From 21ea541db55191e89c1dd482ef17e9d0c081d6e1 Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 11:29:55 +0200
Subject: [PATCH 01/86] warning box for template tree matcher

---
 docs/parsers/template_tree_matcher.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/parsers/template_tree_matcher.md b/docs/parsers/template_tree_matcher.md
index 328da50d..d6806dc8 100644
--- a/docs/parsers/template_tree_matcher.md
+++ b/docs/parsers/template_tree_matcher.md
@@ -13,7 +13,8 @@ Input and output schemas in the pipeline
 | **Input**  | [LogSchema](../schemas.md) | Unstructured log   |
 | **Output** | [ParserSchema](../schemas.md) | Structured log   |
 
-WARNING: This parser is not yet in a stable release and may behave differently across platforms or hardware.
+!!! warning "Not yet stable"
+    This parser is not yet in a stable release and may behave differently across platforms or hardware.
 
 ## Template format
 

From 73fb21bc8e383dba9dc3d8ab10fc7a783af2ef35 Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 11:32:46 +0200
Subject: [PATCH 02/86] proper note formatting across docs

---
 docs/other/log_formats.md             |  6 +++--
 docs/parsers/template_tree_matcher.md |  3 ++-
 docs/user_guide/tutorial.md           | 33 ++++++++++++++-------------
 3 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/docs/other/log_formats.md b/docs/other/log_formats.md
index 8cf611a8..50ab4a36 100644
--- a/docs/other/log_formats.md
+++ b/docs/other/log_formats.md
@@ -85,7 +85,8 @@ Apache httpd access log (Combined Log Format). Each line is fully structured, so
 
 **`log_format`:** `<IP> - - [<Time>] "<RequestType> <Request> <Version>" <Status> <ResponseSize> "<Referer>" "<UserAgent>"`
 
-> All fields land directly in `logFormatVariables`. Use `header_variables` in your detector config to track e.g. `Status`, `IP`, or `RequestType`.
+!!! note
+    All fields land directly in `logFormatVariables`. Use `header_variables` in your detector config to track e.g. `Status`, `IP`, or `RequestType`.
 
 ---
 
@@ -245,7 +246,8 @@ Jun 14 15:16:02 combo sshd(pam_unix)[19939]: authentication failure; logname= ui
 
 **`log_format`:** `<Month> <Date> <Time> <Level> <Component>([<PID>])?: <Content>`
 
-> Note: `<Level>` captures the **hostname** in standard syslog (the field name follows benchmark convention).
+!!! note
+    `<Level>` captures the **hostname** in standard syslog (the field name follows benchmark convention).
 
 **Variable noise patterns:** IP addresses (`(\d+\.){3}\d+`), embedded timestamps (`\d{2}:\d{2}:\d{2}`).
 
diff --git a/docs/parsers/template_tree_matcher.md b/docs/parsers/template_tree_matcher.md
index d6806dc8..c6376987 100644
--- a/docs/parsers/template_tree_matcher.md
+++ b/docs/parsers/template_tree_matcher.md
@@ -73,4 +73,5 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     | `time_format` | string, null | None | shared | fitting description yet to find |
 <!-- End arguments -->
 
-Note: this matcher removes non-alphanumeric characters from logs and templates before matching, except for the `<*>` token. Ensure your templates are compatible with that normalization.
+!!! note
+    This matcher removes non-alphanumeric characters from logs and templates before matching, except for the `<*>` token. Ensure your templates are compatible with that normalization.
diff --git a/docs/user_guide/tutorial.md b/docs/user_guide/tutorial.md
index 9fdc0113..58f2f046 100644
--- a/docs/user_guide/tutorial.md
+++ b/docs/user_guide/tutorial.md
@@ -24,12 +24,13 @@ this time **you write the templates yourself**. A finished template file is
 included in the repository, but only so you can check your result in step 2.
 That is the point: before you can parse a dataset, you have to look at it.
 
-> **Note:** like the Quickstart, this tutorial assumes a cloned repository and
-> runs from the repository root, the folder that contains `pyproject.toml` (see
-> [Before you start](quickstart.md#before-you-start)). The code finds its files
-> relative to that folder through `ROOT = Path.cwd()`. If you work in a notebook
-> stored somewhere else, set `ROOT` to the path of your clone instead, for example
-> `ROOT = Path("/home/me/DetectMateLibrary")`.
+!!! note
+    Like the Quickstart, this tutorial assumes a cloned repository and
+    runs from the repository root, the folder that contains `pyproject.toml` (see
+    [Before you start](quickstart.md#before-you-start)). The code finds its files
+    relative to that folder through `ROOT = Path.cwd()`. If you work in a notebook
+    stored somewhere else, set `ROOT` to the path of your clone instead, for example
+    `ROOT = Path("/home/me/DetectMateLibrary")`.
 
 ```python
 --8<-- "docs/examples/others/tutorial.py:read"
@@ -113,16 +114,16 @@ A few things worth noticing while writing templates like these:
 --8<-- "docs/examples/others/tutorial.py:own_parser"
 ```
 
-> **Common pitfall: don't escape `log_format` yourself.** The Quickstart's
-> `log_format` string escapes the parentheses by hand:
-> `r"...audit\(<Time>:<Serial>\):..."`. Don't copy that; it's wrong.
-> `generate_logformat_regex()` (used internally by every parser that accepts
-> `log_format`) already escapes every literal character outside the
-> `<Placeholder>` tokens, parentheses included. Escaping them yourself asks it
-> to match a **literal backslash** followed by `(`, which never occurs in
-> real log data. The regex then silently fails to match anything, and every
-> log falls back to `<Not Found>`. Write `log_format` as plain text; only the
-> `<Placeholder>` tokens are special.
+!!! warning "Common pitfall: don't escape log_format yourself"
+    The Quickstart's `log_format` string escapes the parentheses by hand:
+    `r"...audit\(<Time>:<Serial>\):..."`. Don't copy that; it's wrong.
+    `generate_logformat_regex()` (used internally by every parser that accepts
+    `log_format`) already escapes every literal character outside the
+    `<Placeholder>` tokens, parentheses included. Escaping them yourself asks it
+    to match a **literal backslash** followed by `(`, which never occurs in
+    real log data. The regex then silently fails to match anything, and every
+    log falls back to `<Not Found>`. Write `log_format` as plain text; only the
+    `<Placeholder>` tokens are special.
 
 Running this prints, for each of the 9 logs, the `EventID` and the matched
 template. All four templates get used, and every line matches (nothing

From cc110ac9b27de22349c26e6db7d326b6c380f50a Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 11:46:33 +0200
Subject: [PATCH 03/86] link template matcher to named event explanation

---
 docs/parsers/template_matcher.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/docs/parsers/template_matcher.md b/docs/parsers/template_matcher.md
index 1564012b..d049795f 100644
--- a/docs/parsers/template_matcher.md
+++ b/docs/parsers/template_matcher.md
@@ -46,6 +46,11 @@ pid=<*> uid=<*> auid=<*> ses=<*> msg='op=PAM:<*> acct=<*>
 login success: user=<*> source=<*>
 ```
 
+Templates can also name their wildcards (`<user>` instead of `<*>`), and a `.csv` template
+file with an `EventId` column can name each template. Detector configurations can then use
+these names instead of numbers; see
+[Named EventIDs and variables](../detectors.md#named-eventids-and-variables).
+
 ## Example
 
 Load the templates and match a log:

From a8b7515c0f48a1799327ce1cdb194e5153707dc0 Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 12:14:41 +0200
Subject: [PATCH 04/86] document use of templates based on how oten it has
 matched

---
 docs/parsers/template_matcher.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/parsers/template_matcher.md b/docs/parsers/template_matcher.md
index d049795f..a2c002a4 100644
--- a/docs/parsers/template_matcher.md
+++ b/docs/parsers/template_matcher.md
@@ -16,11 +16,11 @@ Input and output schemas in the pipeline
 The template matcher is a lightweight, fast parser intended for logs that follow stable textual templates with variable fields. Templates use the token `<*>` to mark wildcard slots. The matcher:
 
 - Preprocesses logs and templates (remove spaces, punctuation, lowercase) based on config.
-- Finds the first template that matches and extracts all wildcard parameters in order.
+- Tries the templates in order of how often each has matched so far, uses the first one that matches, and extracts all wildcard parameters in order. If templates overlap, the same log can therefore get a different `EventID` over time.
 - Populates ParserSchema fields: `EventID`, `template`, `variables`,  `logID`, and related fields.
 - **`EventID` is the 0-indexed line number of the matched template** in the template file (first line → `EventID: 0`, second line → `EventID: 1`, etc.).
 
-This parser is deterministic and designed for high-throughput use when templates are known in advance.
+This parser is designed for high-throughput use when templates are known in advance.
 
 ## EventID assignment (preliminary)
 

From 56edafac1a587ba90fbee755694e374186289604 Mon Sep 17 00:00:00 2001
From: viktorbeck98 <viktor.beck98@gmail.com>
Date: Mon, 12 Oct 2026 13:06:35 +0200
Subject: [PATCH 05/86] fix: JsonParser crash without dict config, EventID 0
 without message

A JsonParserConfig object (or the default config) left the parser without
a content parser, so the first log with a message field raised
AttributeError. It now gets a MatcherParser without templates.

Logs without a message field got EventID 0, the ID of the first template.
They now get EventID -1 and the template <Not Found>, like any log that
matches no template.

Closes #357

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/detectmatelibrary/parsers/json_parser.py |  5 +-
 tests/test_parsers/test_json_parser.py       | 57 ++++++++++++++++++--
 2 files changed, 58 insertions(+), 4 deletions(-)

diff --git a/src/detectmatelibrary/parsers/json_parser.py b/src/detectmatelibrary/parsers/json_parser.py
index f3d9d412..02387898 100644
--- a/src/detectmatelibrary/parsers/json_parser.py
+++ b/src/detectmatelibrary/parsers/json_parser.py
@@ -74,6 +74,9 @@ def __init__(
             )
             self.content_parser = MatcherParser(config=content_parser_config)
             config = cfg_dict
+        else:
+            # a config object cannot define the content parser: use one without templates
+            self.content_parser = MatcherParser()
         super().__init__(name=name, config=config)
         self.config: JsonParserConfig
 
@@ -86,7 +89,7 @@ def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> Non
         timestamp = self.time_extractor.extract(obj=log, delete=True)
         content = self.content_extractor.extract(obj=log, delete=True)
 
-        parsed = {"EventTemplate": "", "Params": [], "EventId": 0}
+        parsed = {"EventTemplate": "<Not Found>", "Params": [], "EventId": -1}
         # if the json also contains a message field, parse it for template and parameters
         if content:
             log_ = schemas.LogSchema({"log": content})
diff --git a/tests/test_parsers/test_json_parser.py b/tests/test_parsers/test_json_parser.py
index 35964071..35e7e4fa 100644
--- a/tests/test_parsers/test_json_parser.py
+++ b/tests/test_parsers/test_json_parser.py
@@ -60,10 +60,10 @@ def test_parse_json_without_message(self):
         output = schemas.ParserSchema()
         parser.parse(input_log, output)
 
-        # When no message field, template should be empty
-        assert output.template == ""
+        # When no message field, no template is found
+        assert output.template == "<Not Found>"
         assert len(output.variables) == 0
-        assert output.EventID == 0
+        assert output.EventID == -1
 
         # But other fields should be present
         assert "level" in output.logFormatVariables
@@ -164,6 +164,57 @@ def test_parse_with_content_parser(self):
         assert len(output.variables) > 0
         assert "level" in output.logFormatVariables
 
+    def test_parse_message_with_config_object(self):
+        """A message parsed with a config object matches no template."""
+        config = JsonParserConfig()
+        parser = JsonParser(name="TestParser", config=config)
+
+        json_log = {
+            "time": "2023-11-18 10:30:00",
+            "message": "hello world"
+        }
+
+        input_log = schemas.LogSchema({
+            "logID": "1",
+            "log": json.dumps(json_log)
+        })
+
+        output = schemas.ParserSchema()
+        parser.parse(input_log, output)
+
+        assert output.template == "<Not Found>"
+        assert output.EventID == -1
+
+    def test_no_message_differs_from_first_template(self):
+        """Logs without message do not share the first template's EventID."""
+        config_dict = {
+            "parsers": {
+                "TestParser": {
+                    "auto_config": True,
+                    "method_type": "json_parser",
+                },
+                "JsonMatcherParser": {
+                    "auto_config": True,
+                    "method_type": "matcher_parser",
+                    "path_templates": TEST_TEMPLATES
+                }
+            }
+        }
+        parser = JsonParser(name="TestParser", config=config_dict)
+
+        json_logs = [
+            {"message": "pid=9699 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\""},
+            {"level": "INFO"},
+        ]
+
+        event_ids = []
+        for json_log in json_logs:
+            output = schemas.ParserSchema()
+            parser.parse(schemas.LogSchema({"logID": "1", "log": json.dumps(json_log)}), output)
+            event_ids.append(output.EventID)
+
+        assert event_ids == [0, -1]
+
     def test_custom_field_names(self):
         """Test with custom timestamp and message field names."""
         config = JsonParserConfig(timestamp_name="timestamp", content_name="msg")

From 9fb8aa107202598735347da0ce4501b1e5c7f684 Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 13:49:43 +0200
Subject: [PATCH 06/86] remove mention of unit test pattern

---
 docs/detectors.md | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/docs/detectors.md b/docs/detectors.md
index f3d9e5fe..04a77388 100644
--- a/docs/detectors.md
+++ b/docs/detectors.md
@@ -8,7 +8,7 @@ Detectors process structured logs from Parsers and emit alerts when anomalies ar
 | **Input**  | [ParserSchema](schemas.md) | Structured log     |
 | **Output** | [DetectorSchema](schemas.md)| Alert / finding    |
 
-This document describes the minimal API, implementation guidance, a short example detector and a unit test pattern.
+This document describes the minimal API, implementation guidance and a short example detector.
 
 ## CoreDetector: minimal API
 
@@ -145,7 +145,7 @@ example configurations set `auto_config: false` anyway, to make this explicit. I
 `auto_config` is `True` *and* `data_use_configure` is set, the configure phase replaces the
 `events` block with its own selection.
 
-When `auto_config` is set to `False`, the detector expects an explicit `events` or `global` block that specifies exactly which variables to monitor. `events` refers to event-specific variables while `global` refers to variables, that are not bound to events (`header_variables` can but don't have to be event bound):
+When `auto_config` is set to `False`, the detector expects an explicit `events` or `global` block that specifies exactly which variables to monitor. `events` refers to event-specific variables while `global` refers to variables that are not bound to events (`header_variables` can but don't have to be event bound):
 
 ```yaml
 detectors:
@@ -172,14 +172,14 @@ detectors:
 
 ### Common parameters (all detectors)
 
-There are some parameters, that **every** detector inherits from `CoreDetectorConfig`/`CoreConfig`/`BasicConfig`, regardless of what it does. The other parameters, that are **specific** for the respective detector, are explained right at the detectors documentation page, later on.
+Some parameters are inherited by **every** detector from `CoreDetectorConfig`/`CoreConfig`/`BasicConfig`, regardless of what it does. The parameters that are **specific** to a detector are explained on that detector's own page.
 
