1)
-        assert alert["alertsObtain"] == {
+        (alert := sc.DetectorSchema()).deserialize(alert1)
+        assert alert["alertDetails"] == {
             "R001 - TemplateNotFound": "No template found by parser",
             "R003 - CheckForExceptions": "Found word 'exception' in the logs",
             "R004 - ErrorLevelFound": "Error found",
@@ -122,17 +122,17 @@ def test_run_single_rule(self) -> None:
             }
         )
 
-        assert rule_detector.process(schemas.ParserSchema()) is None
+        assert rule_detector.process(sc.ParserSchema()) is None
 
-        alert1 = rule_detector.process(schemas.ParserSchema(
+        alert1 = rule_detector.process(sc.ParserSchema(
             {
-                "EventID": -1,
+                "eventID": -1,
                 "log": "fail exception",
-                "logFormatVariables": {"Level": "Error"}
+                "headerVariables": {"Level": "Error"}
             }
         ))
         assert alert1 is not None
-        assert alert1["alertsObtain"] == {
+        assert alert1["alertDetails"] == {
             "R001 - TemplateNotFound": "No template found by parser",
         }
         assert alert1["score"] == 1
@@ -155,8 +155,8 @@ def test_run_single_rule_with_args(self) -> None:
             }
         )
 
-        assert rule_detector.process(schemas.ParserSchema({"log": "ciao"})) is None
-        assert rule_detector.process(schemas.ParserSchema({"log": "hi"})) is not None
+        assert rule_detector.process(sc.ParserSchema({"log": "ciao"})) is None
+        assert rule_detector.process(sc.ParserSchema({"log": "hi"})) is not None
 
     def test_rule_not_found(self) -> None:
 
diff --git a/tests/test_detectors/test_scvs_detector.py b/tests/test_detectors/test_scvs_detector.py
index a169b091..02afd445 100644
--- a/tests/test_detectors/test_scvs_detector.py
+++ b/tests/test_detectors/test_scvs_detector.py
@@ -15,7 +15,7 @@
 class TestSCVSDetector:
     def test_build_count_vec(self):
         input_ = [
-            schemas.ParserSchema({"EventID": i}) for i in [0, 1, 4, 0]
+            schemas.ParserSchema({"eventID": i}) for i in [0, 1, 4, 0]
         ]
         expected = tuple([2, 1, 0, 0, 1])
 
@@ -43,7 +43,7 @@ def test_scvs(self):
 
         input_ = []
         for _ in range(10):
-            input_.extend([schemas.ParserSchema({"EventID": i}) for i in [0, 1, 4, 0]])
+            input_.extend([schemas.ParserSchema({"eventID": i}) for i in [0, 1, 4, 0]])
 
         for in_ in input_:
             scvs.process(in_)
@@ -53,7 +53,7 @@ def test_scvs(self):
             alert = scvs.process(in_)
         assert alert is None
 
-        for in_ in [schemas.ParserSchema({"EventID": i}) for i in [4, 4, 4, 4, 4, 4, 1, 0, 1, 1]]:
+        for in_ in [schemas.ParserSchema({"eventID": i}) for i in [4, 4, 4, 4, 4, 4, 1, 0, 1, 1]]:
             alert = scvs.process(in_)
         assert alert is not None
 
@@ -138,7 +138,7 @@ def test_audit_log_anomalie_fed(self):
 
 
 def _window(event_ids):
-    return [schemas.ParserSchema({"EventID": i}) for i in event_ids]
+    return [schemas.ParserSchema({"eventID": i}) for i in event_ids]
 
 
 def _fed_detector(window_size):
diff --git a/tests/test_detectors/test_value_range_detector.py b/tests/test_detectors/test_value_range_detector.py
index 9b096eeb..74e4586c 100644
--- a/tests/test_detectors/test_value_range_detector.py
+++ b/tests/test_detectors/test_value_range_detector.py
@@ -21,7 +21,7 @@
 from detectmatelibrary.constants import GLOBAL_EVENT_ID
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from detectmatelibrary.tools.logging import logger
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
@@ -75,8 +75,8 @@ def test_default_initialization(self):
         assert detector.name == "ValueRangeDetector"
         assert hasattr(detector, 'config')
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, 'persistency')
 
     def test_custom_config_initialization(self):
@@ -130,16 +130,16 @@ def test_train_multiple_values(self):
                 if event == 1:
                     min_val = min(min_val, value)
                     max_val = max(max_val, value)
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["val0", str(value), "val2", "val3", "val4"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {}
+                    "headerVariables": {}
                 })
                 detector.train(parser_data)
 
@@ -148,16 +148,16 @@ def test_train_multiple_values(self):
                 if event == 1:
                     min_val = min(min_val, value)
                     max_val = max(max_val, value)
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["val0", str(value), "val2", "val3", "val4"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {}
+                    "headerVariables": {}
                 })
                 detector.train(parser_data)
 
@@ -175,33 +175,33 @@ def test_train_detect_non_numeric_raises(self):
 
         detector = ValueRangeDetector(config=config, name="CustomInit")
         # Train with multiple values (the minimum and maximum value should be captured)
-        parser_data = schemas.ParserSchema({
+        parser_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["val0", f"val{random.randint(0, 300)}", "val2", "val3", "val4"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {}
+            "headerVariables": {}
         })
         with pytest.raises(ValueError):
             detector.train(parser_data)
-        normal_data = schemas.ParserSchema({
+        normal_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["val0", f"{random.randint(0, 300)}", "val2", "val3", "val4"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {}
+            "headerVariables": {}
         })
         detector.train(normal_data)
         with pytest.raises(ValueError):
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             detector.detect(parser_data, output)
 
     def test_train_detect_non_numeric_ignore(self):
@@ -209,31 +209,31 @@ def test_train_detect_non_numeric_ignore(self):
 
         detector = ValueRangeDetector(config=config, name="MultipleDetector")
         # Train with multiple values (the minimum and maximum value should be captured)
-        parser_data = schemas.ParserSchema({
+        parser_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["val0", f"val{random.randint(0, 300)}", "val2", "val3", "val4"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {}
+            "headerVariables": {}
         })
         detector.train(parser_data)
-        normal_data = schemas.ParserSchema({
+        normal_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["val0", f"{random.randint(0, 300)}", "val2", "val3", "val4"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {}
+            "headerVariables": {}
         })
         detector.train(normal_data)
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         detector.detect(parser_data, output)
 
 
@@ -245,32 +245,32 @@ def test_detect_learned_value_range_no_alert(self):
 