 <!-- Start common_arguments -->
 ???+ note "Top level"
 
     | Field | Type | Default | Description |
     |---|---|---|---|
-    | `auto_config` | boolean | True | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | Events configuration dict keyed by event_id. |
     | `global` | object | {} | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
 
@@ -188,8 +188,8 @@ There are some parameters, that **every** detector inherits from `CoreDetectorCo
     | Field | Type | Default | Description |
     |---|---|---|---|
     | `start_id` | integer | 10 | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
@@ -207,13 +207,13 @@ The detectors that keep their model in persistency stores ([New Event](detectors
 
     | Field | Type | Default | Description |
     |---|---|---|---|
-    | `persist` | object, null | None | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See [Saving state (persist)](detectors.md#saving-state-persist). |
 
 ???+ note "params"
 
     | Field | Type | Default | Description |
     |---|---|---|---|
-    | `allow_fed` | boolean | False | Allow to do the federation |
+    | `allow_fed` | boolean | False | Builds the stores needed to take part in [federation](federation.md). |
 <!-- End tracker_arguments -->
 
 ### Per-variable model detectors
@@ -368,8 +368,8 @@ axes:
 | `slope_index` | change centroid vs. `slope_threshold` | index positions |
 | `slope_time` | change centroid vs. `slope_threshold` | normalized timestamps |
 
-Any subset of the four may be enabled, and any single one may stand alone. The
-default (`index` alone) is the historical behaviour: each segment's mean rate
+Any subset of the four may be enabled, and any single one may stand alone. By
+default only `index` is enabled: each segment's mean rate
 of change is compared against its entry in `segment_thresholds` (four segments
 by default, one threshold per segment), and the segments are **equal-count**:
 each holds the same number of observations, regardless of how much time they
@@ -410,12 +410,11 @@ detectors:
       timestamp_format: "%y%m%d %H%M%S"
 ```
 
-Defaults reproduce the historical behaviour exactly: `index: True`, the other
-three `False`, `segment_thresholds: [1.1, 0.3, 0.1, 0.01]`, `decision: consensus`,
+The defaults are `index: True`, the other three `False`,
+`segment_thresholds: [1.1, 0.3, 0.1, 0.01]`, `decision: consensus` and
 `slope_threshold: -0.05`. A config that sets nothing under `classification`
-classifies identically to before these changes on every series with at least
-four observations; the one exception is the segment floor described under
-"Fields" below.
+uses exactly these. A variable with fewer observations than segments is
+classified `INSUFFICIENT_DATA`; see the segment floor under "Fields" below.
 
 #### The decision rule
 

From 85603983c986f43a1df894c99b2cc8ef914a30e3 Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 14:10:31 +0200
Subject: [PATCH 07/86] add that new values always emit an alert

---
 docs/detectors/charset.md   | 2 +-
 docs/detectors/combo.md     | 2 +-
 docs/detectors/new_event.md | 2 +-
 docs/detectors/new_value.md | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/detectors/charset.md b/docs/detectors/charset.md
index 11f9de65..258ba0fc 100644
--- a/docs/detectors/charset.md
+++ b/docs/detectors/charset.md
@@ -19,7 +19,7 @@ Input and output schemas in the pipeline
 
 ## Description
 
-This detector maintains a lightweight set of observed characters per monitored field and emits an alert when a character not present in the set is seen for the first time (subject to configuration).
+This detector keeps the set of characters observed during training for each monitored field and emits an alert whenever a value contains a character that is not in the set. Alerts don't add the character to the set, so the same unseen character raises an alert every time it appears.
 
 ## Example
 
diff --git a/docs/detectors/combo.md b/docs/detectors/combo.md
index 00b22642..bcc0e094 100644
--- a/docs/detectors/combo.md
+++ b/docs/detectors/combo.md
@@ -19,7 +19,7 @@ Input and output schemas in the pipeline
 
 ## Description
 
-This detector maintains a lightweight set of observed combination of values per monitored fields and emits an alert when a combination is not present in the set seen for the first time (subject to configuration).
+This detector keeps the set of value combinations observed during training for each group of monitored fields and emits an alert whenever a combination that is not in the set appears. Alerts don't add the combination to the set, so the same unseen combination raises an alert every time it appears.
 
 A combination needs at least two variables in the same instance: with a single variable the detector behaves like the [New Value Detector](new_value.md).
 
diff --git a/docs/detectors/new_event.md b/docs/detectors/new_event.md
index 03ccf041..e43e6022 100644
--- a/docs/detectors/new_event.md
+++ b/docs/detectors/new_event.md
@@ -19,7 +19,7 @@ Input and output schemas in the pipeline
 
 ## Description
 
-This detector maintains a lightweight set of observed event IDs and emits an alert when an event ID not present in the set is seen for the first time (subject to configuration).
+This detector keeps the set of event IDs observed during training and emits an alert whenever an event ID that is not in the set appears. Alerts don't add the event ID to the set, so the same unseen event ID raises an alert every time it appears.
 
 ## Example
 
diff --git a/docs/detectors/new_value.md b/docs/detectors/new_value.md
index 62a5e10d..abb7b3b4 100644
--- a/docs/detectors/new_value.md
+++ b/docs/detectors/new_value.md
@@ -19,7 +19,7 @@ Input and output schemas in the pipeline
 
 ## Description
 
-This detector maintains a lightweight set of observed values per monitored field and emits an alert when a value not present in the set is seen for the first time (subject to configuration).
+This detector keeps the set of values observed during training for each monitored field and emits an alert whenever a value that is not in the set appears. Alerts don't add the value to the set, so the same unseen value raises an alert every time it appears.
 
 ## Example
 

From a5f297dc90738ba478eb108268ac5cafeed63c81 Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 14:11:37 +0200
Subject: [PATCH 08/86] correct charset description

---
 docs/detectors/charset.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/detectors/charset.md b/docs/detectors/charset.md
index 258ba0fc..0d5a340c 100644
--- a/docs/detectors/charset.md
+++ b/docs/detectors/charset.md
@@ -1,6 +1,6 @@
 # Charset Detector
 
-The Charset Detector raises alerts when previously unseen characters appear in configured fields. It is useful to detect novelty, configuration drift, or the appearance of new actors in the environment.
+The Charset Detector raises alerts when previously unseen characters appear in configured fields. It is useful to detect malformed or injected values in fields with a predictable format, for example shell characters such as `;` in a user name.
 
 ## In/out
 

From b2eb4f1a636ecd09edc9f45fbd46a341695cb8dd Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 14:13:01 +0200
Subject: [PATCH 09/86] fix event sequence example

---
 docs/examples/detectors/event_sequence.py | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/docs/examples/detectors/event_sequence.py b/docs/examples/detectors/event_sequence.py
index 9a9027ea..a21a0b88 100644
--- a/docs/examples/detectors/event_sequence.py
+++ b/docs/examples/detectors/event_sequence.py
@@ -1,4 +1,6 @@
 # --8<-- [start:example]
+from itertools import count
+
 import yaml
 from detectmatelibrary import schemas
 from detectmatelibrary.detectors.event_sequence_detector import EventSequenceDetector
@@ -8,9 +10,13 @@
 detector = EventSequenceDetector(name="LoginSequenceDetector", config=config)
 
 
+log_ids = count()
+
+
 def event(event_id: int) -> schemas.ParserSchema:
-    """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    """A parsed log with a running logID; only its EventID (the matched
+    template) matters for detection."""
+    return schemas.ParserSchema({"EventID": event_id, "logID": str(next(log_ids))})
 
 
 # normal session: 0 = login accepted, 1 = session opened, 2 = session closed.
@@ -24,7 +30,7 @@ def event(event_id: int) -> schemas.ParserSchema:
 detector.process(event(0))
 alert = detector.process(event(2))  # session closed without being opened
 print(dict(alert["alertsObtain"]))
-# {'Sequence (0, 2)': 'EventID sequence of length 2 ending at logID  was not seen during training.'}
+# {'Sequence (0, 2)': 'EventID sequence of length 2 ending at logID 10 was not seen during training.'}
 
 print(detector.get_known_sequences())  # {(0, 1), (1, 2), (2, 0)}
 # --8<-- [end:example]

From edff3569a553048dd3b6286288ff39d05b887511 Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 14:24:56 +0200
Subject: [PATCH 10/86] automate examples for alert aggregator

---
 docs/alert_aggregators/basic_concatenation.md | 59 +++++++++++++++----
 .../alert_aggregators/basic_concat.py         | 13 +---
 .../alert_aggregators/basic_concat.yaml       |  6 ++
 docs/examples/config/update.py                | 13 ++++
 .../alert_aggregation/basic_concat.py         | 10 +++-
 .../common/alert_aggregator.py                |  5 +-
 6 files changed, 81 insertions(+), 25 deletions(-)
 create mode 100644 docs/examples/alert_aggregators/basic_concat.yaml

diff --git a/docs/alert_aggregators/basic_concatenation.md b/docs/alert_aggregators/basic_concatenation.md
index 5e37b904..22554668 100644
--- a/docs/alert_aggregators/basic_concatenation.md
+++ b/docs/alert_aggregators/basic_concatenation.md
@@ -1,25 +1,62 @@
 # Basic Concat Alert Aggregation
 
-The basic concat alert aggregation approach aggregates x number of alerts into one output schema.
+The Basic Concat alert aggregation combines the most recent alerts into one aggregated record by
+concatenating their IDs and timestamps.
+
+## In/out
+
+Input and output schemas in the pipeline
 
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
 | **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
 
+## Description
 
-# Configuration example
-
-```yaml
-alert_aggregators:
-    BasicConcatAggregator:
-        method_type: "basic_concat_aggregator"
-        buffer_size: 3
-        auto_config: False
-```
+The aggregator keeps a sliding window of the last `buffer_size` alerts. The first aggregated record
+is emitted once the window is full, and then one record for every new alert, so consecutive records
+overlap. Alerts are combined in the order they arrive, not grouped by log, and the alerts' own
+messages are not carried over (see [What `run()` fills in for you](../alert_aggregator.md#what-run-fills-in-for-you)).
+The [tutorial](../user_guide/tutorial.md#4-add-an-alert-aggregator) shows the overlapping output.
 
-## Example usage
+## Example
 
 ```python
 --8<-- "docs/examples/alert_aggregators/basic_concat.py:example_1"
 ```
+
+## Configuration file
+
+The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
+
+```yaml
+--8<-- "docs/examples/alert_aggregators/basic_concat.yaml"
+```
+
+Load it with `yaml.safe_load` and pass the dict as `config=`, as in the example. The key under `alert_aggregators:` must match the aggregator's `name`.
+
+## Configuration arguments
+
+All parameters this alert aggregator accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this aggregator or `shared` with other alert aggregators.
+
+<!-- Start arguments -->
+??? note "Top level"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `method_type` | string | basic_concat_aggregator | shared | Indicates what type of method it is. |
+    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `buffer_size` | integer | 3 | specific | Number of most recent alerts aggregated together (size of the sliding window). |
+    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
+    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End arguments -->
diff --git a/docs/examples/alert_aggregators/basic_concat.py b/docs/examples/alert_aggregators/basic_concat.py
index ea1bc53a..009ba319 100644
--- a/docs/examples/alert_aggregators/basic_concat.py
+++ b/docs/examples/alert_aggregators/basic_concat.py
@@ -1,19 +1,12 @@
 
 # --8<-- [start:example_1]
+import yaml
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation
 
 import detectmatelibrary.schemas as schemas
 
-
-aggregations_config = {
-    "alert_aggregators": {
-        "BasicConcatAggregator": {
-            "method_type": "basic_concat_aggregator",
-            "buffer_size": 3,
-            "auto_config": False,
-        }
-    }
-}
+with open("docs/examples/alert_aggregators/basic_concat.yaml") as f:
+    aggregations_config = yaml.safe_load(f)
 
 
 input_ = schemas.DetectorSchema({
diff --git a/docs/examples/alert_aggregators/basic_concat.yaml b/docs/examples/alert_aggregators/basic_concat.yaml
new file mode 100644
index 00000000..9d653635
--- /dev/null
+++ b/docs/examples/alert_aggregators/basic_concat.yaml
@@ -0,0 +1,6 @@
+alert_aggregators:
+  BasicConcatAggregator:
+    method_type: basic_concat_aggregator
+    auto_config: false
+    params:
+      buffer_size: 3            # aggregate the 3 most recent alerts
diff --git a/docs/examples/config/update.py b/docs/examples/config/update.py
index 12b8d8aa..c7c2d14e 100644
--- a/docs/examples/config/update.py
+++ b/docs/examples/config/update.py
@@ -26,6 +26,8 @@
 from detectmatelibrary.common.core import CoreConfig
 from detectmatelibrary.common.detector import CoreDetectorConfig
 from detectmatelibrary.common.parser import CoreParserConfig
+from detectmatelibrary.common.alert_aggregator import CoreAlertAggregatorConfig
+from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregationConfig
 from detectmatelibrary.base_detectors import TrackerDetectorConfig
 from detectmatelibrary.base_detectors import VariableDetectorConfig
 from detectmatelibrary.base_detectors import DeepLearningDetectorConfig
@@ -252,3 +254,14 @@ def update_shared_args_parsers(doc_path: str) -> None:
 
 for parser_config, shared_base, doc_path in PARSER_DOCS:
     update_docs(parser_config, doc_path=doc_path, shared_base=shared_base)
+
+ALERT_AGGREGATOR_DOCS: list[tuple[CoreConfig, type[CoreConfig], str]] = [
+    (
+        BasicConcatAggregationConfig(),
+        CoreAlertAggregatorConfig,
+        "docs/alert_aggregators/basic_concatenation.md",
+    ),
+]
+
+for aggregator_config, shared_base, doc_path in ALERT_AGGREGATOR_DOCS:
+    update_docs(aggregator_config, doc_path=doc_path, shared_base=shared_base)
diff --git a/src/detectmatelibrary/alert_aggregation/basic_concat.py b/src/detectmatelibrary/alert_aggregation/basic_concat.py
index 45883cf8..7ae79e96 100644
--- a/src/detectmatelibrary/alert_aggregation/basic_concat.py
+++ b/src/detectmatelibrary/alert_aggregation/basic_concat.py
@@ -5,11 +5,17 @@
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
 
 from typing import Any, Optional
+from pydantic import Field
 
 
 class BasicConcatAggregationConfig(CoreAlertAggregatorConfig):
-    method_type: str = "basic_concat_aggregator"
-    buffer_size: int = 3
+    method_type: str = Field(
+        default="basic_concat_aggregator", description="Indicates what type of method it is."
+    )
+    buffer_size: int = Field(
+        default=3,
+        description="Number of most recent alerts aggregated together (size of the sliding window).",
+    )
 
 
 class BasicConcatAggregation(CoreAlertAggregator):
diff --git a/src/detectmatelibrary/common/alert_aggregator.py b/src/detectmatelibrary/common/alert_aggregator.py
index 44d84fda..9108a730 100644
--- a/src/detectmatelibrary/common/alert_aggregator.py
+++ b/src/detectmatelibrary/common/alert_aggregator.py
@@ -8,6 +8,7 @@
 
 from typing import Any, Optional
 from typing_extensions import override
+from pydantic import Field
 
 
 def _extract_field(
@@ -31,8 +32,8 @@ def _extract_list_field(input_: list[DetectorSchema] | DetectorSchema, field: st
 
 
 class CoreAlertAggregatorConfig(CoreConfig):
-    component_type: str = "alert_aggregators"
-    method_type: str = "core_alert_aggregator"
+    component_type: str = Field(default="alert_aggregators", description="<$IGNORE$>")
+    method_type: str = Field(default="core_alert_aggregator", description="<$IGNORE$>")
 
 
 class CoreAlertAggregator(CoreComponent):

From 36b2a478b8cc952affa848431ba5bcd4c36b8778 Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 14:38:11 +0200
Subject: [PATCH 11/86] correct exports of persistency errors

---
 src/detectmatelibrary/utils/persistency/__init__.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/detectmatelibrary/utils/persistency/__init__.py b/src/detectmatelibrary/utils/persistency/__init__.py
index 228197eb..a8a24db7 100644
--- a/src/detectmatelibrary/utils/persistency/__init__.py
+++ b/src/detectmatelibrary/utils/persistency/__init__.py
@@ -1,5 +1,12 @@
 from .event_persistency import EventPersistency
-from .persistency_saver import PersistencySaver, PersistencySaverConfig, PersistencyLoadError, save, load
+from .persistency_saver import (
+    PersistencySaver,
+    PersistencySaverConfig,
+    PersistencyLoadError,
+    PersistencySaveError,
+    save,
+    load,
+)
 from .data_structures.base import EventDataset
 from .data_structures.trackers.stability.stability_tracker import EventStabilityTracker
 

From 6bf3d8d474337d9b5a47643c4bb85ed6ec159072 Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 14:38:37 +0200
Subject: [PATCH 12/86] typo

---
 docs/auxiliar/input_buffer.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/auxiliar/input_buffer.md b/docs/auxiliar/input_buffer.md
index 09a53397..e1d352b2 100644
--- a/docs/auxiliar/input_buffer.md
+++ b/docs/auxiliar/input_buffer.md
@@ -1,4 +1,4 @@
-#  Data Buffer
+# Data Buffer
 
 The data buffer is an auxiliary method that can be used in all the components. It takes the stream data and formats it to the given specifications.
 

From 8323cd3b38e2d90e15e6dea40f98b2817e971dc4 Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 14:46:48 +0200
Subject: [PATCH 13/86] log format like in tutorial

---
 docs/other/log_formats.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/other/log_formats.md b/docs/other/log_formats.md
index 50ab4a36..0a7cd1a1 100644
--- a/docs/other/log_formats.md
+++ b/docs/other/log_formats.md
@@ -53,7 +53,7 @@ Linux auditd log. Produced by the kernel audit subsystem; records system calls,
 type=USER_ACCT msg=audit(1642723741.072:375): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
 ```
 
-**`log_format`:** `type=<Type> msg=audit(<Time>): <Content>`
+**`log_format`:** `type=<Type> msg=audit(<Time>:<Serial>): <Content>`
 
 **Variable noise patterns:** Numeric field values (`=\d+`), IP addresses (`(\d+\.){3}\d+`).
 

From 5d22e936a2725056fc01bc89e0fd13c9660aa09d Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Mon, 12 Oct 2026 14:54:23 +0200
Subject: [PATCH 14/86] improve bug description

---
 docs/contribution.md | 10 +++++++---
 docs/development.md  |  4 ++--
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/docs/contribution.md b/docs/contribution.md
index 64b81925..dc6ccfa0 100644
--- a/docs/contribution.md
+++ b/docs/contribution.md
@@ -11,9 +11,13 @@ Bug reports are very helpful to us in improving the software, and therefore, the
 at least the following information in a bug report:
 
 1. Description of the bug. Describe the problem clearly.
-2. Steps to reproduce. With the following configuration, go to.., click.., see error
-3. Expected behavior. What should happen?
-4. Environment. What was the environment for the test(version, browser, etc..)
+2. Steps to reproduce. A minimal code snippet, plus the configuration (YAML or dict) and, if
+   possible, a few log lines that trigger the problem.
+3. Expected behavior. What should happen, and what happens instead (including the full error
+   message, if any)?
+4. Environment. Your Python version, your DetectMate version
+   (`python -c "import detectmatelibrary; print(detectmatelibrary.__version__)"`) and your
+   operating system.
 