         # Train with values
         for val in ["1", "5000", "2130"]:
-            train_data = schemas.ParserSchema({
+            train_data = sc.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "test template",
                 "variables": ["adsasd", val],
                 "logID": "1",
                 "parsedLogID": "1",
                 "parserID": "test_parser",
                 "log": "test log message",
-                "logFormatVariables": {"level": "INFO"}
+                "headerVariables": {"level": "INFO"}
             })
             detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "4321"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -282,32 +282,32 @@ def test_detect_known_value_ranges_alert(self):
 
         # Train with values
         for val in ["1", "5000", "2130"]:
-            train_data = schemas.ParserSchema({
+            train_data = sc.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "test template",
                 "variables": ["adsasd", val],
                 "logID": "1",
                 "parsedLogID": "1",
                 "parserID": "test_parser",
                 "log": "test log message",
-                "logFormatVariables": {"level": "INFO"}
+                "headerVariables": {"level": "INFO"}
             })
             detector.train(train_data)
 
         # Detect with the different value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "5001"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -315,18 +315,18 @@ def test_detect_known_value_ranges_alert(self):
         assert output.score == 1.0
 
         # Detect with the different value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "0"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -373,7 +373,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -403,7 +403,7 @@ def test_audit_log_anomalies_to_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector2.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -437,7 +437,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -514,9 +514,9 @@ def test_global_instance_detects_new_type(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
-                assert all(key.startswith("Global -") for key in output["alertsObtain"])
+                assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
 
         assert len(detected_ids) > 0
@@ -544,11 +544,11 @@ def test_set_configuration_preserves_persist(self):
 
         # Feed configure() with a couple of stable-variable samples
         for _ in range(5):
-            sample = schemas.ParserSchema({
-                "parserType": "test", "EventID": 1, "template": "t",
+            sample = sc.ParserSchema({
+                "parserType": "test", "eventID": 1, "template": "t",
                 "variables": ["123"], "logID": "x", "parsedLogID": "x",
                 "parserID": "p", "log": "l",
-                "logFormatVariables": {"level": "INFO"},
+                "headerVariables": {"level": "INFO"},
             })
             detector.configure(sample)
 
diff --git a/tests/test_helper/test_from_to.py b/tests/test_helper/test_from_to.py
index 870d6ada..7195c112 100644
--- a/tests/test_helper/test_from_to.py
+++ b/tests/test_helper/test_from_to.py
@@ -3,7 +3,7 @@
 from detectmatelibrary._testutils.dummy_parser import DummyParser
 from tests.test_data import AUDIT_TEMPLATES, DUMMY_TXT_PATH, DUMMY_TXT_PATH2, DUMMY_JSON_PATH, \
     DUMMY_JSON_PATH2, DUMMY_YAML_PATH, DUMMY_YAML_PATH2
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 import detectmateperformance as dmp
 import polars as pl
 import json
@@ -128,7 +128,7 @@ def test_fromlog_no_process(self):
         log = next(From.log(parser, in_path=AUDIT_TEMPLATES, do_process=False))
 
         assert log.log == expected_log
-        assert isinstance(log, schemas.LogSchema)
+        assert isinstance(log, sc.LogSchema)
 
     def test_fromlog(self):
         parser = DummyParser()
@@ -136,7 +136,7 @@ def test_fromlog(self):
         log = next(From.log(parser, in_path=AUDIT_TEMPLATES, do_process=True))
 
         assert log.log == expected_log
-        assert isinstance(log, schemas.ParserSchema)
+        assert isinstance(log, sc.ParserSchema)
 
     @remove_files
     def test_frombinary(self):
@@ -179,26 +179,26 @@ def test_frompolars(self):
         gen = From.polars(DummyDetector(), df=table, do_process=False)
 
         parsed1 = next(gen)
-        schema1 = schemas.ParserSchema({
+        schema1 = sc.ParserSchema({
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
-            "EventID": 0,
-            "logFormatVariables": {"Type": "A"}
+            "eventID": 0,
+            "headerVariables": {"Type": "A"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed1[field] == schema1[field], field
         assert parsed1["logID"] == "0"
 
         parsed2 = next(gen)
-        schema2 = schemas.ParserSchema({
+        schema2 = sc.ParserSchema({
             "log": "general kenobi",
             "variables": ["c", "d"],
             "template": "<*> kenobi",
-            "EventID": 1,
-            "logFormatVariables": {"Type": "B"}
+            "eventID": 1,
+            "headerVariables": {"Type": "B"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed2[field] == schema2[field], field
         assert parsed2["logID"] == "1"
 
@@ -213,26 +213,26 @@ def test_frompolars_lazy(self):
         gen = From.polars(DummyDetector(), df=table, do_process=False)
 
         parsed1 = next(gen)
-        schema1 = schemas.ParserSchema({
+        schema1 = sc.ParserSchema({
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
-            "EventID": 0,
-            "logFormatVariables": {"Type": "A"}
+            "eventID": 0,
+            "headerVariables": {"Type": "A"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed1[field] == schema1[field], field
         assert parsed1["logID"] == "0"
 
         parsed2 = next(gen)
-        schema2 = schemas.ParserSchema({
+        schema2 = sc.ParserSchema({
             "log": "general kenobi",
             "variables": ["c", "d"],
             "template": "<*> kenobi",
-            "EventID": 1,
-            "logFormatVariables": {"Type": "B"}
+            "eventID": 1,
+            "headerVariables": {"Type": "B"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed2[field] == schema2[field], field
         assert parsed2["logID"] == "1"
 
@@ -245,19 +245,19 @@ def test_frompolars_rename(self):
             "EventIDs": [0, 1]
         })
         renames = {
-            "Content": "log", "Vars": "variables", "EventIDs": "EventID", "Templates": "template"
+            "Content": "log", "Vars": "variables", "EventIDs": "eventID", "Templates": "template"
         }
         gen = From.polars(DummyDetector(), df=table, do_process=False, renames=renames)
 
         parsed1 = next(gen)
-        schema1 = schemas.ParserSchema({
+        schema1 = sc.ParserSchema({
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
-            "EventID": 0,
-            "logFormatVariables": {"Type": "A"}
+            "eventID": 0,
+            "headerVariables": {"Type": "A"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed1[field] == schema1[field], field
 
     def test_frompolars_rename_vars(self):
@@ -269,19 +269,19 @@ def test_frompolars_rename_vars(self):
             "EventIDs": [0, 1]
         })
         renames = {
-            "Content": "log", "Vars": "variables", "EventIDs": "EventID", "Templates": "template"
+            "Content": "log", "Vars": "variables", "EventIDs": "eventID", "Templates": "template"
         }
         gen = From.polars(DummyDetector(), df=table, do_process=False, renames=renames)
 
         parsed1 = next(gen)
-        schema1 = schemas.ParserSchema({
+        schema1 = sc.ParserSchema({
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
-            "EventID": 0,
-            "logFormatVariables": {"Type": "A"}
+            "eventID": 0,
+            "headerVariables": {"Type": "A"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed1[field] == schema1[field], field
 
 
diff --git a/tests/test_helper/test_select_component.py b/tests/test_helper/test_select_component.py
new file mode 100644
index 00000000..0410b175
--- /dev/null
+++ b/tests/test_helper/test_select_component.py
@@ -0,0 +1,89 @@
+from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation
+from detectmatelibrary.detectors.random_detector import RandomDetector, RandomDetectorConfig
+from detectmatelibrary.parsers.drain import DrainParser, DrainConfig
+
+import detectmatelibrary.helper.select_component as selc
+
+
+class TestFindFromName:
+    def test_get_configs(self):
+        assert (comp := selc._find_component_from_type("drain_parser", "parsers")) is not None
+        assert isinstance(comp(), DrainParser)
+
+        assert (comp := selc._find_component_from_type("random_detector", "detectors")) is not None
+        assert isinstance(comp(), RandomDetector)
+
+        assert (comp := selc._find_component_from_type(
+            "basic_concat_aggregator", "alert_aggregators"
+        )) is not None
+        assert isinstance(comp(), BasicConcatAggregation)
+
+        assert selc._find_component_from_type("aux", "alert_aggregators") is None
+
+
+class TestPickComponets:
+    def test_pick_component_dict(self):
+        config = {
+            "detectors": {
+                "TestDetector": {"method_type": "random_detector"}
+            }
+        }
+        comp = selc.selectComponent(
+            name="TestDetector", config=config, component_type="detectors"
+        )
+
+        assert isinstance(comp, RandomDetector)
+
+    def test_pick_component_dict_no_name(self):
+        config = {
+            "detectors": {
+                "TestDetector": {"method_type": "random_detector"}
+            }
+        }
+        comp = selc.selectComponent(config=config, component_type="detectors")
+
+        assert isinstance(comp, RandomDetector)
+
+    def test_pick_component(self):
+        config = DrainConfig()
+        comp = selc.selectComponent(
+            name="Drain", config=config, component_type="parsers"
+        )
+
+        assert isinstance(comp, DrainParser)
+
+    def test_pick_component_no_name(self):
+        config = DrainConfig()
+        comp = selc.selectComponent(config=config, component_type="parsers")
+
+        assert isinstance(comp, DrainParser)
+
+    def test_pick_multiple_components(self):
+        configs = [
+            {
+                "detectors": {
+                    "a": {"method_type": "random_detector"}
+                }
+            },
+            RandomDetectorConfig(),
+        ]
+        names = ["a", "b"]
+
+        for component in selc.selectComponents(
+            configs=configs, names=names, component_type="detectors"
+        ):
+            assert isinstance(component, RandomDetector)
+
+    def test_pick_multiple_components_no_names(self):
+        configs = [
+            {
+                "detectors": {
+                    "a": {"method_type": "random_detector"}
+                }
+            },
+            RandomDetectorConfig(),
+        ]
+        for component in selc.selectComponents(
+            configs=configs, component_type="detectors"
+        ):
+            assert isinstance(component, RandomDetector)
diff --git a/tests/test_parsers/test_drain.py b/tests/test_parsers/test_drain.py
index d12d0d5a..9e33fc26 100644
--- a/tests/test_parsers/test_drain.py
+++ b/tests/test_parsers/test_drain.py
@@ -23,19 +23,19 @@ def test_train_process(self):
         parser = DrainParser(config=config_dict)
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, general kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, captain kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, sargent kenobi!"}))
-        assert parsed["EventID"] == 0
+        assert parsed["eventID"] == 0
         assert parsed["template"] == "hello there <*> kenobi"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, general R2D2!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "template not found"
 
     def test_reset_after_train(self):
@@ -54,15 +54,15 @@ def test_reset_after_train(self):
         parser = DrainParser(config=config_dict)
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, general kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, captain kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, sargent kenobi!"}))
-        assert parsed["EventID"] == 0
+        assert parsed["eventID"] == 0
         assert parsed["template"] == "hello there <*> kenobi"
 
         parser.update_state("keep_training")
@@ -70,7 +70,7 @@ def test_reset_after_train(self):
         parser.update_state("stop_training")
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, sargent kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "template not found"
 
     def test_not_reset_train(self):
@@ -89,15 +89,15 @@ def test_not_reset_train(self):
         parser = DrainParser(config=config_dict)
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, general kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, captain kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, sargent kenobi!"}))
-        assert parsed["EventID"] == 0
+        assert parsed["eventID"] == 0
         assert parsed["template"] == "hello there <*> kenobi"
 
         parser.update_state("keep_training")
diff --git a/tests/test_parsers/test_json_parser.py b/tests/test_parsers/test_json_parser.py
index 35964071..b5806b1e 100644
--- a/tests/test_parsers/test_json_parser.py
+++ b/tests/test_parsers/test_json_parser.py
@@ -1,10 +1,11 @@
 import json
+import logging
 from detectmatelibrary.parsers.json_parser import (
     JsonParser,
     JsonParserConfig,
     flatten_dict
 )
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from tests.test_data import TEST_TEMPLATES
 
 
@@ -52,24 +53,24 @@ def test_parse_json_without_message(self):
             "error_code": 404
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
 
-        output = schemas.ParserSchema()
+        output = sc.ParserSchema()
         parser.parse(input_log, output)
 
-        # When no message field, template should be empty
+        # When no message field, the template is empty and the eventID is -2
         assert output.template == ""
         assert len(output.variables) == 0
-        assert output.EventID == 0
+        assert output.eventID == -2
 
         # But other fields should be present
-        assert "level" in output.logFormatVariables
-        assert output.logFormatVariables["level"] == "ERROR"
-        assert "error_code" in output.logFormatVariables
-        assert output.logFormatVariables["error_code"] == "404"
+        assert "level" in output.headerVariables
+        assert output.headerVariables["level"] == "ERROR"
+        assert "error_code" in output.headerVariables
+        assert output.headerVariables["error_code"] == "404"
 
     def test_parse_nested_json(self):
         """Test parsing nested JSON structure."""
@@ -87,20 +88,20 @@ def test_parse_nested_json(self):
             }
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
 
-        output = schemas.ParserSchema()
+        output = sc.ParserSchema()
         parser.parse(input_log, output)
 