 *Please don't include any private/sensitive information in your issue! For reporting security-related issues, see [SECURITY.md](https://github.com/ait-detectmate/DetectMateLibrary/blob/main/SECURITY.md)*
 
diff --git a/docs/development.md b/docs/development.md
index 97ba47ce..1c27f4ea 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -20,9 +20,9 @@ uv sync --dev
 
 ## Use prek to run code checks
 
-Every code contributer must use [`prek`](https://github.com/j178/prek) to run basic checks at commit time.
+Every code contributor must use [`prek`](https://github.com/j178/prek) to run basic checks at commit time.
 `prek` is configured via the existing `.pre-commit-config.yaml`
-and can be installed as part of the `dev` extras. To ensure pre-commit hooks run before each commit, run:
+and is installed with the `dev` dependency group. To ensure pre-commit hooks run before each commit, run:
 
 ```bash
 uv run prek install

From 0d062f70f890be8cccfbfeb0879c723a421be471 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 12 Oct 2026 14:59:11 +0200
Subject: [PATCH 15/86] Automated documentation update

---
 docs/detectors.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/detectors.md b/docs/detectors.md
index 04a77388..5ffcacb8 100644
--- a/docs/detectors.md
+++ b/docs/detectors.md
@@ -179,7 +179,7 @@ Some parameters are inherited by **every** detector from `CoreDetectorConfig`/`C
 
     | Field | Type | Default | Description |
     |---|---|---|---|
-    | `auto_config` | boolean | True | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
+    | `auto_config` | boolean | True | Runs the configuration step before the training process. |
     | `events` | object | {} | Events configuration dict keyed by event_id. |
     | `global` | object | {} | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
 
@@ -188,8 +188,8 @@ Some parameters are inherited by **every** detector from `CoreDetectorConfig`/`C
     | Field | Type | Default | Description |
     |---|---|---|---|
     | `start_id` | integer | 10 | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | Number of logs used for training. None skips training. |
-    | `data_use_configure` | integer, null | None | Number of logs used for the configuration step. None skips it. |
+    | `data_use_training` | integer, null | None | Data used for training, if None, training is not done. |
+    | `data_use_configure` | integer, null | None | Data used for configuration, if None, configuration is not done. |
     | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
@@ -207,13 +207,13 @@ The detectors that keep their model in persistency stores ([New Event](detectors
 
     | Field | Type | Default | Description |
     |---|---|---|---|
-    | `persist` | object, null | None | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See [Saving state (persist)](detectors.md#saving-state-persist). |
+    | `persist` | object, null | None | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
 
 ???+ note "params"
 
     | Field | Type | Default | Description |
     |---|---|---|---|
-    | `allow_fed` | boolean | False | Builds the stores needed to take part in [federation](federation.md). |
+    | `allow_fed` | boolean | False | Allow to do the federation |
 <!-- End tracker_arguments -->
 
 ### Per-variable model detectors

From 8f21db0ca23ed973616144391e31f99bb6a5ad1d Mon Sep 17 00:00:00 2001
From: viktorbeck98 <viktor.beck98@gmail.com>
Date: Mon, 12 Oct 2026 23:36:24 +0200
Subject: [PATCH 16/86] Rename inconsistent schema fields (schema version
 2.0.0)

EventID -> eventID, logFormatVariables -> headerVariables, alertsObtain -> alertDetails, extractedTimestamps -> logTimestamps, detectionTimestamp -> detectedTimestamp, outputTimestamp -> aggregatedTimestamp, __version__ -> schemaVersion. Field numbers and types are unchanged, so the binary wire format stays. Breaking: no aliases for the old names.

Refs #127

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 AGENTS.md                                     |   4 +-
 docs/alert_aggregator.md                      |   8 +-
 docs/auxiliar/persistency.md                  |  12 +-
 docs/detectors.md                             |  12 +-
 docs/detectors/rule_based.md                  |   2 +-
 docs/development.md                           |   4 +-
 .../alert_aggregators/basic_concat.py         |   6 +-
 docs/examples/detectors/bigram_frequency.py   |   4 +-
 docs/examples/detectors/charset.py            |   4 +-
 docs/examples/detectors/combo.py              |   4 +-
 docs/examples/detectors/deeplog.py            |   2 +-
 docs/examples/detectors/ecvc_detector.py      |   2 +-
 docs/examples/detectors/event_sequence.py     |   4 +-
 docs/examples/detectors/logbert.py            |   2 +-
 docs/examples/detectors/named_events.py       |   2 +-
 docs/examples/detectors/new_event.py          |   4 +-
 docs/examples/detectors/new_value.py          |   4 +-
 docs/examples/detectors/random_detector.py    |   2 +-
 docs/examples/detectors/rule_based.py         |   4 +-
 docs/examples/detectors/scvs_detector.py      |   2 +-
 docs/examples/detectors/value_range.py        |   4 +-
 docs/examples/others/tutorial.py              |   4 +-
 docs/examples/parsers/json_parser.py          |   6 +-
 docs/examples/parsers/template_matcher.py     |   2 +-
 .../examples/parsers/template_tree_matcher.py |   2 +-
 docs/helper/from_to.md                        |  20 +-
 docs/other/log_formats.md                     |   4 +-
 docs/parsers.md                               |   8 +-
 docs/parsers/json_parser.md                   |   2 +-
 docs/parsers/template_matcher.md              |   8 +-
 docs/schemas.md                               |  16 +-
 docs/user_guide/basic_knowledge.md            |  26 +-
 docs/user_guide/tutorial.md                   |  16 +-
 .../_testutils/dummy_detector.py              |   2 +-
 .../_testutils/dummy_parser.py                |   2 +-
 .../base_detectors/_stability.py              |   2 +-
 .../base_detectors/deeplearning_detector.py   |   2 +-
 .../base_detectors/variable_detector.py       |  10 +-
 .../common/_config/_compile.py                |  22 +-
 .../common/alert_aggregator.py                |   4 +-
 src/detectmatelibrary/common/detector.py      |   6 +-
 src/detectmatelibrary/common/parser.py        |   2 +-
 .../detectors/bigram_frequency_detector.py    |   2 +-
 .../detectors/ecvc_detector.py                |   2 +-
 .../detectors/event_sequence_detector.py      |   8 +-
 .../detectors/new_event_detector.py           |   8 +-
 .../detectors/new_value_combo_detector.py     |   4 +-
 .../detectors/random_detector.py              |   4 +-
 .../detectors/rule_detector.py                |   6 +-
 src/detectmatelibrary/helper/from_to.py       |   6 +-
 src/detectmatelibrary/parsers/autoparser.py   |   4 +-
 src/detectmatelibrary/parsers/drain.py        |   4 +-
 src/detectmatelibrary/parsers/json_parser.py  |  10 +-
 .../parsers/logbatcher/parser.py              |   2 +-
 .../parsers/template_matcher/_parser.py       |   2 +-
 src/detectmatelibrary/parsers/tree_matcher.py |   2 +-
 src/detectmatelibrary/schemas/_op.py          |   4 +-
 src/detectmatelibrary/schemas/schemas.proto   |  26 +-
 src/detectmatelibrary/schemas/schemas_pb2.py  |  44 ++--
 .../workspace/templates/CustomDetector.py     |   2 +-
 .../tools/workspace/templates/CustomParser.py |   2 +-
 .../tools/workspace/templates/data/logs.json  |  24 +-
 .../workspace/templates/data/parsed_log.json  |  72 +++---
 .../test_templates/test_CustomDetector.py     |   4 +-
 .../utils/sequence_encoding.py                |   2 +-
 .../test_basic_concat.py                      |   6 +-
 .../test_deeplearning_detectors.py            |   6 +-
 .../test_tracker_detector.py                  |   6 +-
 .../test_variable_detector.py                 |   4 +-
 tests/test_common/test_core.py                |  14 +-
 .../test_common/test_core_alert_aggregator.py |  30 +--
 tests/test_common/test_core_detector.py       |  22 +-
 tests/test_common/test_core_parser.py         |  12 +-
 tests/test_common/test_extract_timestamp.py   |  16 +-
 .../test_auto_config_params_survive.py        |   4 +-
 .../test_bigram_frequency_detector.py         |  34 +--
 tests/test_detectors/test_charset_detector.py |  40 +--
 tests/test_detectors/test_deeplog_detector.py |   6 +-
 tests/test_detectors/test_ecvc_detector.py    |  10 +-
 .../test_event_sequence_detector.py           |   6 +-
 tests/test_detectors/test_logbert_detector.py |   6 +-
 .../test_detectors/test_mismatch_warnings.py  |   4 +-
 .../test_detectors/test_new_event_detector.py |  16 +-
 .../test_new_value_combo_detector.py          |  78 +++---
 .../test_detectors/test_new_value_detector.py |  26 +-
 .../test_persist_integration.py               |   2 +-
 .../test_detectors/test_pre_tracker_state.py  |   2 +-
 tests/test_detectors/test_random_detector.py  |   4 +-
 tests/test_detectors/test_rule_detector.py    |  26 +-
 tests/test_detectors/test_scvs_detector.py    |   8 +-
 .../test_value_range_detector.py              |  50 ++--
 tests/test_helper/test_from_to.py             |  40 +--
 tests/test_parsers/test_drain.py              |  22 +-
 tests/test_parsers/test_json_parser.py        |  44 ++--
 tests/test_parsers/test_logbatcher_parser.py  |   2 +-
 tests/test_parsers/test_template_matcher.py   |  10 +-
 tests/test_parsers/test_tree_matcher.py       |   4 +-
 .../test_time_dependent_stability.py          |   4 +-
 tests/test_pipelines/test_bad_players.py      |   4 +-
 tests/test_pipelines/test_basic_pipelines.py  |   2 +-
 tests/test_pipelines/test_dummy_methods.py    |   4 +-
 tests/test_schemas/test_default_values.py     |  12 +-
 tests/test_schemas/test_field_rename.py       | 234 ++++++++++++++++++
 tests/test_schemas/test_ops.py                |  50 ++--
 tests/test_schemas/test_schema_class.py       |  20 +-
 105 files changed, 813 insertions(+), 579 deletions(-)
 create mode 100644 tests/test_schemas/test_field_rename.py

diff --git a/AGENTS.md b/AGENTS.md
index c499600f..ea9581b7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -84,7 +84,7 @@ detectors:
             - pos: pid          # named wildcard label OR integer position in ParserSchema.variables[]
               name: pid
           header_variables:
-            - pos: Type         # key in ParserSchema.logFormatVariables{}
+            - pos: Type         # key in ParserSchema.headerVariables{}
               params: {}
     global:                     # event-ID-independent instances (GLOBAL_EVENT_ID = "*")
       global_monitor:
@@ -185,7 +185,7 @@ class MyDetector(TrackerDetector):
         super().__init__(name=name, config=config)
 
     def train(self, input_: ParserSchema) -> None:
-        self._ingest(input_, variables={...}, event_id=input_["EventID"])
+        self._ingest(input_, variables={...}, event_id=input_["eventID"])
 ```
 
 Pass tracker kwargs by overriding `_event_data_kwargs()` / `_auto_conf_kwargs()`; build an extra store with `self._new_store()`. Keep `__init__` callable as `MyDetector(name=..., config=...)`: `from_binary()` rebuilds the detector that way, so any other constructor argument needs a default.
diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index deac6763..cc177559 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -52,14 +52,14 @@ Before calling `aggregate_alerts()`, `CoreAlertAggregator.run()` collects these
 alerts in the window:
 
 - `detectorIDs`, `detectorTypes`, `alertIDs`: one entry per alert
-- `logIDs`, `extractedTimestamps`: the entries of all alerts, combined into one list
+- `logIDs`, `logTimestamps`: the entries of all alerts, combined into one list
 
-After `aggregate_alerts()` returns `True`, `run()` also sets `outputTimestamp`. So the only
-fields left for `aggregate_alerts()` to fill are `description` and `alertsObtain`.
+After `aggregate_alerts()` returns `True`, `run()` also sets `aggregatedTimestamp`. So the only
+fields left for `aggregate_alerts()` to fill are `description` and `alertDetails`.
 
 !!! warning "The alerts' details are not carried over"
     `run()` copies only the fields listed above. Everything else in the incoming alerts is dropped
-    unless your `aggregate_alerts()` keeps it, including their `detectionTimestamp` and
+    unless your `aggregate_alerts()` keeps it, including their `detectedTimestamp` and
     `receivedTimestamp`.
 
 ## Available alert aggregators
diff --git a/docs/auxiliar/persistency.md b/docs/auxiliar/persistency.md
index 808af5c0..27653386 100644
--- a/docs/auxiliar/persistency.md
+++ b/docs/auxiliar/persistency.md
@@ -1,7 +1,7 @@
 # Persistency
 
 The persistency module gives a detector a place to remember things about the
-events it sees. State is keyed by `EventID` and survives across training, the
+events it sees. State is keyed by `eventID` and survives across training, the
 detection loop, and (optionally) restarts on disk.
 
 This page is structured to read top-to-bottom: first the mental model, then a
@@ -14,10 +14,10 @@ rest of the page much easier to follow.
 
 ### 1. Events
 
-Logs are grouped by `EventID`. Two events with the same ID share a template
+Logs are grouped by `eventID`. Two events with the same ID share a template
 but have their own variable values. Persistency stores **one independent state
-object per event ID**, so an `EventStabilityTracker` for `EventID=4733` does
-not interfere with one for `EventID=4624`.
+object per event ID**, so an `EventStabilityTracker` for `eventID=4733` does
+not interfere with one for `eventID=4624`.
 
 ### 2. Backends (`EventDataStructure`)
 
@@ -239,10 +239,10 @@ class MyDetector(TrackerDetector):
         super().__init__(name=name, config=config)
 
     def train(self, input_):
-        self._ingest(input_, variables={...}, event_id=input_["EventID"])
+        self._ingest(input_, variables={...}, event_id=input_["eventID"])
 
     def detect(self, input_, output_):
-        tracker = self.persistency.get_events_data().get(input_["EventID"])
+        tracker = self.persistency.get_events_data().get(input_["eventID"])
         # compare against tracker to produce alerts
 ```
 
diff --git a/docs/detectors.md b/docs/detectors.md
index f3d9e5fe..e483fcb8 100644
--- a/docs/detectors.md
+++ b/docs/detectors.md
@@ -255,7 +255,7 @@ The two neural detectors ([DeepLog](detectors/deeplog.md), [LogBERT](detectors/l
 
 ### Configuration semantics (preliminary)
 
-**`events` key**: the key is the `EventID` (or `event_id`) to monitor: an integer as the parser emits it (see the [Template Matcher](parsers/template_matcher.md) docs for how the EventID is assigned), or a name (see [Named EventIDs and variables](#named-eventids-and-variables) below).
+**`events` key**: the key is the `eventID` (or `event_id`) to monitor: an integer as the parser emits it (see the [Template Matcher](parsers/template_matcher.md) docs for how the EventID is assigned), or a name (see [Named EventIDs and variables](#named-eventids-and-variables) below).
 
 **`global` key** - This one has a similar functionality as the `events` key but refers to variables, that are not bound to events (thus can only contain `header_variables`).
 
@@ -272,7 +272,7 @@ pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=
 
 ### Named EventIDs and variables
 
-Instead of numbers, the `events` block can use names: a name for the `EventID`, and
+Instead of numbers, the `events` block can use names: a name for the `eventID`, and
 the name of a wildcard for `variables[].pos`. The names come from the
 [Template Matcher](parsers/template_matcher.md)'s template file:
 
@@ -285,10 +285,10 @@ the name of a wildcard for `variables[].pos`. The names come from the
     --8<-- "docs/examples/data/named_templates.csv"
     ```
 
-The parser still emits numbers (`EventID` 1 and position 0 for `<user>` in the second
+The parser still emits numbers (`eventID` 1 and position 0 for `<user>` in the second
 template), so the names must be translated before the detector runs. Do this once,
 after creating both components, with `compile_detector_config()`. **Without this step
-the detector monitors nothing**; it only logs a warning that the named `EventID` was
+the detector monitors nothing**; it only logs a warning that the named `eventID` was
 never observed in training.
 