         # Check flattened structure
-        assert "request.method" in output.logFormatVariables
-        assert output.logFormatVariables["request.method"] == "GET"
-        assert "request.path" in output.logFormatVariables
-        assert output.logFormatVariables["request.path"] == "/api/users"
-        assert "request.headers.content-type" in output.logFormatVariables
+        assert "request.method" in output.headerVariables
+        assert output.headerVariables["request.method"] == "GET"
+        assert "request.path" in output.headerVariables
+        assert output.headerVariables["request.path"] == "/api/users"
+        assert "request.headers.content-type" in output.headerVariables
 
     def test_parse_json_with_array(self):
         """Test parsing JSON with arrays."""
@@ -112,19 +113,19 @@ def test_parse_json_with_array(self):
             "events": ["login", "update", "logout"]
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
 
-        output = schemas.ParserSchema()
+        output = sc.ParserSchema()
         parser.parse(input_log, output)
 
         # Check array is flattened
-        assert "events.0" in output.logFormatVariables
-        assert output.logFormatVariables["events.0"] == "login"
-        assert "events.2" in output.logFormatVariables
-        assert output.logFormatVariables["events.2"] == "logout"
+        assert "events.0" in output.headerVariables
+        assert output.headerVariables["events.0"] == "login"
+        assert "events.2" in output.headerVariables
+        assert output.headerVariables["events.2"] == "logout"
 
     def test_parse_with_content_parser(self):
         """Test parsing with MatcherParser for message field."""
@@ -151,18 +152,106 @@ def test_parse_with_content_parser(self):
             "level": "INFO"
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
 
-        output = schemas.ParserSchema()
+        output = sc.ParserSchema()
         parser.parse(input_log, output)
 
         # The content parser should have parsed the message
         assert output.template != ""
         assert len(output.variables) > 0
-        assert "level" in output.logFormatVariables
+        assert "level" in output.headerVariables
+
+    def test_parse_message_with_config_object(self):
+        """A message parsed with a config object matches no template."""
+        config = JsonParserConfig()
+        parser = JsonParser(name="TestParser", config=config)
+
+        json_log = {
+            "time": "2023-11-18 10:30:00",
+            "message": "hello world"
+        }
+
+        input_log = sc.LogSchema({
+            "logID": "1",
+            "log": json.dumps(json_log)
+        })
+
+        output = sc.ParserSchema()
+        parser.parse(input_log, output)
+
+        assert output.template == "<Not Found>"
+        assert output.eventID == -1
+
+    def test_no_message_differs_from_first_template_and_no_match(self):
+        """Logs without message share neither the first template's eventID nor
+        the eventID of a message that matches no template."""
+        config_dict = {
+            "parsers": {
+                "TestParser": {
+                    "auto_config": True,
+                    "method_type": "json_parser",
+                },
+                "JsonMatcherParser": {
+                    "auto_config": True,
+                    "method_type": "matcher_parser",
+                    "path_templates": TEST_TEMPLATES
+                }
+            }
+        }
+        parser = JsonParser(name="TestParser", config=config_dict)
+
+        json_logs = [
+            {"message": "pid=9699 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\""},
+            {"message": "matches no template"},
+            {"level": "INFO"},
+        ]
+
+        event_ids = []
+        for json_log in json_logs:
+            output = sc.ParserSchema()
+            parser.parse(sc.LogSchema({"logID": "1", "log": json.dumps(json_log)}), output)
+            event_ids.append(output.eventID)
+
+        assert event_ids == [0, -1, -2]
+
+    def test_warns_once_when_message_meets_no_templates(self, caplog):
+        """A parser without templates warns once, at the first message."""
+        parser = JsonParser(name="TestParser", config=JsonParserConfig())
+
+        def parse(json_log):
+            parser.parse(sc.LogSchema({"log": json.dumps(json_log)}), sc.ParserSchema())
+
+        with caplog.at_level(logging.WARNING):
+            parse({"level": "INFO"})
+            assert not caplog.records
+            parse({"message": "hello"})
+            parse({"message": "world"})
+
+        warnings = [r for r in caplog.records if "no templates" in r.message]
+        assert len(warnings) == 1
+
+    def test_no_warning_with_templates(self, caplog):
+        """A parser with templates does not warn about missing templates."""
+        config_dict = {
+            "parsers": {
+                "TestParser": {"auto_config": True, "method_type": "json_parser"},
+                "JsonMatcherParser": {
+                    "auto_config": True,
+                    "method_type": "matcher_parser",
+                    "path_templates": TEST_TEMPLATES
+                }
+            }
+        }
+        parser = JsonParser(name="TestParser", config=config_dict)
+
+        with caplog.at_level(logging.WARNING):
+            parser.parse(sc.LogSchema({"log": json.dumps({"message": "hello"})}), sc.ParserSchema())
+
+        assert not [r for r in caplog.records if "no templates" in r.message]
 
     def test_custom_field_names(self):
         """Test with custom timestamp and message field names."""
@@ -174,19 +263,19 @@ def test_custom_field_names(self):
             "severity": "high"
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
 
-        output = schemas.ParserSchema()
+        output = sc.ParserSchema()
         parser.parse(input_log, output)
 
-        # Timestamp should be extracted and Time should be in logFormatVariables
-        assert "Time" in output.logFormatVariables
-        assert "severity" in output.logFormatVariables
+        # Timestamp should be extracted and Time should be in headerVariables
+        assert "Time" in output.headerVariables
+        assert "severity" in output.headerVariables
         # timestamp key should not appear in flattened dict (deleted after extraction)
-        assert "timestamp" not in output.logFormatVariables
+        assert "timestamp" not in output.headerVariables
 
     def test_process_method(self):
         """Test the full process method."""
@@ -198,7 +287,7 @@ def test_process_method(self):
             "status": "ok"
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
@@ -206,7 +295,7 @@ def test_process_method(self):
         # Test the full process method
         result = parser.process(input_log)
 
-        assert isinstance(result, schemas.ParserSchema)
-        assert "Time" in result.logFormatVariables
-        assert "status" in result.logFormatVariables
-        assert result.logFormatVariables["status"] == "ok"
+        assert isinstance(result, sc.ParserSchema)
+        assert "Time" in result.headerVariables
+        assert "status" in result.headerVariables
+        assert result.headerVariables["status"] == "ok"
diff --git a/tests/test_parsers/test_logbatcher_parser.py b/tests/test_parsers/test_logbatcher_parser.py
index 79aa5df2..abac37b0 100644
--- a/tests/test_parsers/test_logbatcher_parser.py
+++ b/tests/test_parsers/test_logbatcher_parser.py
@@ -8,7 +8,7 @@
 
 import pytest
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.common.parser import CoreParser
 from detectmatelibrary.parsers.logbatcher import LogBatcherParser, LogBatcherParserConfig
 from detectmatelibrary.utils.aux import time_test_mode
@@ -45,7 +45,7 @@ def test_config_method_type(self):
 class TestLogBatcherParserParse:
     def test_template_extracted(self):
         parser = _make_parser()
-        log_schema = schemas.LogSchema({"logID": "1", "log": LOG})
+        log_schema = sc.LogSchema({"logID": "1", "log": LOG})
 
         result = parser.process(log_schema)
 