 ```python
@@ -379,7 +379,7 @@ traffic looks stable, because the flood supplies enough samples to dominate the
 later segments. Enabling `time` cuts the same segments at **equal
 durations** instead, so each segment covers the same amount of wall-clock time;
 the detector then needs an event time per record, which it reads from the log's
-named variables (`logFormatVariables`, i.e. the fields declared in the parser's
+named variables (`headerVariables`, i.e. the fields declared in the parser's
 `log_format`) under the name given by `timestamp_variable`. `slope_index` and
 `slope_time` ask a different question (whether the change centroid sits early
 or late in the series), on the index axis and the time axis respectively.
@@ -448,7 +448,7 @@ All of these live in the detector's `auto_config_params` block.
 | `use_stable_vars` | `bool` | `true` | Include variables classified `STABLE` in the generated configuration. |
 | `use_static_vars` | `bool` | `true` | Include variables classified `STATIC`. Defaults to `false` on `NewValueComboDetector`. |
 | `classification` | `ClassificationMethods` | see below | Which classification methods run and how their verdicts combine. |
-| `timestamp_variable` | `str \| null` | `null` | Name of the field in `logFormatVariables` holding the record's event time. Required for `time` and `slope_time` to have any effect. Only named log-format fields are consulted, never the positional `variables` list. |
+| `timestamp_variable` | `str \| null` | `null` | Name of the field in `headerVariables` holding the record's event time. Required for `time` and `slope_time` to have any effect. Only named log-format fields are consulted, never the positional `variables` list. |
 | `timestamp_format` | `str \| null` | `null` | Explicit [`strftime`](https://docs.python.org/3/library/datetime.html#strftime-and-strptime-format-codes) pattern for parsing that field. When unset, `TimeFormatHandler` auto-detects the format (ISO 8601, Apache, syslog, numeric epoch seconds/milliseconds, and other common layouts). |
 
 Set `timestamp_format` when the source uses a layout the auto-detection does not
diff --git a/docs/detectors/rule_based.md b/docs/detectors/rule_based.md
index ace49d2e..174cbf87 100644
--- a/docs/detectors/rule_based.md
+++ b/docs/detectors/rule_based.md
@@ -19,7 +19,7 @@ Input and output schemas in the pipeline
 
 ## Description
 
-The detector analyzes parsed logs one by one and checks which rules are triggered. When alerts are produced, the triggered rules and their messages are recorded in the `alertsObtain` field of the output schema. The `score` field contains the number of rules that triggered.
+The detector analyzes parsed logs one by one and checks which rules are triggered. When alerts are produced, the triggered rules and their messages are recorded in the `alertDetails` field of the output schema. The `score` field contains the number of rules that triggered.
 
 ### Available rules
 
diff --git a/docs/development.md b/docs/development.md
index 97ba47ce..e48c1f29 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -66,10 +66,10 @@ The `configure()` method ingests all available variables (not just configured on
 ```python
 def configure(self, input_):
     self.auto_conf_persistency.ingest_event(
-        event_id=input_["EventID"],
+        event_id=input_["eventID"],
         event_template=input_["template"],
         variables=input_["variables"],
-        named_variables=input_["logFormatVariables"],
+        named_variables=input_["headerVariables"],
     )
 ```
 
diff --git a/docs/examples/alert_aggregators/basic_concat.py b/docs/examples/alert_aggregators/basic_concat.py
index ea1bc53a..88d351e9 100644
--- a/docs/examples/alert_aggregators/basic_concat.py
+++ b/docs/examples/alert_aggregators/basic_concat.py
@@ -20,13 +20,13 @@
     "detectorID": "1",
     "detectorType": "dummy",
     "alertID": "2",
-    "detectionTimestamp": 0,
+    "detectedTimestamp": 0,
     "logIDs": ["logID1"],
     "score": 0.2,
-    "extractedTimestamps": [-1],
+    "logTimestamps": [-1],
     "description": "hello there",
     "receivedTimestamp": 1,
-    "alertsObtain": {"99 problems": "but logs aint one"}
+    "alertDetails": {"99 problems": "but logs aint one"}
 })
 
 alert_aggregator = BasicConcatAggregation(
diff --git a/docs/examples/detectors/bigram_frequency.py b/docs/examples/detectors/bigram_frequency.py
index 0291faad..d6c2d183 100644
--- a/docs/examples/detectors/bigram_frequency.py
+++ b/docs/examples/detectors/bigram_frequency.py
@@ -11,7 +11,7 @@
 def failed_login(user: str) -> schemas.ParserSchema:
     """What a parser emits for 'Failed password for <user> from 10.0.0.1 port
     22'."""
-    return schemas.ParserSchema({"EventID": 1, "variables": [user, "10.0.0.1", "22"]})
+    return schemas.ParserSchema({"eventID": 1, "variables": [user, "10.0.0.1", "22"]})
 
 
 # the first 4 logs train the detector (data_use_training: 4)
@@ -20,6 +20,6 @@ def failed_login(user: str) -> schemas.ParserSchema:
 
 print(detector.process(failed_login("alia")))  # None: familiar character pairs
 alert = detector.process(failed_login("xq7zv9k"))  # random-looking user name
-print(dict(alert["alertsObtain"]))
+print(dict(alert["alertDetails"]))
 # {'EventID 1 - user': 'Bigram frequency anomaly with value xq7zv9k, critical_val 0.0 and threshold 0.05.'}
 # --8<-- [end:example]
diff --git a/docs/examples/detectors/charset.py b/docs/examples/detectors/charset.py
index 78f8abe8..e81f4982 100644
--- a/docs/examples/detectors/charset.py
+++ b/docs/examples/detectors/charset.py
@@ -11,7 +11,7 @@
 def failed_login(user: str) -> schemas.ParserSchema:
     """What a parser emits for 'Failed password for <user> from 10.0.0.1 port
     22'."""
-    return schemas.ParserSchema({"EventID": 1, "variables": [user, "10.0.0.1", "22"]})
+    return schemas.ParserSchema({"eventID": 1, "variables": [user, "10.0.0.1", "22"]})
 
 
 # the first 3 logs train the detector (data_use_training: 3)
@@ -20,6 +20,6 @@ def failed_login(user: str) -> schemas.ParserSchema:
 
 print(detector.process(failed_login("carla")))  # None: only known characters
 alert = detector.process(failed_login("bob;rm -rf"))
-print(dict(alert["alertsObtain"]))
+print(dict(alert["alertDetails"]))
 # {'EventID 1 - user': "Unknown character(s): ' ', '-', ';', 'f', 'm'"}
 # --8<-- [end:example]
diff --git a/docs/examples/detectors/combo.py b/docs/examples/detectors/combo.py
index d7f5a544..ac490bbf 100644
--- a/docs/examples/detectors/combo.py
+++ b/docs/examples/detectors/combo.py
@@ -11,7 +11,7 @@
 def login(user: str, ip: str) -> schemas.ParserSchema:
     """What a parser emits for 'Accepted password for <user> from <ip> port
     22'."""
-    return schemas.ParserSchema({"EventID": 0, "variables": [user, ip, "22"]})
+    return schemas.ParserSchema({"eventID": 0, "variables": [user, ip, "22"]})
 
 
 # the first 3 logs train the detector (data_use_training: 3)
@@ -21,6 +21,6 @@ def login(user: str, ip: str) -> schemas.ParserSchema:
 print(detector.process(login("bob", "10.0.0.2")))  # None: known user/IP pair
 # alice and 10.0.0.2 are both known, but never appeared together
 alert = detector.process(login("alice", "10.0.0.2"))
-print(dict(alert["alertsObtain"]))
+print(dict(alert["alertDetails"]))
 # {"EventID 0 - ('user', 'src_ip')": "Unknown value combination: ('alice', '10.0.0.2')"}
 # --8<-- [end:example]
diff --git a/docs/examples/detectors/deeplog.py b/docs/examples/detectors/deeplog.py
index 78d8a03e..7155b35b 100644
--- a/docs/examples/detectors/deeplog.py
+++ b/docs/examples/detectors/deeplog.py
@@ -10,7 +10,7 @@
 
 def event(event_id: int) -> schemas.ParserSchema:
     """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    return schemas.ParserSchema({"eventID": event_id})
 
 
 # a repeating workflow of 4 events; the model trains once 60 windows are collected
diff --git a/docs/examples/detectors/ecvc_detector.py b/docs/examples/detectors/ecvc_detector.py
index 09eaf186..fd5b458a 100644
--- a/docs/examples/detectors/ecvc_detector.py
+++ b/docs/examples/detectors/ecvc_detector.py
@@ -10,7 +10,7 @@
 
 def event(event_id: int) -> schemas.ParserSchema:
     """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    return schemas.ParserSchema({"eventID": event_id})
 
 
 # normal session: 0 = login accepted, 1 = session opened, 2 = session closed.
diff --git a/docs/examples/detectors/event_sequence.py b/docs/examples/detectors/event_sequence.py
index 9a9027ea..2d3a74ca 100644
--- a/docs/examples/detectors/event_sequence.py
+++ b/docs/examples/detectors/event_sequence.py
@@ -10,7 +10,7 @@
 
 def event(event_id: int) -> schemas.ParserSchema:
     """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    return schemas.ParserSchema({"eventID": event_id})
 
 
 # normal session: 0 = login accepted, 1 = session opened, 2 = session closed.
@@ -23,7 +23,7 @@ def event(event_id: int) -> schemas.ParserSchema:
 
 detector.process(event(0))
 alert = detector.process(event(2))  # session closed without being opened
-print(dict(alert["alertsObtain"]))
+print(dict(alert["alertDetails"]))
 # {'Sequence (0, 2)': 'EventID sequence of length 2 ending at logID  was not seen during training.'}
 
 print(detector.get_known_sequences())  # {(0, 1), (1, 2), (2, 0)}
diff --git a/docs/examples/detectors/logbert.py b/docs/examples/detectors/logbert.py
index b460d1c6..8fed4c03 100644
--- a/docs/examples/detectors/logbert.py
+++ b/docs/examples/detectors/logbert.py
@@ -10,7 +10,7 @@
 
 def event(event_id: int) -> schemas.ParserSchema:
     """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    return schemas.ParserSchema({"eventID": event_id})
 
 
 # a repeating workflow of 4 events; the model trains once 60 windows are collected
diff --git a/docs/examples/detectors/named_events.py b/docs/examples/detectors/named_events.py
index 1b8cbece..1aa70302 100644
--- a/docs/examples/detectors/named_events.py
+++ b/docs/examples/detectors/named_events.py
@@ -35,7 +35,7 @@
 ]
 for line in lines:
     alert = detector.process(parser.process(schemas.LogSchema({"log": line})))
-    print(dict(alert["alertsObtain"]) if alert else None)
+    print(dict(alert["alertDetails"]) if alert else None)
 # None
 # None
 # {'EventID 1 - user': "Unknown value: 'mallory'"}
diff --git a/docs/examples/detectors/new_event.py b/docs/examples/detectors/new_event.py
index 22c44bd3..67dd0dff 100644
--- a/docs/examples/detectors/new_event.py
+++ b/docs/examples/detectors/new_event.py
@@ -10,7 +10,7 @@
 
 def event(event_id: int) -> schemas.ParserSchema:
     """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    return schemas.ParserSchema({"eventID": event_id})
 
 
 # the first 3 logs train the detector (data_use_training: 3):
@@ -20,5 +20,5 @@ def event(event_id: int) -> schemas.ParserSchema:
 
 print(detector.process(event(1)))  # None: known event
 alert = detector.process(event(2))  # a template never seen during training
-print(dict(alert["alertsObtain"]))  # {'EventID 2 - {}': "Unknown event ID: '2'"}
+print(dict(alert["alertDetails"]))  # {'EventID 2 - {}': "Unknown event ID: '2'"}
 # --8<-- [end:example]
diff --git a/docs/examples/detectors/new_value.py b/docs/examples/detectors/new_value.py
index d9ecb77c..1d64461f 100644
--- a/docs/examples/detectors/new_value.py
+++ b/docs/examples/detectors/new_value.py
@@ -11,7 +11,7 @@
 def login(user: str, ip: str) -> schemas.ParserSchema:
     """What a parser emits for 'Accepted password for <user> from <ip> port
     22'."""
-    return schemas.ParserSchema({"EventID": 0, "variables": [user, ip, "22"]})
+    return schemas.ParserSchema({"eventID": 0, "variables": [user, ip, "22"]})
 
 
 # the first 3 logs train the detector (data_use_training: 3)
@@ -20,5 +20,5 @@ def login(user: str, ip: str) -> schemas.ParserSchema:
 
 print(detector.process(login("bob", "10.0.0.9")))  # None: bob is a known user
 alert = detector.process(login("mallory", "10.0.0.1"))
-print(dict(alert["alertsObtain"]))  # {'EventID 0 - user': "Unknown value: 'mallory'"}
+print(dict(alert["alertDetails"]))  # {'EventID 0 - user': "Unknown value: 'mallory'"}
 # --8<-- [end:example]
diff --git a/docs/examples/detectors/random_detector.py b/docs/examples/detectors/random_detector.py
index 90cac0b3..94d3a81e 100644
--- a/docs/examples/detectors/random_detector.py
+++ b/docs/examples/detectors/random_detector.py
@@ -8,7 +8,7 @@
     config = yaml.safe_load(f)
 detector = RandomDetector(name="RandomDetector", config=config)
 
-login = schemas.ParserSchema({"EventID": 0, "variables": ["alice", "10.0.0.1", "22"]})
+login = schemas.ParserSchema({"eventID": 0, "variables": ["alice", "10.0.0.1", "22"]})
 
 np.random.seed(0)  # only to make this example reproducible
 
diff --git a/docs/examples/detectors/rule_based.py b/docs/examples/detectors/rule_based.py
index 4740114c..3fe9339d 100644
--- a/docs/examples/detectors/rule_based.py
+++ b/docs/examples/detectors/rule_based.py
@@ -10,7 +10,7 @@
 
 def parsed(event_id: int, log: str, level: str = "INFO") -> schemas.ParserSchema:
     """A parsed log; EventID -1 means the parser found no matching template."""
-    return schemas.ParserSchema({"EventID": event_id, "log": log, "logFormatVariables": {"Level": level}})
+    return schemas.ParserSchema({"eventID": event_id, "log": log, "headerVariables": {"Level": level}})
 
 
 logs = [
@@ -21,7 +21,7 @@ def parsed(event_id: int, log: str, level: str = "INFO") -> schemas.ParserSchema
 ]
 for log in logs:
     alert = detector.process(log)
-    print(dict(alert["alertsObtain"]) if alert else None)
+    print(dict(alert["alertDetails"]) if alert else None)
 # None
 # {'R001 - TemplateNotFound': 'No template found by parser'}
 # {'R002 - SpecificKeyword': "Found word 'sudo' in the logs"}
diff --git a/docs/examples/detectors/scvs_detector.py b/docs/examples/detectors/scvs_detector.py
index cddacbeb..4fbda79e 100644
--- a/docs/examples/detectors/scvs_detector.py
+++ b/docs/examples/detectors/scvs_detector.py
@@ -10,7 +10,7 @@
 
 def event(event_id: int) -> schemas.ParserSchema:
     """A parsed log; only its EventID (the matched template) matters here."""
-    return schemas.ParserSchema({"EventID": event_id})
+    return schemas.ParserSchema({"eventID": event_id})
 
 
 # normal session: 0 = login accepted, 1 = session opened, 2 = session closed.
diff --git a/docs/examples/detectors/value_range.py b/docs/examples/detectors/value_range.py
index 38f70b9b..0bfb3c80 100644
--- a/docs/examples/detectors/value_range.py
+++ b/docs/examples/detectors/value_range.py
@@ -11,7 +11,7 @@
 def download(path: str, bytes_read: int) -> schemas.ParserSchema:
     """What a parser emits for 'close <path> bytes read <bytes_read> written
     0'."""
-    return schemas.ParserSchema({"EventID": 2, "variables": [path, str(bytes_read), "0"]})
+    return schemas.ParserSchema({"eventID": 2, "variables": [path, str(bytes_read), "0"]})
 
 
 # the first 3 logs train the detector (data_use_training: 3)
@@ -20,5 +20,5 @@ def download(path: str, bytes_read: int) -> schemas.ParserSchema:
 
 print(detector.process(download("/srv/d.pdf", 200)))  # None: inside the learned range
 alert = detector.process(download("/srv/db.dump", 99999))
-print(dict(alert["alertsObtain"]))  # {'EventID 2 - bytes_read': "Out of range value: '99999' (100 - 250)"}
+print(dict(alert["alertDetails"]))  # {'EventID 2 - bytes_read': "Out of range value: '99999' (100 - 250)"}
 # --8<-- [end:example]
diff --git a/docs/examples/others/tutorial.py b/docs/examples/others/tutorial.py
index 5a763838..594ec95a 100644
--- a/docs/examples/others/tutorial.py
+++ b/docs/examples/others/tutorial.py
@@ -35,7 +35,7 @@
 
 parsed_logs = [parser.process(raw) for raw in raw_logs]
 for plog in parsed_logs:
-    print(plog["EventID"], plog["template"])
+    print(plog["eventID"], plog["template"])
 # --8<-- [end:own_parser]
 
 # --8<-- [start:detectors]
@@ -89,7 +89,7 @@
     nv_alert = new_value_detector.process(plog)
     es_alert = event_sequence_detector.process(plog)
     print(
-        f"{i:>2}  {plog['EventID']:>7}  {str(bool(nv_alert)):>8}  {str(bool(es_alert)):>13}"
+        f"{i:>2}  {plog['eventID']:>7}  {str(bool(nv_alert)):>8}  {str(bool(es_alert)):>13}"
     )
     if nv_alert:
         alerts.append(nv_alert)
diff --git a/docs/examples/parsers/json_parser.py b/docs/examples/parsers/json_parser.py
index c0fa2b80..a41fee88 100644
--- a/docs/examples/parsers/json_parser.py
+++ b/docs/examples/parsers/json_parser.py
@@ -12,8 +12,8 @@
 output = schemas.ParserSchema()
 parser.parse(schemas.LogSchema({"logID": "1", "log": json.dumps(json_log)}), output)
 
-print(output.logFormatVariables["request.method"])  # GET
-print(output.logFormatVariables["request.path"])    # /api/users
+print(output.headerVariables["request.method"])  # GET
+print(output.headerVariables["request.path"])    # /api/users
 # --8<-- [end:basic]
 
 # --8<-- [start:dict-based]
@@ -31,6 +31,6 @@
 output = schemas.ParserSchema()
 parser.parse(schemas.LogSchema({"logID": "1", "log": json.dumps(json_log)}), output)
 
-print(output.logFormatVariables["level"])  # INFO
+print(output.headerVariables["level"])  # INFO
 print(output.template)                     # pid=<*> uid=<*> auid=<*> ses=<*> msg='op=PAM:<*> acct=<*>
 # --8<-- [end:dict-based]
diff --git a/docs/examples/parsers/template_matcher.py b/docs/examples/parsers/template_matcher.py
index f7ba6416..fbef52f9 100644
--- a/docs/examples/parsers/template_matcher.py
+++ b/docs/examples/parsers/template_matcher.py
@@ -11,7 +11,7 @@
     "logID": "0",
     "log": "pid=9699 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\"'",
 }))
-print(parsed.EventID)    # 0: the first template in the file
+print(parsed.eventID)    # 0: the first template in the file
 print(parsed.template)   # pid=<*> uid=<*> auid=<*> ses=<*> msg='op=PAM:<*> acct=<*>
 print(parsed.variables)  # ('9699', '0', '4294967295', '4294967295', 'accounting', '"root"\'')
 # --8<-- [end:example]
diff --git a/docs/examples/parsers/template_tree_matcher.py b/docs/examples/parsers/template_tree_matcher.py
index 5007cf15..e835fc75 100644
--- a/docs/examples/parsers/template_tree_matcher.py
+++ b/docs/examples/parsers/template_tree_matcher.py
@@ -11,7 +11,7 @@
     "logID": "0",
     "log": "pid=9699 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\"'",
 }))
-print(parsed.EventID)    # 0: the first template in the file
+print(parsed.eventID)    # 0: the first template in the file
 print(parsed.template)   # pid <*> uid <*> auid <*> ses <*> msg op PAM <*> acct <*>
 print(parsed.variables)  # ['9699', '0', '4294967295', '4294967295', 'accounting', 'root']
 # --8<-- [end:example]
diff --git a/docs/helper/from_to.md b/docs/helper/from_to.md
index 92f8a6e2..c5bb1c67 100644
--- a/docs/helper/from_to.md
+++ b/docs/helper/from_to.md
@@ -103,14 +103,14 @@ Example JSON save file format:
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "__version__": "1.0.0"
+        "schemaVersion": "2.0.0"
     },
     "1": {
         "logID": "1",
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='unit=<*> comm=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "__version__": "1.0.0"
+        "schemaVersion": "2.0.0"
     }
 }
 ```
@@ -236,14 +236,14 @@ Example input data:
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "__version__": "1.0.0"
+        "schemaVersion": "2.0.0"
     },
     "1": {
         "logID": "1",
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='unit=<*> comm=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "__version__": "1.0.0"
+        "schemaVersion": "2.0.0"
     }
 }
 ```
@@ -255,8 +255,8 @@ Example output data after parsing:
     "0": {
         "template": "This is a dummy template",
         "parsedTimestamp": 1771336089,
-        "EventID": 2,
-        "logFormatVariables": {
+        "eventID": 2,
+        "headerVariables": {
             "Time": "0"
         },
         "parserID": "DummyParser",
@@ -267,14 +267,14 @@ Example output data after parsing:
         ],
         "receivedTimestamp": 1771336089,
         "logID": "0",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "parsedLogID": "10"
     },
     "1": {
         "template": "This is a dummy template",
         "parsedTimestamp": 1771336089,
-        "EventID": 2,
-        "logFormatVariables": {
+        "eventID": 2,
+        "headerVariables": {
             "Time": "0"
         },
         "parserID": "DummyParser",
@@ -285,7 +285,7 @@ Example output data after parsing:
         ],
         "receivedTimestamp": 1771336089,
         "logID": "1",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "parsedLogID": "11"
     }
 }
diff --git a/docs/other/log_formats.md b/docs/other/log_formats.md
index 8cf611a8..3c2f605a 100644
--- a/docs/other/log_formats.md
+++ b/docs/other/log_formats.md
@@ -2,7 +2,7 @@
 
 This catalog covers 18 common log formats and provides ready-to-use `log_format` patterns for the DetectMate parsers, such as the [MatcherParser](../parsers/template_matcher.md).
 
-**Key concept:** `log_format` splits a raw log line into structured header fields that become entries in `ParserSchema.logFormatVariables`. The special `<Content>` token captures the variable message body, which is then matched against your template file to produce `EventID` and `variables`. Formats without `<Content>` are fully structured, so no template file is needed.
+**Key concept:** `log_format` splits a raw log line into structured header fields that become entries in `ParserSchema.headerVariables`. The special `<Content>` token captures the variable message body, which is then matched against your template file to produce `eventID` and `variables`. Formats without `<Content>` are fully structured, so no template file is needed.
 
 **Generic configuration:**
 
@@ -85,7 +85,7 @@ Apache httpd access log (Combined Log Format). Each line is fully structured, so
 
 **`log_format`:** `<IP> - - [<Time>] "<RequestType> <Request> <Version>" <Status> <ResponseSize> "<Referer>" "<UserAgent>"`
 
-> All fields land directly in `logFormatVariables`. Use `header_variables` in your detector config to track e.g. `Status`, `IP`, or `RequestType`.
+> All fields land directly in `headerVariables`. Use `header_variables` in your detector config to track e.g. `Status`, `IP`, or `RequestType`.
 
 ---
 
diff --git a/docs/parsers.md b/docs/parsers.md
index f7661259..f6cb3eb4 100644
--- a/docs/parsers.md
+++ b/docs/parsers.md
@@ -41,7 +41,7 @@ class CoreParser:
 
 `parse()` only has to fill the fields that describe the match:
 
-- `EventID` (int): identifier for the matched template/event
+- `eventID` (int): identifier for the matched template/event
 - `template` (string): event template text
 - `variables` (repeated string): extracted parameters (extend the list)
 
@@ -50,7 +50,7 @@ class CoreParser:
 - `parserID`, `parserType`: the parser's name and `method_type`
 - `parsedLogID`: a new unique ID for the parsed record
 - `logID`, `log`: copied from the input `LogSchema`
-- `logFormatVariables`: the header fields extracted with `log_format`
+- `headerVariables`: the header fields extracted with `log_format`
 - `receivedTimestamp`, `parsedTimestamp`: set just before and just after
   `parse()` runs
 
@@ -94,7 +94,7 @@ class MyParser(CoreParser):
         text = input_.log or ""
         # simple example: split on whitespace and treat as variables
         tokens = text.split()
-        output_["EventID"] = 1
+        output_["eventID"] = 1
         output_["template"] = " ".join(["<*>"] * len(tokens))
         output_["variables"].extend(tokens)
         return True
@@ -114,7 +114,7 @@ def test_my_parser_parse():
     out = schemas.ParserSchema()
     ok = parser.parse(raw, out)
     assert ok is True
-    assert out["EventID"] == 1
+    assert out["eventID"] == 1
     assert out["variables"] == ["a", "b", "c"]
 ```
 
diff --git a/docs/parsers/json_parser.md b/docs/parsers/json_parser.md
index 8b6ece4c..7f3b1ccc 100644
--- a/docs/parsers/json_parser.md
+++ b/docs/parsers/json_parser.md
@@ -1,6 +1,6 @@
 # JSON Parser
 
-Extracts structured information from JSON-formatted logs. Optionally delegates parsing of a specific JSON field (the "content") to a sibling Template Matcher parser. Nested JSON objects are always flattened to dot-separated keys in `logFormatVariables`.
+Extracts structured information from JSON-formatted logs. Optionally delegates parsing of a specific JSON field (the "content") to a sibling Template Matcher parser. Nested JSON objects are always flattened to dot-separated keys in `headerVariables`.
 
 ## In/out
 
diff --git a/docs/parsers/template_matcher.md b/docs/parsers/template_matcher.md
index 1564012b..6755659d 100644
--- a/docs/parsers/template_matcher.md
+++ b/docs/parsers/template_matcher.md
@@ -17,14 +17,14 @@ The template matcher is a lightweight, fast parser intended for logs that follow
 
 - Preprocesses logs and templates (remove spaces, punctuation, lowercase) based on config.
 - Finds the first template that matches and extracts all wildcard parameters in order.
-- Populates ParserSchema fields: `EventID`, `template`, `variables`,  `logID`, and related fields.
-- **`EventID` is the 0-indexed line number of the matched template** in the template file (first line → `EventID: 0`, second line → `EventID: 1`, etc.).
+- Populates ParserSchema fields: `eventID`, `template`, `variables`,  `logID`, and related fields.
+- **`eventID` is the 0-indexed line number of the matched template** in the template file (first line → `eventID: 0`, second line → `eventID: 1`, etc.).
 
 This parser is deterministic and designed for high-throughput use when templates are known in advance.
 
 ## EventID assignment (preliminary)
 
-The `EventID` (or `event_id`) field in the output `ParserSchema` identifies which template was matched. It equals the **0-indexed line number** of the matching template in the template file, for example:
+The `eventID` (or `event_id`) field in the output `ParserSchema` identifies which template was matched. It equals the **0-indexed line number** of the matching template in the template file, for example:
 
 | Line in template file | EventID |
 |-----------------------|---------|
@@ -33,7 +33,7 @@ The `EventID` (or `event_id`) field in the output `ParserSchema` identifies whic
 | 3rd line              | 2       |
 | ...                   | ...     |
 
-The `EventID` is the integer key used in detector configurations (e.g., `NewValueDetector`) to scope detection rules to logs of a particular template type.
+The `eventID` is the integer key used in detector configurations (e.g., `NewValueDetector`) to scope detection rules to logs of a particular template type.
 
 ## Template format
 
diff --git a/docs/schemas.md b/docs/schemas.md
index ad0d5e90..0b4c0871 100644
--- a/docs/schemas.md
+++ b/docs/schemas.md
@@ -93,13 +93,13 @@ Fields:
 |---|---|---|
 | parserType | string | Parser type. |
 | parserID | string | Parser instance identifier. |
-| EventID | int32 | Template/event identifier. |
+| eventID | int32 | Template/event identifier. |
 | template | string | Event template text. |
 | variables | repeated string | Parameters extracted from the template. |
 | parsedLogID | string | ID assigned after parsing (optional). |
 | logID | string | Original raw log ID (link to LogSchema). |
 | log | string | Raw log text. |
-| logFormatVariables | map<string,string> | Key/value pairs from format extraction. |
+| headerVariables | map<string,string> | Key/value pairs from format extraction. |
 | receivedTimestamp | int64 | Timestamp when log was received. |
 | parsedTimestamp | int64 | Timestamp when parsing completed. |
 
@@ -113,13 +113,13 @@ Fields:
 | detectorID | string | Detector instance identifier. |
 | detectorType | string | Type/name of detector. |
 | alertID | string | Unique alert identifier. |
-| detectionTimestamp | int64 | When the alert was produced. |
+| detectedTimestamp | int64 | When the alert was produced. |
 | logIDs | repeated string | IDs of logs related to the alert. |
 | score | float | Confidence/score (if applicable). |
-| extractedTimestamps | repeated int64 | Timestamps extracted from logs. |
+| logTimestamps | repeated int64 | Timestamps extracted from logs. |
 | description | string | Human-readable description of the alert. |
 | receivedTimestamp | int64 | When inputs were received by detector. |
-| alertsObtain | map<string,string> | Additional alert metadata. |
+| alertDetails | map<string,string> | Additional alert metadata. |
 
 ### AggregateSchema
 Output from Alert Aggregations (alerts / findings).
@@ -131,11 +131,11 @@ Fields:
 | detectorIDs | repeated string | List of detector instance identifier. |
 | detectorTypes | repeated string | List of type/name of detectors. |
 | alertIDs | repeated string | List of unique alert identifiers. |
-| outputTimestamp | int64 | When the aggregation was produced. |
+| aggregatedTimestamp | int64 | When the aggregation was produced. |
 | logIDs | repeated string | IDs of logs related to the alerts. |
-| extractedTimestamps | repeated int64 | Timestamps extracted from logs. |
+| logTimestamps | repeated int64 | Timestamps extracted from logs. |
 | description | string | Human-readable description of the alert aggregation. |
-| alertsObtain | map<string,string> | Additional alert metadata from the alert aggregation. |
+| alertDetails | map<string,string> | Additional alert metadata from the alert aggregation. |
 
 ## Examples
 
diff --git a/docs/user_guide/basic_knowledge.md b/docs/user_guide/basic_knowledge.md
index f1630aa0..33fb60f5 100644
--- a/docs/user_guide/basic_knowledge.md
+++ b/docs/user_guide/basic_knowledge.md
@@ -94,10 +94,10 @@ A parsed log would contain fields like:
 
 | Field                | Value                                                  |
 |----------------------|--------------------------------------------------------|
-| `EventID`            | `0`                                                    |
+| `eventID`            | `0`                                                    |
 | `template`           | `hello I am a log about <*> and about <*>`              |
 | `variables`          | `["DetectMate getting started", "what is a log"]`      |
-| `logFormatVariables` | `{"Level": "INFO", "Time": "18-05-2005", "Content": "hello I am a log about DetectMate getting started and about what is a log"}` |
+| `headerVariables` | `{"Level": "INFO", "Time": "18-05-2005", "Content": "hello I am a log about DetectMate getting started and about what is a log"}` |
 
 Parsed logs expose structured data that downstream detection components use for
 anomaly detection.
@@ -105,24 +105,24 @@ anomaly detection.
 ### What is an EventID?
 
 Every distinct template is a different *kind* of event, and the parser gives
-each one a number: the **`EventID`**. All lines that match the same template get
-the same `EventID`, so `User alice logged in from 192.168.0.5` and
-`User bob logged in from 10.0.0.2` share one `EventID`, while a
+each one a number: the **`eventID`**. All lines that match the same template get
+the same `eventID`, so `User alice logged in from 192.168.0.5` and
+`User bob logged in from 10.0.0.2` share one `eventID`, while a
 `User bob logged out` line would get another.
 
 How the number is chosen depends on the parser. With the
 [Template Matcher](../parsers/template_matcher.md), it is the position of the
 matching template in your template file, counting from `0`: the first template is
-`EventID 0`, the second `EventID 1`, and so on. In the table above the template
-file contains just one template, so the line gets `EventID 0`. A line that
-matches no template gets `EventID -1` and the template `<Not Found>`.
+`eventID 0`, the second `eventID 1`, and so on. In the table above the template
+file contains just one template, so the line gets `eventID 0`. A line that
+matches no template gets `eventID -1` and the template `<Not Found>`.
 
-The `EventID` is what detectors build on:
+The `eventID` is what detectors build on:
 
-- Detectors that watch variable values are configured per `EventID`: their
+- Detectors that watch variable values are configured per `eventID`: their
   `events` block says which variables to monitor for which kind of event (see
   [Detectors](../detectors.md#configuration)).
-- Some detectors look at nothing but the `EventID`, for example the
-  [New Event Detector](../detectors/new_event.md) (an `EventID` never seen
+- Some detectors look at nothing but the `eventID`, for example the
+  [New Event Detector](../detectors/new_event.md) (an `eventID` never seen
   before) and the [Event Sequence Detector](../detectors/event_sequence.md) (an
-  unusual order of `EventID`s).
+  unusual order of `eventID`s).
diff --git a/docs/user_guide/tutorial.md b/docs/user_guide/tutorial.md
index 9fdc0113..3c4caded 100644
--- a/docs/user_guide/tutorial.md
+++ b/docs/user_guide/tutorial.md
@@ -69,7 +69,7 @@ one.
 
 **Splitting off the prefix.** The `log_format` string tells the parser how to
 carve off the `type=`/`msg=audit(...)` prefix into
-`logFormatVariables` and hand the parser only the `<Content>` part to match
+`headerVariables` and hand the parser only the `<Content>` part to match
 against templates:
 
 ```text
@@ -93,7 +93,7 @@ proctitle=<*>
 
 A few things worth noticing while writing templates like these:
 
-- The line number is the `EventID`: line 1 (0-indexed: `0`) matches
+- The line number is the `eventID`: line 1 (0-indexed: `0`) matches
   `DAEMON_START`, line 2 (`1`) matches `CONFIG_CHANGE`, and so on, exactly as
   described in [EventID assignment](../parsers/template_matcher.md#eventid-assignment-preliminary).
 - The second template's `op=set <*> old=<*> ...` has only one wildcard where
@@ -124,7 +124,7 @@ A few things worth noticing while writing templates like these:
 > log falls back to `<Not Found>`. Write `log_format` as plain text; only the
 > `<Placeholder>` tokens are special.
 