@@ -53,7 +53,7 @@ def test_template_extracted(self):
 
     def test_variables_extracted(self):
         parser = _make_parser()
-        log_schema = schemas.LogSchema({"logID": "1", "log": LOG})
+        log_schema = sc.LogSchema({"logID": "1", "log": LOG})
 
         result = parser.process(log_schema)
 
@@ -62,21 +62,21 @@ def test_variables_extracted(self):
 
     def test_event_id_is_int(self):
         parser = _make_parser()
-        log_schema = schemas.LogSchema({"logID": "1", "log": LOG})
+        log_schema = sc.LogSchema({"logID": "1", "log": LOG})
 
         result = parser.process(log_schema)
 
-        assert isinstance(result["EventID"], int)
+        assert isinstance(result["eventID"], int)
 
     def test_second_call_hits_cache(self):
         """Second identical log must not trigger a new LLM call."""
         parser = _make_parser()
 
-        log_schema1 = schemas.LogSchema({"logID": "1", "log": LOG})
+        log_schema1 = sc.LogSchema({"logID": "1", "log": LOG})
         parser.process(log_schema1)
         llm_call_count = parser._llm_parser.chat.call_count
 
-        log_schema2 = schemas.LogSchema({"logID": "2", "log": LOG})
+        log_schema2 = sc.LogSchema({"logID": "2", "log": LOG})
         parser.process(log_schema2)
 
         assert parser._llm_parser.chat.call_count == llm_call_count
diff --git a/tests/test_parsers/test_template_matcher.py b/tests/test_parsers/test_template_matcher.py
index 3efeceb3..abe5b1ea 100644
--- a/tests/test_parsers/test_template_matcher.py
+++ b/tests/test_parsers/test_template_matcher.py
@@ -28,7 +28,7 @@ def test_no_path_templates(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == "<Not Found>"
-        assert output_data.EventID == -1
+        assert output_data.eventID == -1
         assert output_data.variables == []
 
     def test_templates_not_found(self):
@@ -60,7 +60,7 @@ def test_successful_match(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == test_template[0]
-        assert output_data.EventID == 0
+        assert output_data.eventID == 0
         assert len(output_data.variables) > 0
 
     def test_no_match(self):
@@ -79,7 +79,7 @@ def test_no_match(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == "<Not Found>"
-        assert output_data.EventID == -1
+        assert output_data.eventID == -1
         assert output_data.variables == []
 
     def test_custom_preprocessing_flags(self):
@@ -147,7 +147,7 @@ def test_match_produces_correct_variables(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == self.named_template_compiled
-        assert output_data.EventID == 0
+        assert output_data.eventID == 0
         assert len(output_data.variables) == 6
 
     def test_compile_resolves_named_positions(self):
@@ -200,7 +200,7 @@ def test_match_produces_correct_variables(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == self.named_template_compiled
-        assert output_data.EventID == 0
+        assert output_data.eventID == 0
         assert len(output_data.variables) == 6
 
     def test_compile_resolves_named_event_key(self):
diff --git a/tests/test_parsers/test_tree_matcher.py b/tests/test_parsers/test_tree_matcher.py
index ca3d1515..21c8c153 100644
--- a/tests/test_parsers/test_tree_matcher.py
+++ b/tests/test_parsers/test_tree_matcher.py
@@ -26,7 +26,7 @@ def test_no_path_templates(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == "template not found"
-        assert output_data.EventID == -1
+        assert output_data.eventID == -1
         assert output_data.variables == []
 
     def test_successful_match(self):
@@ -44,5 +44,5 @@ def test_successful_match(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == test_template[0]
-        assert output_data.EventID == 0
+        assert output_data.eventID == 0
         assert len(output_data.variables) > 0
diff --git a/tests/test_persistency/test_time_dependent_stability.py b/tests/test_persistency/test_time_dependent_stability.py
index 0e2ce703..ab67f1f0 100644
--- a/tests/test_persistency/test_time_dependent_stability.py
+++ b/tests/test_persistency/test_time_dependent_stability.py
@@ -3,7 +3,7 @@
 import logging
 import math
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.detectors.charset_detector import CharsetDetector, CharsetDetectorConfig
 from detectmatelibrary.base_detectors import StabilityAutoConfigParams, VariableAutoConfigParams
 from detectmatelibrary.base_detectors._stability import TimestampReader
@@ -386,16 +386,16 @@ def test_event_tracker_detector_backed_round_trip(self):
 
 
 def _parser_record(ts_value, event_id=1):
-    return schemas.ParserSchema({
+    return sc.ParserSchema({
         "parserType": "test",
-        "EventID": event_id,
+        "eventID": event_id,
         "template": "test template",
         "variables": ["abc"],
         "logID": "1",
         "parsedLogID": "1",
         "parserID": "test_parser",
         "log": "test log message",
-        "logFormatVariables": {"ts": ts_value},
+        "headerVariables": {"ts": ts_value},
     })
 
 
diff --git a/tests/test_pipelines/test_bad_players.py b/tests/test_pipelines/test_bad_players.py
index 279d7c90..2bfdec68 100644
--- a/tests/test_pipelines/test_bad_players.py
+++ b/tests/test_pipelines/test_bad_players.py
@@ -28,10 +28,10 @@ class MockupBadParser(CoreParser):
     def parse(self, input_, output_):
         input_.log = "This message was change!"
 
-        output_.EventID = 1
+        output_.eventID = 1
         output_.template = "hello"
         output_.variables.extend(["a", "b"])
-        output_.logFormatVariables["timestamp"] = "1"
+        output_.headerVariables["timestamp"] = "1"
 
 
 class MockupDetector(CoreDetector):
diff --git a/tests/test_pipelines/test_dummy_methods.py b/tests/test_pipelines/test_dummy_methods.py
index c8f2b333..2a6e44ed 100644
--- a/tests/test_pipelines/test_dummy_methods.py
+++ b/tests/test_pipelines/test_dummy_methods.py
@@ -1,7 +1,7 @@
 
 from detectmatelibrary._testutils.dummy_detector import DummyDetector, DummyDetectorConfig
 from detectmatelibrary._testutils.dummy_parser import DummyParser, DummyParserConfig
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 
 default_args = {
@@ -32,18 +32,18 @@ def test_initialize_default(self) -> None:
 
     def test_run_detect_method(self) -> None:
         detector = DummyDetector()
-        data = schemas.ParserSchema({"log": "test log"})
-        output = schemas.DetectorSchema()
+        data = sc.ParserSchema({"log": "test log"})
+        output = sc.DetectorSchema()
 
         result = detector.detect(data, output)
 
         assert output.description == "Dummy detection process"
         if result:
             assert output.score == 1.0
-            assert "Anomaly detected by DummyDetector" in output.alertsObtain["type"]
+            assert "Anomaly detected by DummyDetector" in output.alertDetails["type"]
         else:
             assert output.score == 0.0
-            assert len(output.alertsObtain) == 0
+            assert len(output.alertDetails) == 0
 
     def test_parser_initialize_default(self) -> None:
         parser = DummyParser(name="DummyParser", config=default_args)
@@ -54,8 +54,8 @@ def test_parser_initialize_default(self) -> None:
 
     def test_run_parse_method(self) -> None:
         parser = DummyParser()
-        input_data = schemas.LogSchema({"log": "test log"})
-        output_data = schemas.ParserSchema()
+        input_data = sc.LogSchema({"log": "test log"})
+        output_data = sc.ParserSchema()
 
         parser.parse(input_data, output_data)
 