-Running this prints, for each of the 9 logs, the `EventID` and the matched
+Running this prints, for each of the 9 logs, the `eventID` and the matched
 template. All four templates get used, and every line matches (nothing
 comes back as `<Not Found>`).
 
@@ -137,7 +137,7 @@ stream:
 - [**NewValueDetector**](../detectors/new_value.md) watches the *content* of
   specific fields and alerts when a value it hasn't been trained on shows up.
 - [**EventSequenceDetector**](../detectors/event_sequence.md) ignores field
-  content entirely and instead watches the *order* of `EventID`s, alerting
+  content entirely and instead watches the *order* of `eventID`s, alerting
   when a sequence of consecutive events wasn't part of what it was trained
   on.
 
@@ -150,8 +150,8 @@ Both detectors are configured with `data_use_training: 3`: the first 3 logs
 runs on the remaining 6; see [Configuration](../detectors.md#configuration)
 for how `data_use_training` and `events` interact. `NewValueDetector` is
 pointed at the two fields we identified while writing the templates in step
-2: the `key=value` pair inside `CONFIG_CHANGE` (`EventID: 1`, `pos: 0`) and
-the process name inside `SYSCALL` (`EventID: 2`, `pos: 22`, the `comm=` slot
+2: the `key=value` pair inside `CONFIG_CHANGE` (`eventID: 1`, `pos: 0`) and
+the process name inside `SYSCALL` (`eventID: 2`, `pos: 22`, the `comm=` slot
 counting `<*>` positions left to right in the third template line).
 
 Running the loop prints one row per log line:
@@ -243,14 +243,14 @@ Two details are easy to miss here, and both matter for production configs:
   `log_format` string breaks matching:
   `generate_logformat_regex()` already escapes literal text for you.
 * Detectors configured with an `events` block (such as `NewValueDetector`) only
-  check `EventID`s they have seen in training. If you configure an `EventID` that
+  check `eventID`s they have seen in training. If you configure an `eventID` that
   never appears in the training window (`data_use_training`), the detector stays
   silent for that event type: it does not alert on everything, and it does not
   raise an error. It does log a warning when training ends, for example
   `[NewValueDetector] EventID 5 is configured but was never observed in training data`,
   so check the log after training. This does not apply to every detector: the
   [New Event Detector](../detectors/new_event.md) exists to alert on exactly
-  those never-seen `EventID`s.
+  those never-seen `eventID`s.
 * Calling `.process()` on a detector or aggregator returns `None` when
   nothing fires, and the actual output schema (truthy) when it does, so check
   with `if result:` rather than assuming a boolean.
diff --git a/src/detectmatelibrary/_testutils/dummy_detector.py b/src/detectmatelibrary/_testutils/dummy_detector.py
index b4277883..062602a9 100644
--- a/src/detectmatelibrary/_testutils/dummy_detector.py
+++ b/src/detectmatelibrary/_testutils/dummy_detector.py
@@ -36,5 +36,5 @@ def detect(
         result = pattern[self._call_count % len(pattern)]
         if result:
             output_["score"] = 1.0
-            output_["alertsObtain"]["type"] = "Anomaly detected by DummyDetector"
+            output_["alertDetails"]["type"] = "Anomaly detected by DummyDetector"
         return result
diff --git a/src/detectmatelibrary/_testutils/dummy_parser.py b/src/detectmatelibrary/_testutils/dummy_parser.py
index 62285b77..a8fcdbdc 100644
--- a/src/detectmatelibrary/_testutils/dummy_parser.py
+++ b/src/detectmatelibrary/_testutils/dummy_parser.py
@@ -28,6 +28,6 @@ def parse(
         output_: schemas.ParserSchema
     ) -> None:
 
-        output_["EventID"] = 2
+        output_["eventID"] = 2
         output_["variables"].extend(["dummy_variable"])
         output_["template"] = "This is a dummy template"
diff --git a/src/detectmatelibrary/base_detectors/_stability.py b/src/detectmatelibrary/base_detectors/_stability.py
index bb1d4b1e..327bcff0 100644
--- a/src/detectmatelibrary/base_detectors/_stability.py
+++ b/src/detectmatelibrary/base_detectors/_stability.py
@@ -51,7 +51,7 @@ def read(self, input_: ParserSchema) -> float | None:
             )
             return None
 
-        raw = input_["logFormatVariables"].get(self._params.timestamp_variable)
+        raw = input_["headerVariables"].get(self._params.timestamp_variable)
         ts = self._handler.parse_timestamp(str(raw or ""), self._params.timestamp_format)
         if ts == "0":
             self._warn_once(
diff --git a/src/detectmatelibrary/base_detectors/deeplearning_detector.py b/src/detectmatelibrary/base_detectors/deeplearning_detector.py
index 14229b87..f00beeee 100644
--- a/src/detectmatelibrary/base_detectors/deeplearning_detector.py
+++ b/src/detectmatelibrary/base_detectors/deeplearning_detector.py
@@ -43,7 +43,7 @@ class DeepLearningDetectorConfig(CoreDetectorConfig):
 
 
 def build_seq(input_: list[schemas.ParserSchema]) -> tuple[int]:
-    return tuple([in_["EventID"] for in_ in input_])
+    return tuple([in_["eventID"] for in_ in input_])
 
 
 class DeepLearningDetector(CoreDetector):
diff --git a/src/detectmatelibrary/base_detectors/variable_detector.py b/src/detectmatelibrary/base_detectors/variable_detector.py
index 02dea5ec..33c63d38 100644
--- a/src/detectmatelibrary/base_detectors/variable_detector.py
+++ b/src/detectmatelibrary/base_detectors/variable_detector.py
@@ -154,7 +154,7 @@ def _event_variables(self, input_: ParserSchema) -> List[Dict[str, Any]]:
 
     def train(self, input_: ParserSchema) -> None:  # type: ignore
         for variables in self._event_variables(input_):
-            self._ingest(input_, self._prepare_variables(variables, "training"), input_["EventID"])
+            self._ingest(input_, self._prepare_variables(variables, "training"), input_["eventID"])
         if self.config.global_instances:
             global_vars = get_global_variables(input_, self.config.global_instances)
             if global_vars:
@@ -164,7 +164,7 @@ def detect(self, input_: ParserSchema, output_: DetectorSchema) -> bool:  # type
         alerts: Dict[str, str] = {}
         overall_score = 0.0
         known_events = self.persistency.get_events_data()
-        current_event_id = input_["EventID"]
+        current_event_id = input_["eventID"]
 
         if current_event_id in known_events:
             variables: Dict[str, Any] = {}
@@ -186,16 +186,16 @@ def detect(self, input_: ParserSchema, output_: DetectorSchema) -> bool:  # type
         if overall_score > 0:
             output_["score"] = overall_score
             output_["description"] = self._description()
-            output_["alertsObtain"].update(alerts)
+            output_["alertDetails"].update(alerts)
             return True
         return False
 
     def configure(self, input_: ParserSchema) -> None:  # type: ignore
         self.auto_conf_persistency.ingest_event(
-            event_id=input_["EventID"],
+            event_id=input_["eventID"],
             event_template=input_["template"],
             variables=input_["variables"],
-            named_variables=input_["logFormatVariables"],
+            named_variables=input_["headerVariables"],
             timestamp=self._timestamps.read(input_),
         )
 
diff --git a/src/detectmatelibrary/common/_config/_compile.py b/src/detectmatelibrary/common/_config/_compile.py
index 6f8ea05e..fee27e1f 100644
--- a/src/detectmatelibrary/common/_config/_compile.py
+++ b/src/detectmatelibrary/common/_config/_compile.py
@@ -256,13 +256,13 @@ def get_configured_variables(
     """Extract variables from input based on what's defined in the config.
 
     Args:
-        input_: Parser schema containing variables and logFormatVariables
+        input_: Parser schema containing variables and headerVariables
         log_variables: Config specifying which variables to extract per EventID
 
     Returns:
         Dict mapping variable names to their values from the input
     """
-    event_id = input_["EventID"]
+    event_id = input_["eventID"]
     result: Dict[str, Any] = {}
 
     # Get the config for this event
@@ -279,8 +279,8 @@ def get_configured_variables(
     # Extract header/log format variables by name
     if hasattr(event_config, "header_variables"):
         for name in event_config.header_variables:
-            if name in input_["logFormatVariables"]:
-                result[name] = input_["logFormatVariables"][name]
+            if name in input_["headerVariables"]:
+                result[name] = input_["headerVariables"][name]
 
     return result
 
@@ -296,13 +296,13 @@ def get_instance_variables(
     variables.
 
     Args:
-        input_: Parser schema containing variables and logFormatVariables
+        input_: Parser schema containing variables and headerVariables
         log_variables: Config specifying which variables to extract per EventID
 
     Returns:
         Dict mapping instance name to that instance's variable names and values
     """
-    event_id = input_["EventID"]
+    event_id = input_["eventID"]
     event_config = log_variables[event_id] if event_id in log_variables else None
     result: Dict[str, Dict[str, Any]] = {}
 
@@ -315,8 +315,8 @@ def get_instance_variables(
             else:
                 complete = False
         for name in instance.header_variables:
-            if name in input_["logFormatVariables"]:
-                values[name] = input_["logFormatVariables"][name]
+            if name in input_["headerVariables"]:
+                values[name] = input_["headerVariables"][name]
             else:
                 complete = False
         if complete and values:
@@ -332,7 +332,7 @@ def get_global_variables(
     """Extract header variables from event-ID-independent instances.
 
     Args:
-        input_: Parser schema containing logFormatVariables
+        input_: Parser schema containing headerVariables
         global_instances: Dict of instance_name -> _EventInstance configs
 
     Returns:
@@ -341,6 +341,6 @@ def get_global_variables(
     result: Dict[str, Any] = {}
     for instance in global_instances.values():
         for name in instance.header_variables:
-            if name in input_["logFormatVariables"]:
-                result[name] = input_["logFormatVariables"][name]
+            if name in input_["headerVariables"]:
+                result[name] = input_["headerVariables"][name]
     return result
diff --git a/src/detectmatelibrary/common/alert_aggregator.py b/src/detectmatelibrary/common/alert_aggregator.py
index 44d84fda..28045ead 100644
--- a/src/detectmatelibrary/common/alert_aggregator.py
+++ b/src/detectmatelibrary/common/alert_aggregator.py
@@ -64,10 +64,10 @@ def run(
         output_["detectorTypes"] = _extract_field(input_, "detectorType")
         output_["alertIDs"] = _extract_field(input_, "alertID")
         output_["logIDs"] = _extract_list_field(input_, "logIDs")
-        output_["extractedTimestamps"] = _extract_list_field(input_, "extractedTimestamps")
+        output_["logTimestamps"] = _extract_list_field(input_, "logTimestamps")
 
         if (alert := self.aggregate_alerts(input_=input_, output_=output_)):
-            output_["outputTimestamp"] = get_timestamp()
+            output_["aggregatedTimestamp"] = get_timestamp()
 
         return alert
 
diff --git a/src/detectmatelibrary/common/detector.py b/src/detectmatelibrary/common/detector.py
index fca3be7e..ac956f99 100644
--- a/src/detectmatelibrary/common/detector.py
+++ b/src/detectmatelibrary/common/detector.py
@@ -20,7 +20,7 @@ def _extract_timestamp(input_: List[ParserSchema] | ParserSchema) -> List[int]:
     if not isinstance(input_, list):
         input_ = [input_]
     return [
-        int(_time_handler.parse_timestamp(i["logFormatVariables"]["Time"]))
+        int(_time_handler.parse_timestamp(i["headerVariables"]["Time"]))
         for i in input_
     ]
 
@@ -84,12 +84,12 @@ def run(
         output_["detectorID"] = self.name
         output_["detectorType"] = self.config.method_type
         output_["logIDs"] = _extract_logIDs(input_)
-        output_["extractedTimestamps"] = _extract_timestamp(input_)
+        output_["logTimestamps"] = _extract_timestamp(input_)
         output_["receivedTimestamp"] = get_timestamp()
 
         if anomaly_detected := self.detect(input_=input_, output_=output_):
             output_["alertID"] = str(self.id_generator())
-            output_["detectionTimestamp"] = get_timestamp()
+            output_["detectedTimestamp"] = get_timestamp()
 
         return anomaly_detected
 
diff --git a/src/detectmatelibrary/common/parser.py b/src/detectmatelibrary/common/parser.py
index 92f87864..adae332e 100644
--- a/src/detectmatelibrary/common/parser.py
+++ b/src/detectmatelibrary/common/parser.py
@@ -73,7 +73,7 @@ def run(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> bool:
         output_["parserType"] = self.config.method_type
         output_["logID"] = input_["logID"]
         output_["log"] = input_["log"]
-        output_["logFormatVariables"].update(var)
+        output_["headerVariables"].update(var)
         input_["log"] = content
 
         output_["receivedTimestamp"] = get_timestamp()
diff --git a/src/detectmatelibrary/detectors/bigram_frequency_detector.py b/src/detectmatelibrary/detectors/bigram_frequency_detector.py
index 11ca5b03..4ee0ccaf 100644
--- a/src/detectmatelibrary/detectors/bigram_frequency_detector.py
+++ b/src/detectmatelibrary/detectors/bigram_frequency_detector.py
@@ -126,7 +126,7 @@ def _description(self) -> str:
     def train(self, input_: ParserSchema) -> None:  # type: ignore
         """Train the detector by updating per-variable bigram frequencies."""
         configured_variables = get_configured_variables(input_, self.config.events)
-        current_event_id = input_["EventID"]
+        current_event_id = input_["eventID"]
         known_events = self.persistency.get_events_data()
 
         pre_unique = self._snapshot_unique_sets(
diff --git a/src/detectmatelibrary/detectors/ecvc_detector.py b/src/detectmatelibrary/detectors/ecvc_detector.py
index 3aad5dfd..5e01ed23 100644
--- a/src/detectmatelibrary/detectors/ecvc_detector.py
+++ b/src/detectmatelibrary/detectors/ecvc_detector.py
@@ -23,7 +23,7 @@ class ECVCOp:
 
     @staticmethod
     def build_one_vec(input_: List[schemas.ParserSchema], n: int) -> np.ndarray:
-        events = [in_["EventID"] for in_ in input_]
+        events = [in_["eventID"] for in_ in input_]
         arr = np.zeros(n if n > (m := max(events) + 1) else m)
 
         for e in events:
diff --git a/src/detectmatelibrary/detectors/event_sequence_detector.py b/src/detectmatelibrary/detectors/event_sequence_detector.py
index 62c165c1..fde8f390 100644
--- a/src/detectmatelibrary/detectors/event_sequence_detector.py
+++ b/src/detectmatelibrary/detectors/event_sequence_detector.py
@@ -136,7 +136,7 @@ def train(self, input_: ParserSchema) -> None:  # type: ignore
         """
         if (length := self.config.fixed_window_size) is None:
             return
-        self._train_window.append(input_["EventID"])
+        self._train_window.append(input_["eventID"])
         if len(self._train_window) < length:
             return
         self.persistency.ingest_event(
@@ -153,7 +153,7 @@ def detect(self, input_: ParserSchema, output_: DetectorSchema) -> bool:  # type
         """
         if (length := self.config.fixed_window_size) is None:
             return False
-        self._detect_window.append(input_["EventID"])
+        self._detect_window.append(input_["eventID"])
         if len(self._detect_window) < length:
             return False
 
@@ -165,7 +165,7 @@ def detect(self, input_: ParserSchema, output_: DetectorSchema) -> bool:  # type
         output_["description"] = (
             f"{self.name} detects unknown EventID sequences as anomalies."
         )
-        output_["alertsObtain"].update(
+        output_["alertDetails"].update(
             {
                 f"Sequence {sequence}": (
                     f"EventID sequence of length {len(sequence)} ending at logID "
@@ -186,7 +186,7 @@ def configure(self, input_: ParserSchema) -> None:  # type: ignore
         auto = self.config.auto_config_params
         for length in range(auto.min_window_size, auto.max_window_size + 1):
             window = self._configure_windows.setdefault(length, deque(maxlen=length))
-            window.append(input_["EventID"])
+            window.append(input_["eventID"])
             if len(window) == length:
                 self.auto_conf_persistency.ingest_event(
                     event_id=length,
diff --git a/src/detectmatelibrary/detectors/new_event_detector.py b/src/detectmatelibrary/detectors/new_event_detector.py
index 75e831a6..85ee74d1 100644
--- a/src/detectmatelibrary/detectors/new_event_detector.py
+++ b/src/detectmatelibrary/detectors/new_event_detector.py
@@ -35,7 +35,7 @@ def __init__(
 
     def train(self, input_: ParserSchema) -> None:  # type: ignore
         """Train the detector by learning values from the input data."""
-        self._ingest(event_id=input_["EventID"], input_=input_, variables={})
+        self._ingest(event_id=input_["eventID"], input_=input_, variables={})
         if self.config.global_instances:
             global_vars = get_global_variables(input_, self.config.global_instances)
             if global_vars:
@@ -48,7 +48,7 @@ def detect(
         alerts: dict[str, str] = {}
         overall_score = 0.0
 
-        current_event_id = input_["EventID"]
+        current_event_id = input_["eventID"]
         known_events = self.persistency.get_events_seen()
 
         if self.config.global_instances and GLOBAL_EVENT_ID in known_events:
@@ -66,14 +66,14 @@ def detect(
             output_["score"] = overall_score
             output_["description"] = \
                 f"{self.name} detects event IDs not encountered in training as anomalies."
-            output_["alertsObtain"].update(alerts)
+            output_["alertDetails"].update(alerts)
             return True
 
         return False
 
     def configure(self, input_: ParserSchema) -> None:  # type: ignore
         self.auto_conf_persistency.ingest_event(
-            event_id=input_["EventID"],
+            event_id=input_["eventID"],
             event_template=input_["template"]
         )
 
diff --git a/src/detectmatelibrary/detectors/new_value_combo_detector.py b/src/detectmatelibrary/detectors/new_value_combo_detector.py
index 63145eb7..cb492e38 100644
--- a/src/detectmatelibrary/detectors/new_value_combo_detector.py
+++ b/src/detectmatelibrary/detectors/new_value_combo_detector.py
@@ -155,7 +155,7 @@ def set_configuration(self, max_combo_size: int | None = None) -> None:
 
         Variables and combos are sorted before they are written, so the
         generated config does not depend on the order the variables arrived in
-        (a ParserSchema keeps its logFormatVariables in no fixed order).
+        (a ParserSchema keeps its headerVariables in no fixed order).
         """
         if max_combo_size is not None:
             self.config.auto_config_params.max_combo_size = max_combo_size
@@ -174,7 +174,7 @@ def set_configuration(self, max_combo_size: int | None = None) -> None:
             input_ = cast(ParserSchema, record)
             configured_variables = get_configured_variables(input_, self.config.events)
             self.auto_conf_persistency_combos.ingest_event(
-                event_id=input_["EventID"],
+                event_id=input_["eventID"],
                 event_template=input_["template"],
                 named_variables=configured_variables,
                 timestamp=self._timestamps.read(input_),
diff --git a/src/detectmatelibrary/detectors/random_detector.py b/src/detectmatelibrary/detectors/random_detector.py
index dd3bac81..3ad33ad4 100644
--- a/src/detectmatelibrary/detectors/random_detector.py
+++ b/src/detectmatelibrary/detectors/random_detector.py
@@ -48,7 +48,7 @@ def detect(
         overall_score = 0.0
         alerts = {}
 
-        event_config = self.config.events[input_["EventID"]]
+        event_config = self.config.events[input_["eventID"]]
         if event_config is None:
             return False
 
@@ -69,7 +69,7 @@ def detect(
 
         if overall_score > 0:
             output_["score"] = overall_score
-            output_["alertsObtain"].update(alerts)
+            output_["alertDetails"].update(alerts)
             return True
 
         return False
diff --git a/src/detectmatelibrary/detectors/rule_detector.py b/src/detectmatelibrary/detectors/rule_detector.py
index 3056fe97..672c8c22 100644
--- a/src/detectmatelibrary/detectors/rule_detector.py
+++ b/src/detectmatelibrary/detectors/rule_detector.py
@@ -20,7 +20,7 @@ def template_rule(
 
 
 def template_not_found(input_: schemas.ParserSchema, *args: list[Any]) -> tuple[bool, str]:
-    raise_alert = input_["EventID"] == -1
+    raise_alert = input_["eventID"] == -1
     message = "No template found by parser"
     return raise_alert, message
 
@@ -40,7 +40,7 @@ def exceptions(input_: schemas.ParserSchema, *args: list[Any]) -> tuple[bool, st
 
 
 def error_log(input_: schemas.ParserSchema, *args: list[Any]) -> tuple[bool, str]:
-    vars_: dict[str, str] = input_["logFormatVariables"]
+    vars_: dict[str, str] = input_["headerVariables"]
     raise_alert = "Level" in vars_ and "error" == vars_["Level"].lower()
     message = "Error found"
     return raise_alert, message
@@ -103,7 +103,7 @@ def detect(
             alert, msg = rules[rule["rule"]](input_, rule["args"])  # type: ignore
 
             if alert:
-                output_["alertsObtain"][rule["rule"]] = msg
+                output_["alertDetails"][rule["rule"]] = msg
                 output_["score"] += 1
 
             anomaly = anomaly or alert
diff --git a/src/detectmatelibrary/helper/from_to.py b/src/detectmatelibrary/helper/from_to.py
index 6ce39c22..00c36572 100644
--- a/src/detectmatelibrary/helper/from_to.py
+++ b/src/detectmatelibrary/helper/from_to.py
@@ -146,7 +146,7 @@ def __generator():  # type: ignore
             for i in range(len(df)):
                 data = df.row(i, named=True)
                 if len(df_vars) > 0:
-                    data["logFormatVariables"] = df_vars.row(i, named=True)
+                    data["headerVariables"] = df_vars.row(i, named=True)
                 data["logID"] = str(i)
                 schema = component.input_schema(data)
                 yield schema
@@ -179,7 +179,7 @@ def __generator():  # type: ignore
                     data = df_batch.row(i, named=True)
                     data_var = batch_vars.row(i, named=True)
                     if len(data_var) > 0:
-                        data["logFormatVariables"] = data_var
+                        data["headerVariables"] = data_var
                     data["logID"] = str(i)
                     schema = component.input_schema(data)
                     yield schema
@@ -266,7 +266,7 @@ def polars(
     ) -> Iterator[BaseSchema]:
 
         renames = {
-            "Content": "log", "ParamList": "variables", "EventIDs": "EventID", "Templates": "template"
+            "Content": "log", "ParamList": "variables", "EventIDs": "eventID", "Templates": "template"
         } if renames is None else renames
         columns = df.columns if isinstance(df, pl.DataFrame) else df.collect_schema().names()
         if "ParamList" not in columns and "ParamList" in renames:
diff --git a/src/detectmatelibrary/parsers/autoparser.py b/src/detectmatelibrary/parsers/autoparser.py
index d83093c4..5fefdd25 100644
--- a/src/detectmatelibrary/parsers/autoparser.py
+++ b/src/detectmatelibrary/parsers/autoparser.py
@@ -49,11 +49,11 @@ def post_train(self) -> None:
     def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> None:
 
         if self.tree_match is None:
-            output_["EventID"] = -1
+            output_["eventID"] = -1
             output_["template"] = "templates not yet generated"
         else:
             parsed = self.tree_match.match_log(input_["log"], get_var=True)[0]
 
-            output_["EventID"] = parsed["EventID"]
+            output_["eventID"] = parsed["EventID"]
             output_["variables"].extend(parsed["ParamList"])
             output_["template"] = parsed["Template"]
diff --git a/src/detectmatelibrary/parsers/drain.py b/src/detectmatelibrary/parsers/drain.py
index fbcd75af..17547e3f 100644
--- a/src/detectmatelibrary/parsers/drain.py
+++ b/src/detectmatelibrary/parsers/drain.py
@@ -108,11 +108,11 @@ def post_train(self) -> None:
     def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> None:
 
         if self.tree_match is None:
-            output_["EventID"] = -1
+            output_["eventID"] = -1
             output_["template"] = "templates not yet generated"
         else:
             parsed = self.tree_match.match_log(input_["log"], get_var=True)[0]
 
-            output_["EventID"] = parsed["EventID"]
+            output_["eventID"] = parsed["EventID"]
             output_["variables"].extend(parsed["ParamList"])
             output_["template"] = parsed["Template"]
diff --git a/src/detectmatelibrary/parsers/json_parser.py b/src/detectmatelibrary/parsers/json_parser.py
index f3d9d412..22bc5987 100644
--- a/src/detectmatelibrary/parsers/json_parser.py
+++ b/src/detectmatelibrary/parsers/json_parser.py
@@ -93,15 +93,15 @@ def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> Non
             parsed_content = self.content_parser.process(log_)
             parsed["EventTemplate"] = parsed_content["template"]  # type: ignore
             parsed["Params"] = parsed_content["variables"]  # type: ignore
-            parsed["EventId"] = parsed_content["EventID"]  # type: ignore
+            parsed["EventId"] = parsed_content["eventID"]  # type: ignore
 
         log_flat = flatten_dict(log)
-        output_["logFormatVariables"].clear()  # ensure it's empty before updating
-        output_["logFormatVariables"].update({k: str(v) for k, v in log_flat.items()})
+        output_["headerVariables"].clear()  # ensure it's empty before updating
+        output_["headerVariables"].update({k: str(v) for k, v in log_flat.items()})
         time = self.time_format_handler.parse_timestamp(
             str(timestamp), self.config.time_format
         )
-        output_["logFormatVariables"].update({"Time": time})
+        output_["headerVariables"].update({"Time": time})
         output_["template"] = parsed["EventTemplate"]
         output_["variables"].extend(parsed["Params"])
-        output_["EventID"] = parsed["EventId"]
+        output_["eventID"] = parsed["EventId"]
diff --git a/src/detectmatelibrary/parsers/logbatcher/parser.py b/src/detectmatelibrary/parsers/logbatcher/parser.py
index ecfecdd7..2c6a51de 100644
--- a/src/detectmatelibrary/parsers/logbatcher/parser.py
+++ b/src/detectmatelibrary/parsers/logbatcher/parser.py
@@ -73,4 +73,4 @@ def parse(
 
         output_["template"] = template
         output_["variables"].extend(list(variables))
-        output_["EventID"] = event_id
+        output_["eventID"] = event_id
diff --git a/src/detectmatelibrary/parsers/template_matcher/_parser.py b/src/detectmatelibrary/parsers/template_matcher/_parser.py
index 8565cf32..7e74bbdc 100644
--- a/src/detectmatelibrary/parsers/template_matcher/_parser.py
+++ b/src/detectmatelibrary/parsers/template_matcher/_parser.py
@@ -159,4 +159,4 @@ def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> Non
 
         output_["template"] = parsed["EventTemplate"]
         output_["variables"] = parsed["Params"]
-        output_["EventID"] = parsed["EventId"]
+        output_["eventID"] = parsed["EventId"]
diff --git a/src/detectmatelibrary/parsers/tree_matcher.py b/src/detectmatelibrary/parsers/tree_matcher.py
index fbdf185d..c6a3a299 100644
--- a/src/detectmatelibrary/parsers/tree_matcher.py
+++ b/src/detectmatelibrary/parsers/tree_matcher.py
@@ -38,6 +38,6 @@ def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> Non
 
         parsed = self.tree.match_log(input_["log"], get_var=True)[0]
 
-        output_["EventID"] = parsed["EventID"]
+        output_["eventID"] = parsed["EventID"]
         output_["variables"].extend(parsed["ParamList"])
         output_["template"] = parsed["Template"]
diff --git a/src/detectmatelibrary/schemas/_op.py b/src/detectmatelibrary/schemas/_op.py
index d2c92015..c63ebc92 100644
--- a/src/detectmatelibrary/schemas/_op.py
+++ b/src/detectmatelibrary/schemas/_op.py
@@ -15,7 +15,7 @@
 DETECTOR_SCHEMA: SchemaT = s.DetectorSchema  # type: ignore
 AGGREGATE_SCHEMA: SchemaT = s.AggregateSchema  # type: ignore
 
-__current_version = "1.0.0"
+__current_version = "2.0.0"
 
 
 #  Exceptions ****************************************
@@ -88,7 +88,7 @@ def get_variables_names(schema: SchemaT) -> list[str]:
 def initialize(schema: SchemaT, **kwargs: Any) -> SchemaT:
     """Initialize a protobuf schema, it uses its arguments and the assigned
     id."""
-    kwargs["__version__"] = __current_version
+    kwargs["schemaVersion"] = __current_version
     return schema(**kwargs)
 
 
diff --git a/src/detectmatelibrary/schemas/schemas.proto b/src/detectmatelibrary/schemas/schemas.proto
index 95459477..7eb5a344 100644
--- a/src/detectmatelibrary/schemas/schemas.proto
+++ b/src/detectmatelibrary/schemas/schemas.proto
@@ -1,11 +1,11 @@
 syntax = "proto3";
 
 message Schema {
-    string __version__ = 1;
+    string schemaVersion = 1;
 }
 
 message LogSchema {
-    optional string __version__ = 1;
+    optional string schemaVersion = 1;
     optional string logID = 2;
     optional string log = 3;
     optional string logSource = 4;
@@ -13,42 +13,42 @@ message LogSchema {
 }
 
 message ParserSchema {
-    optional string __version__ = 1;
+    optional string schemaVersion = 1;
     optional string parserType = 2;
     optional string parserID = 3;
-    optional int32 EventID = 4;
+    optional int32 eventID = 4;
     optional string template = 5;
     repeated string variables = 6;
     optional string parsedLogID = 7;
     optional string logID = 8;
     optional string log = 9;
-    map<string, string> logFormatVariables = 10;
+    map<string, string> headerVariables = 10;
     optional int64 receivedTimestamp = 11;
     optional int64 parsedTimestamp = 12;
 }
 
 message DetectorSchema {
-    optional string __version__ = 1;
+    optional string schemaVersion = 1;
     optional string detectorID = 2;
     optional string detectorType = 3;
     optional string alertID = 4;
-    optional int64 detectionTimestamp = 5;
+    optional int64 detectedTimestamp = 5;
     repeated string logIDs = 6;
     optional float score = 8;
-    repeated int64 extractedTimestamps = 9;
+    repeated int64 logTimestamps = 9;
     optional string description = 10;
     optional int64 receivedTimestamp = 11;
-    map<string, string> alertsObtain = 12;
+    map<string, string> alertDetails = 12;
 }
 
 message AggregateSchema {
-    optional string __version__ = 1;
+    optional string schemaVersion = 1;
     repeated string detectorIDs = 2;
     repeated string detectorTypes = 3;
     repeated string alertIDs = 4;
-    optional int64 outputTimestamp = 5;
+    optional int64 aggregatedTimestamp = 5;
     repeated string logIDs = 6;
-    repeated int64 extractedTimestamps = 9;
+    repeated int64 logTimestamps = 9;
     optional string description = 10;
-    map<string, string> alertsObtain = 12;
+    map<string, string> alertDetails = 12;
 }
diff --git a/src/detectmatelibrary/schemas/schemas_pb2.py b/src/detectmatelibrary/schemas/schemas_pb2.py
index fd62de35..2b28ea23 100644
--- a/src/detectmatelibrary/schemas/schemas_pb2.py
+++ b/src/detectmatelibrary/schemas/schemas_pb2.py
@@ -13,33 +13,33 @@
 