@@ -66,7 +66,7 @@ def test_pipeline(test) -> None:
         parser = DummyParser()
         detector = DummyDetector()
 
-        log_input = schemas.LogSchema({"log": "test log", "logID": "1"})
+        log_input = sc.LogSchema({"log": "test log", "logID": "1"})
         parsed_log = parser.process(log_input)
 
         while (result := detector.process(parsed_log)) is None:
diff --git a/tests/test_pipelines/test_main_pipeline.py b/tests/test_pipelines/test_main_pipeline.py
new file mode 100644
index 00000000..37051bb1
--- /dev/null
+++ b/tests/test_pipelines/test_main_pipeline.py
@@ -0,0 +1,208 @@
+from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
+
+from detectmatelibrary.pipeline import PipelineConfig, _run_pipeline, Pipeline
+
+from detectmatelibrary._testutils.dummy_parser import DummyParser
+from detectmatelibrary._testutils.dummy_detector import DummyDetectorConfig
+from detectmatelibrary._testutils.dummy_alert_aggregator import (
+    DummyAlertAggregator, DummyAlertAggregatorConfig
+)
+
+from detectmatelibrary.helper.from_to import From
+import detectmatelibrary.schemas as sc
+
+from detectmatelibrary.common.detector import CoreDetector
+
+from detectmatelibrary.detectors.ecvc_detector import ECVCDetectorConfig
+from detectmatelibrary.detectors.charset_detector import CharsetDetectorConfig
+
+from detectmatelibrary.parsers.tree_matcher import TemplateCppTreeMatcherConfig
+
+from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegationConfig
+
+import pytest
+
+
+class AlwayAlert(CoreDetector):
+    """A dummy detector for testing purposes."""
+
+    def __init__(
+        self,
+        name: str = "DummyDetector",
+        config: DummyDetectorConfig = DummyDetectorConfig()
+    ) -> None:
+
+        super().__init__(name=name, config=config)
+
+    def detect(
+        self,
+        input_: list[sc.ParserSchema] | sc.ParserSchema,
+        output_: sc.DetectorSchema
+    ) -> bool:
+        output_["description"] = "Dummy detection process"
+
+        output_["score"] = 1.0
+        output_["alertDetails"]["type"] = "Anomaly detected by DummyDetector"
+        return True
+
+
+log_schema = sc.LogSchema({"logID": "1", "log": "hello"})
+
+parser_schema = sc.ParserSchema({
+    "parserType": "a",
+    "parserID": "ciao",
+    "logID": "1",
+    "eventID": 1,
+    "template": "a",
+    "parsedLogID": "as2",
+    "log": "hello",
+    "receivedTimestamp": 1,
+    "parsedTimestamp": 2,
+    "headerVariables": {"Time": "-1"}
+})
+
+
+class TestRunPipeline:
+    def test_run_parser2detectors(self) -> None:
+        out_ = _run_pipeline(
+            config=PipelineConfig(do_parsing=True, do_aggregation=False),
+            input_=log_schema,
+            parser=DummyParser(),
+            detectors=[AlwayAlert(), AlwayAlert()],
+            alert_aggreator=None
+        )
+
+        assert isinstance(out_, list)
+        assert isinstance(out_[0], sc.DetectorSchema)
+        assert len(out_) == 2
+
+    def test_run_parser2aggregator(self) -> None:
+        out_ = _run_pipeline(
+            config=PipelineConfig(do_parsing=True, do_aggregation=True),
+            input_=log_schema,
+            parser=DummyParser(),
+            detectors=[AlwayAlert(), AlwayAlert()],
+            alert_aggreator=DummyAlertAggregator(
+                config=DummyAlertAggregatorConfig(buffer_size=2)
+            )
+        )
+
+        assert isinstance(out_, list)
+        assert isinstance(out_[0], sc.AggregateSchema)
+        assert len(out_) == 1
+
+    def test_run_detectors_only(self) -> None:
+        out_ = _run_pipeline(
+            config=PipelineConfig(do_parsing=False, do_aggregation=False),
+            input_=parser_schema,
+            parser=None,
+            detectors=[AlwayAlert(), AlwayAlert()],
+            alert_aggreator=None
+        )
+
+        assert isinstance(out_, list)
+        assert isinstance(out_[0], sc.DetectorSchema)
+        assert len(out_) == 2
+
+    def test_run_detectors_parallel(self) -> None:
+        out_ = _run_pipeline(
+            config=PipelineConfig(do_parsing=False, do_aggregation=False),
+            input_=parser_schema,
+            parser=None,
+            detectors=[AlwayAlert(), AlwayAlert()],
+            alert_aggreator=None,
+            n_workers=2,
+        )
+
+        assert isinstance(out_, list)
+        assert isinstance(out_[0], sc.DetectorSchema)
+        assert len(out_) == 2
+
+    def test_run_detectors2aggregator(self) -> None:
+        out_ = _run_pipeline(
+            config=PipelineConfig(do_parsing=False, do_aggregation=True),
+            input_=parser_schema,
+            parser=None,
+            detectors=[AlwayAlert(), AlwayAlert()],
+            alert_aggreator=DummyAlertAggregator(
+                config=DummyAlertAggregatorConfig(buffer_size=2)
+            )
+        )
+
+        assert isinstance(out_, list)
+        assert isinstance(out_[0], sc.AggregateSchema)
+        assert len(out_) == 1
+
+
+class TestPipeline:
+    @pytest.mark.ignored
+    def test_full_pipeline(self) -> None:
+        config = PipelineConfig(
+            do_parsing=True,
+            do_aggregation=True,
+            n_workers=1,
+            parser=TemplateCppTreeMatcherConfig(
+                path_templates=AUDIT_TEMPLATES,
+                log_format="type=<Type> msg=audit(<Time>): <Content>"
+            ),
+            detectors=[
+                ECVCDetectorConfig(
+                    data_use_configure=TRAIN_UNTIL,
+                    window_size=10,
+                    seed=0,
+                    validation_per=0.,
+                    threshold_method="mean"
+                ),
+                CharsetDetectorConfig(
+                    data_use_configure=TRAIN_UNTIL,
+                    data_use_training=1,
+                    auto_config=True,
+                )
+            ],
+            aggregator=LogIDCountAggegationConfig(max_count=1)
+        )
+
+        pipeline = Pipeline(config=config)
+        alerts = []
+        for parsed_log in From.log(pipeline.parser, in_path=AUDIT_LOG, do_process=True):
+            if (alert := pipeline.process(parsed_log)) is not None:
+                alerts.extend(alert["logIDs"])
+
+        expected = ['1859', '1860', '1861', '1862', '1864', '1865', '1866', '1867']
+        assert set(alerts) == set(expected)
+
+    @pytest.mark.ignored
+    def test_full_pipeline_parallel(self) -> None:
+        config = PipelineConfig(
+            do_parsing=True,
+            do_aggregation=True,
+            n_workers=3,
+            parser=TemplateCppTreeMatcherConfig(
+                path_templates=AUDIT_TEMPLATES,
+                log_format="type=<Type> msg=audit(<Time>): <Content>"
+            ),
+            detectors=[
+                ECVCDetectorConfig(
+                    data_use_configure=TRAIN_UNTIL,
+                    window_size=10,
+                    seed=0,
+                    validation_per=0.,
+                    threshold_method="mean"
+                ),
+                CharsetDetectorConfig(
+                    data_use_configure=TRAIN_UNTIL,
+                    data_use_training=1,
+                    auto_config=True,
+                )
+            ],
+            aggregator=LogIDCountAggegationConfig(max_count=1)
+        )
+
+        pipeline = Pipeline(config=config)
+        alerts = []
+        for parsed_log in From.log(pipeline.parser, in_path=AUDIT_LOG, do_process=True):
+            if (alert := pipeline.process(parsed_log)) is not None:
+                alerts.extend(alert["logIDs"])
+
+        expected = ['1859', '1860', '1861', '1862', '1864', '1865', '1866', '1867']
+        assert set(alerts) == set(expected)
diff --git a/tests/test_schemas/test_default_values.py b/tests/test_schemas/test_default_values.py
index e08b7cd1..d6c7dd64 100644
--- a/tests/test_schemas/test_default_values.py
+++ b/tests/test_schemas/test_default_values.py
@@ -14,13 +14,13 @@ def test_initialize_parser_schema(self) -> None:
         values = {
             "parserType": "test",
             "parserID": "test",
-            "EventID": 0,
+            "eventID": 0,
             "template": "test template",
             "variables": ["a", "b"],
             "parsedLogID": "0",
             "logID": "0",
             "log": "test log",
-            "logFormatVariables": {"TimeStamp": "test timestamp"},
+            "headerVariables": {"TimeStamp": "test timestamp"},
             "receivedTimestamp": 0,
             "parsedTimestamp": 0,
         }
@@ -32,10 +32,10 @@ def test_initialize_detector_schema(self) -> None:
             "detectorID": "test id",
             "detectorType": "type test",
             "alertID": "0",
-            "detectionTimestamp": 0,
+            "detectedTimestamp": 0,
             "logIDs": ["0", "0", "0"],
             "score": 0.0,
-            "extractedTimestamps": [0, 0, 0],
+            "logTimestamps": [0, 0, 0],
             "description": "",
             "receivedTimestamp": 0,
         }
@@ -46,7 +46,7 @@ def test_initialize_parser_schema_empty_list_dict(self) -> None:
         values = {
             "parserType": "test",
             "parserID": "test",
-            "EventID": 0,
+            "eventID": 0,
             "template": "test template",
             "parsedLogID": "0",
             "logID": "0",
@@ -57,5 +57,5 @@ def test_initialize_parser_schema_empty_list_dict(self) -> None:
         schema = op_schemas.initialize(op_schemas.PARSER_SCHEMA, **values)
         op_schemas.check_if_schema_is_complete(schema)
 
-        assert len(schema.logFormatVariables) == 0
+        assert len(schema.headerVariables) == 0
         assert len(schema.variables) == 0
diff --git a/tests/test_schemas/test_ops.py b/tests/test_schemas/test_ops.py
index 6bd6b9d9..0704980b 100644
--- a/tests/test_schemas/test_ops.py
+++ b/tests/test_schemas/test_ops.py
@@ -7,7 +7,7 @@ class TestCaseSchemas:
     def test_initialize_basic(self):
         schema = op_schemas.initialize(op_schemas.BASE_SCHEMA, **{})
 
-        assert schema.__version__ == "1.0.0"
+        assert schema.__version__ == "2.0.0"
 
     def test_initialize_log_schema(self) -> None:
         values = {
@@ -15,7 +15,7 @@ def test_initialize_log_schema(self) -> None:
         }
         schema = op_schemas.initialize(op_schemas.LOG_SCHEMA, **values)
 
-        assert schema.__version__ == "1.0.0"
+        assert schema.__version__ == "2.0.0"
         assert schema.logID == "1"
         assert schema.log == "test"
         assert schema.logSource == "example"
@@ -25,70 +25,70 @@ def test_initialize_parser_schema(self) -> None:
         values = {
             "parserType": "test",
             "parserID": "test",
-            "EventID": 5,
+            "eventID": 5,
             "template": "test template",
             "variables": ["a", "b"],
             "parsedLogID": "2",
             "logID": "4",
             "log": "test log",
-            "logFormatVariables": {"TimeStamp": "test timestamp"}
+            "headerVariables": {"TimeStamp": "test timestamp"}
         }
         schema = op_schemas.initialize(op_schemas.PARSER_SCHEMA, **values)
 
-        assert schema.__version__ == "1.0.0"
-        assert schema.EventID == 5
+        assert schema.__version__ == "2.0.0"
+        assert schema.eventID == 5
         assert schema.template == "test template"
         assert schema.variables == ["a", "b"]
         assert schema.parserID == "test"
         assert schema.logID == "4"
         assert schema.parsedLogID == "2"
         assert schema.log == "test log"
-        assert schema.logFormatVariables == {"TimeStamp": "test timestamp"}
+        assert schema.headerVariables == {"TimeStamp": "test timestamp"}
 
     def test_initialize_detector_schema(self) -> None:
         values = {
             "detectorID": "test id",
             "detectorType": "type test",
             "alertID": "1",
-            "detectionTimestamp": 2,
+            "detectedTimestamp": 2,
             "logIDs": ["1", "2", "3"],
             "score": 0.5,
-            "extractedTimestamps": [4, 5, 6]
+            "logTimestamps": [4, 5, 6]
         }
         schema = op_schemas.initialize(op_schemas.DETECTOR_SCHEMA, **values)
 
-        assert schema.__version__ == "1.0.0"
+        assert schema.__version__ == "2.0.0"
         assert schema.detectorID == "test id"
         assert schema.detectorType == "type test"
         assert schema.alertID == "1"
-        assert schema.detectionTimestamp == 2
+        assert schema.detectedTimestamp == 2
         assert schema.logIDs == ["1", "2", "3"]
         assert schema.score == 0.5
-        assert schema.extractedTimestamps == [4, 5, 6]
+        assert schema.logTimestamps == [4, 5, 6]
 
     def test_initialize_output_schema(self) -> None:
         values = {
             "detectorIDs": ["test id", "another id"],
             "detectorTypes": ["type test", "another type"],
             "alertIDs": ["1", "2"],
-            "outputTimestamp": 2,
+            "aggregatedTimestamp": 2,
             "logIDs": ["1", "2", "3"],
-            "extractedTimestamps": [4, 5, 6],
+            "logTimestamps": [4, 5, 6],
             "description": "test description",
-            "alertsObtain": {"key": "value"}
+            "alertDetails": {"key": "value"}
         }
         schema = op_schemas.initialize(op_schemas.AGGREGATE_SCHEMA, **values)
 
-        assert schema.__version__ == "1.0.0"
+        assert schema.__version__ == "2.0.0"
         assert schema.detectorIDs == ["test id", "another id"]
         assert schema.detectorTypes == ["type test", "another type"]
         assert schema.alertIDs == ["1", "2"]
-        assert schema.outputTimestamp == 2
+        assert schema.aggregatedTimestamp == 2
         assert schema.logIDs == ["1", "2", "3"]
-        assert schema.extractedTimestamps == [4, 5, 6]
+        assert schema.logTimestamps == [4, 5, 6]
         assert schema.description == "test description"
-        assert schema.alertsObtain == {"key": "value"}
-        assert schema.extractedTimestamps == [4, 5, 6]
+        assert schema.alertDetails == {"key": "value"}
+        assert schema.logTimestamps == [4, 5, 6]
 
     def test_copy(self) -> None:
         values = {
@@ -118,7 +118,7 @@ def test_serialize_method(self) -> None:
 
         new_schema = op_schemas.deserialize(op_schemas.LOG_SCHEMA, bschema)
 
-        assert new_schema.__version__ == "1.0.0"
+        assert new_schema.__version__ == "2.0.0"
         assert new_schema.logID == "1"
         assert new_schema.log == "test"
         assert new_schema.logSource == "example"
@@ -157,14 +157,14 @@ def test_is_repeated(self) -> None:
             "detectorID": "test id",
             "detectorType": "type test",
             "alertID": "1",
-            "detectionTimestamp": 2,
+            "detectedTimestamp": 2,
             "logIDs": ["1", "2", "3"],
             "score": 0.5,
-            "extractedTimestamps": [4, 5, 6]
+            "logTimestamps": [4, 5, 6]
         }
         schema = op_schemas.initialize(op_schemas.DETECTOR_SCHEMA, **values)
 
         assert not op_schemas.is_repeated(schema, "detectorID")
         assert not op_schemas.is_repeated(schema, "score")
         assert op_schemas.is_repeated(schema, "logIDs")
-        assert op_schemas.is_repeated(schema, "extractedTimestamps")
+        assert op_schemas.is_repeated(schema, "logTimestamps")
diff --git a/tests/test_schemas/test_schema_class.py b/tests/test_schemas/test_schema_class.py
index e809100b..7f7dcf0d 100644
--- a/tests/test_schemas/test_schema_class.py
+++ b/tests/test_schemas/test_schema_class.py
@@ -13,18 +13,18 @@ def test_basic_init(self):
         schema_var = SchemaVariables(schema_class=PARSER_SCHEMA)
 
         assert schema_var.schema_class == PARSER_SCHEMA
-        assert schema_var.get_schema().__version__ == "1.0.0"
+        assert schema_var.get_schema().__version__ == "2.0.0"
 
     def test_init_with_kwargs(self):
         values = {
             "parserType": "test",
             "parserID": "test",
-            "EventID": 0,
+            "eventID": 0,
             "template": "test template",
             "variables": ["a", "b"],
             "parsedLogID": "0",
             "log": "test log",
-            "logFormatVariables": {"TimeStamp": "test timestamp"},
+            "headerVariables": {"TimeStamp": "test timestamp"},
             "receivedTimestamp": 0,
             "parsedTimestamp": 0,
         }
@@ -33,13 +33,13 @@ def test_init_with_kwargs(self):
 
         assert schema_var.parserType == "test"
         assert schema_var.parserID == "test"
-        assert schema_var.EventID == 0
+        assert schema_var.eventID == 0
         assert schema_var.template == "test template"
         assert schema_var.variables == ["a", "b"]
         assert schema_var.parsedLogID == "0"
         assert schema_var.logID == "0"
         assert schema_var.log == "test log"
-        assert schema_var.logFormatVariables == {"TimeStamp": "test timestamp"}
+        assert schema_var.headerVariables == {"TimeStamp": "test timestamp"}
         assert schema_var.receivedTimestamp == 0
         assert schema_var.parsedTimestamp == 0
 
@@ -67,7 +67,7 @@ def test_basic_init(self):
         base_schema = BaseSchema()
 
         assert base_schema.schema_class == BASE_SCHEMA
-        assert base_schema.get_schema().__version__ == "1.0.0"
+        assert base_schema.get_schema().__version__ == "2.0.0"
 
     def test_all_initialize(self):
         LogSchema()
@@ -151,15 +151,15 @@ def test_is_field_list(self):
     def test_as_dict(self):
         detector_schema = DetectorSchema()
         assert detector_schema.as_dict() == {
-            "__version__": "1.0.0",
+            "__version__": "2.0.0",
             "detectorID": detector_schema.detectorID,
             "detectorType": detector_schema.detectorType,
             "alertID": detector_schema.alertID,
-            "detectionTimestamp": detector_schema.detectionTimestamp,
+            "detectedTimestamp": detector_schema.detectedTimestamp,
             "logIDs": detector_schema.logIDs,
             "score": detector_schema.score,
-            "extractedTimestamps": detector_schema.extractedTimestamps,
+            "logTimestamps": detector_schema.logTimestamps,
             "description": detector_schema.description,
             "receivedTimestamp": detector_schema.receivedTimestamp,
-            "alertsObtain": detector_schema.alertsObtain,
+            "alertDetails": detector_schema.alertDetails,
         }