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\rschemas.proto\"\x1d\n\x06Schema\x12\x13\n\x0b__version__\x18\x01 \x01(\t\"\xb7\x01\n\tLogSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05logID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x10\n\x03log\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x16\n\tlogSource\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x15\n\x08hostname\x18\x05 \x01(\tH\x04\x88\x01\x01\x42\x0e\n\x0cX__version__B\x08\n\x06_logIDB\x06\n\x04_logB\x0c\n\n_logSourceB\x0b\n\t_hostname\"\xa5\x04\n\x0cParserSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\nparserType\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x15\n\x08parserID\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x45ventID\x18\x04 \x01(\x05H\x03\x88\x01\x01\x12\x15\n\x08template\x18\x05 \x01(\tH\x04\x88\x01\x01\x12\x11\n\tvariables\x18\x06 \x03(\t\x12\x18\n\x0bparsedLogID\x18\x07 \x01(\tH\x05\x88\x01\x01\x12\x12\n\x05logID\x18\x08 \x01(\tH\x06\x88\x01\x01\x12\x10\n\x03log\x18\t \x01(\tH\x07\x88\x01\x01\x12\x41\n\x12logFormatVariables\x18\n \x03(\x0b\x32%.ParserSchema.LogFormatVariablesEntry\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x08\x88\x01\x01\x12\x1c\n\x0fparsedTimestamp\x18\x0c \x01(\x03H\t\x88\x01\x01\x1a\x39\n\x17LogFormatVariablesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\r\n\x0b_parserTypeB\x0b\n\t_parserIDB\n\n\x08_EventIDB\x0b\n\t_templateB\x0e\n\x0c_parsedLogIDB\x08\n\x06_logIDB\x06\n\x04_logB\x14\n\x12_receivedTimestampB\x12\n\x10_parsedTimestamp\"\x81\x04\n\x0e\x44\x65tectorSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\ndetectorID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x19\n\x0c\x64\x65tectorType\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x61lertID\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x1f\n\x12\x64\x65tectionTimestamp\x18\x05 \x01(\x03H\x04\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x12\n\x05score\x18\x08 \x01(\x02H\x05\x88\x01\x01\x12\x1b\n\x13\x65xtractedTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x06\x88\x01\x01\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x07\x88\x01\x01\x12\x37\n\x0c\x61lertsObtain\x18\x0c \x03(\x0b\x32!.DetectorSchema.AlertsObtainEntry\x1a\x33\n\x11\x41lertsObtainEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\r\n\x0b_detectorIDB\x0f\n\r_detectorTypeB\n\n\x08_alertIDB\x15\n\x13_detectionTimestampB\x08\n\x06_scoreB\x0e\n\x0c_descriptionB\x14\n\x12_receivedTimestamp\"\xf1\x02\n\x0f\x41ggregateSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x13\n\x0b\x64\x65tectorIDs\x18\x02 \x03(\t\x12\x15\n\rdetectorTypes\x18\x03 \x03(\t\x12\x10\n\x08\x61lertIDs\x18\x04 \x03(\t\x12\x1c\n\x0foutputTimestamp\x18\x05 \x01(\x03H\x01\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x1b\n\x13\x65xtractedTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x02\x88\x01\x01\x12\x38\n\x0c\x61lertsObtain\x18\x0c \x03(\x0b\x32\".AggregateSchema.AlertsObtainEntry\x1a\x33\n\x11\x41lertsObtainEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\x12\n\x10_outputTimestampB\x0e\n\x0c_descriptionb\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\rschemas.proto\"\x1f\n\x06Schema\x12\x15\n\rschemaVersion\x18\x01 \x01(\t\"\xbb\x01\n\tLogSchema\x12\x1a\n\rschemaVersion\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05logID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x10\n\x03log\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x16\n\tlogSource\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x15\n\x08hostname\x18\x05 \x01(\tH\x04\x88\x01\x01\x42\x10\n\x0e_schemaVersionB\x08\n\x06_logIDB\x06\n\x04_logB\x0c\n\n_logSourceB\x0b\n\t_hostname\"\xa0\x04\n\x0cParserSchema\x12\x1a\n\rschemaVersion\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\nparserType\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x15\n\x08parserID\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x65ventID\x18\x04 \x01(\x05H\x03\x88\x01\x01\x12\x15\n\x08template\x18\x05 \x01(\tH\x04\x88\x01\x01\x12\x11\n\tvariables\x18\x06 \x03(\t\x12\x18\n\x0bparsedLogID\x18\x07 \x01(\tH\x05\x88\x01\x01\x12\x12\n\x05logID\x18\x08 \x01(\tH\x06\x88\x01\x01\x12\x10\n\x03log\x18\t \x01(\tH\x07\x88\x01\x01\x12;\n\x0fheaderVariables\x18\n \x03(\x0b\x32\".ParserSchema.HeaderVariablesEntry\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x08\x88\x01\x01\x12\x1c\n\x0fparsedTimestamp\x18\x0c \x01(\x03H\t\x88\x01\x01\x1a\x36\n\x14HeaderVariablesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x10\n\x0e_schemaVersionB\r\n\x0b_parserTypeB\x0b\n\t_parserIDB\n\n\x08_eventIDB\x0b\n\t_templateB\x0e\n\x0c_parsedLogIDB\x08\n\x06_logIDB\x06\n\x04_logB\x14\n\x12_receivedTimestampB\x12\n\x10_parsedTimestamp\"\xfd\x03\n\x0e\x44\x65tectorSchema\x12\x1a\n\rschemaVersion\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\ndetectorID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x19\n\x0c\x64\x65tectorType\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x61lertID\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x1e\n\x11\x64\x65tectedTimestamp\x18\x05 \x01(\x03H\x04\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x12\n\x05score\x18\x08 \x01(\x02H\x05\x88\x01\x01\x12\x15\n\rlogTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x06\x88\x01\x01\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x07\x88\x01\x01\x12\x37\n\x0c\x61lertDetails\x18\x0c \x03(\x0b\x32!.DetectorSchema.AlertDetailsEntry\x1a\x33\n\x11\x41lertDetailsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x10\n\x0e_schemaVersionB\r\n\x0b_detectorIDB\x0f\n\r_detectorTypeB\n\n\x08_alertIDB\x14\n\x12_detectedTimestampB\x08\n\x06_scoreB\x0e\n\x0c_descriptionB\x14\n\x12_receivedTimestamp\"\xf7\x02\n\x0f\x41ggregateSchema\x12\x1a\n\rschemaVersion\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x13\n\x0b\x64\x65tectorIDs\x18\x02 \x03(\t\x12\x15\n\rdetectorTypes\x18\x03 \x03(\t\x12\x10\n\x08\x61lertIDs\x18\x04 \x03(\t\x12 \n\x13\x61ggregatedTimestamp\x18\x05 \x01(\x03H\x01\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x15\n\rlogTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x02\x88\x01\x01\x12\x38\n\x0c\x61lertDetails\x18\x0c \x03(\x0b\x32\".AggregateSchema.AlertDetailsEntry\x1a\x33\n\x11\x41lertDetailsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x10\n\x0e_schemaVersionB\x16\n\x14_aggregatedTimestampB\x0e\n\x0c_descriptionb\x06proto3')
 
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, globals())
 _builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'schemas_pb2', globals())
 if _descriptor._USE_C_DESCRIPTORS == False:
 
   DESCRIPTOR._options = None
-  _PARSERSCHEMA_LOGFORMATVARIABLESENTRY._options = None
-  _PARSERSCHEMA_LOGFORMATVARIABLESENTRY._serialized_options = b'8\001'
-  _DETECTORSCHEMA_ALERTSOBTAINENTRY._options = None
-  _DETECTORSCHEMA_ALERTSOBTAINENTRY._serialized_options = b'8\001'
-  _AGGREGATESCHEMA_ALERTSOBTAINENTRY._options = None
-  _AGGREGATESCHEMA_ALERTSOBTAINENTRY._serialized_options = b'8\001'
+  _PARSERSCHEMA_HEADERVARIABLESENTRY._options = None
+  _PARSERSCHEMA_HEADERVARIABLESENTRY._serialized_options = b'8\001'
+  _DETECTORSCHEMA_ALERTDETAILSENTRY._options = None
+  _DETECTORSCHEMA_ALERTDETAILSENTRY._serialized_options = b'8\001'
+  _AGGREGATESCHEMA_ALERTDETAILSENTRY._options = None
+  _AGGREGATESCHEMA_ALERTDETAILSENTRY._serialized_options = b'8\001'
   _SCHEMA._serialized_start=17
-  _SCHEMA._serialized_end=46
-  _LOGSCHEMA._serialized_start=49
-  _LOGSCHEMA._serialized_end=232
-  _PARSERSCHEMA._serialized_start=235
-  _PARSERSCHEMA._serialized_end=784
-  _PARSERSCHEMA_LOGFORMATVARIABLESENTRY._serialized_start=582
-  _PARSERSCHEMA_LOGFORMATVARIABLESENTRY._serialized_end=639
-  _DETECTORSCHEMA._serialized_start=787
-  _DETECTORSCHEMA._serialized_end=1300
-  _DETECTORSCHEMA_ALERTSOBTAINENTRY._serialized_start=1118
-  _DETECTORSCHEMA_ALERTSOBTAINENTRY._serialized_end=1169
-  _AGGREGATESCHEMA._serialized_start=1303
-  _AGGREGATESCHEMA._serialized_end=1672
-  _AGGREGATESCHEMA_ALERTSOBTAINENTRY._serialized_start=1118
-  _AGGREGATESCHEMA_ALERTSOBTAINENTRY._serialized_end=1169
+  _SCHEMA._serialized_end=48
+  _LOGSCHEMA._serialized_start=51
+  _LOGSCHEMA._serialized_end=238
+  _PARSERSCHEMA._serialized_start=241
+  _PARSERSCHEMA._serialized_end=785
+  _PARSERSCHEMA_HEADERVARIABLESENTRY._serialized_start=584
+  _PARSERSCHEMA_HEADERVARIABLESENTRY._serialized_end=638
+  _DETECTORSCHEMA._serialized_start=788
+  _DETECTORSCHEMA._serialized_end=1297
+  _DETECTORSCHEMA_ALERTDETAILSENTRY._serialized_start=1114
+  _DETECTORSCHEMA_ALERTDETAILSENTRY._serialized_end=1165
+  _AGGREGATESCHEMA._serialized_start=1300
+  _AGGREGATESCHEMA._serialized_end=1675
+  _AGGREGATESCHEMA_ALERTDETAILSENTRY._serialized_start=1114
+  _AGGREGATESCHEMA_ALERTDETAILSENTRY._serialized_end=1165
 # @@protoc_insertion_point(module_scope)
diff --git a/src/detectmatelibrary/tools/workspace/templates/CustomDetector.py b/src/detectmatelibrary/tools/workspace/templates/CustomDetector.py
index 07f6b8db..3dc93937 100644
--- a/src/detectmatelibrary/tools/workspace/templates/CustomDetector.py
+++ b/src/detectmatelibrary/tools/workspace/templates/CustomDetector.py
@@ -52,7 +52,7 @@ def detect(
         result = pattern[self._call_count % len(pattern)]
         if result:
             output_["score"] = 1.0  # Score of the detector
-            output_["alertsObtain"]["type"] = "Anomaly detected by CustomDetector"  # Additional info
+            output_["alertDetails"]["type"] = "Anomaly detected by CustomDetector"  # Additional info
 
         return result
 
diff --git a/src/detectmatelibrary/tools/workspace/templates/CustomParser.py b/src/detectmatelibrary/tools/workspace/templates/CustomParser.py
index a40a932f..4825778f 100644
--- a/src/detectmatelibrary/tools/workspace/templates/CustomParser.py
+++ b/src/detectmatelibrary/tools/workspace/templates/CustomParser.py
@@ -41,7 +41,7 @@ def parse(
         """
 
         # Dummy implementation example (replace with real logic)
-        output_["EventID"] = 2  # Number of the log template
+        output_["eventID"] = 2  # Number of the log template
         output_["variables"].extend(["dummy_variable"])  # Variables found in the log
         output_["template"] = "This is a dummy template"  # Log template
 
diff --git a/src/detectmatelibrary/tools/workspace/templates/data/logs.json b/src/detectmatelibrary/tools/workspace/templates/data/logs.json
index bdcda278..5bdf9021 100644
--- a/src/detectmatelibrary/tools/workspace/templates/data/logs.json
+++ b/src/detectmatelibrary/tools/workspace/templates/data/logs.json
@@ -1,84 +1,84 @@
 {
     "0": {
         "log": "type=USER_ACCT msg=audit(1642723741.072:375): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "0"
     },
     "1": {
         "log": "type=CRED_ACQ msg=audit(1642723741.072:376): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "1"
     },
     "2": {
         "log": "type=LOGIN msg=audit(1642723741.076:377): pid=10125 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=65 res=1",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "2"
     },
     "3": {
         "log": "type=USER_START msg=audit(1642723741.080:378): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "3"
     },
     "4": {
         "log": "type=CRED_DISP msg=audit(1642723741.084:379): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "4"
     },
     "5": {
         "log": "type=USER_END msg=audit(1642723741.084:380): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "5"
     },
     "6": {
         "log": "type=SERVICE_START msg=audit(1642723752.624:381): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "6"
     },
     "7": {
         "log": "type=SERVICE_STOP msg=audit(1642723752.624:382): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "7"
     },
     "8": {
         "log": "type=USER_ACCT msg=audit(1642724221.094:383): pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "8"
     },
     "9": {
         "log": "type=CRED_ACQ msg=audit(1642724221.098:384): pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "9"
     },
     "10": {
         "log": "type=LOGIN msg=audit(1642724221.098:385): pid=10197 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=66 res=1",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "10"
     },
     "11": {
         "log": "type=USER_START msg=audit(1642724221.102:386): pid=10197 uid=0 auid=0 ses=66 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "11"
diff --git a/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json b/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json
index 412fd631..5b7b358b 100644
--- a/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json
+++ b/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json
@@ -4,13 +4,13 @@
         "parsedLogID": "10",
         "logID": "0",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "USER_ACCT",
             "Serial": "375",
             "Time": "1642723741.072",
             "Content": "pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -27,7 +27,7 @@
         ],
         "log": "type=USER_ACCT msg=audit(1642723741.072:375): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "1": {
@@ -35,13 +35,13 @@
         "parsedLogID": "11",
         "logID": "1",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "CRED_ACQ",
             "Serial": "376",
             "Time": "1642723741.072",
             "Content": "pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -58,7 +58,7 @@
         ],
         "log": "type=CRED_ACQ msg=audit(1642723741.072:376): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "2": {
@@ -66,13 +66,13 @@
         "parsedLogID": "12",
         "logID": "2",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "LOGIN",
             "Serial": "377",
             "Time": "1642723741.076",
             "Content": "pid=10125 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=65 res=1"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -86,7 +86,7 @@
         ],
         "log": "type=LOGIN msg=audit(1642723741.076:377): pid=10125 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=65 res=1",
         "parserType": "matcher_parser",
-        "EventID": 2,
+        "eventID": 2,
         "template": "pid=<*> uid=<*> old-auid=<*> auid=<*> tty=<*> old-ses=<*> ses=<*> res=<*>"
     },
     "3": {
@@ -94,13 +94,13 @@
         "parsedLogID": "13",
         "logID": "3",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "USER_START",
             "Serial": "378",
             "Time": "1642723741.080",
             "Content": "pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -117,7 +117,7 @@
         ],
         "log": "type=USER_START msg=audit(1642723741.080:378): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "4": {
@@ -125,13 +125,13 @@
         "parsedLogID": "14",
         "logID": "4",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "CRED_DISP",
             "Serial": "379",
             "Time": "1642723741.084",
             "Content": "pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -148,7 +148,7 @@
         ],
         "log": "type=CRED_DISP msg=audit(1642723741.084:379): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "5": {
@@ -156,13 +156,13 @@
         "parsedLogID": "15",
         "logID": "5",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "USER_END",
             "Serial": "380",
             "Time": "1642723741.084",
             "Content": "pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -179,7 +179,7 @@
         ],
         "log": "type=USER_END msg=audit(1642723741.084:380): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "6": {
@@ -187,13 +187,13 @@
         "parsedLogID": "16",
         "logID": "6",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "SERVICE_START",
             "Serial": "381",
             "Time": "1642723752.624",
             "Content": "pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "1",
@@ -210,7 +210,7 @@
         ],
         "log": "type=SERVICE_START msg=audit(1642723752.624:381): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'",
         "parserType": "matcher_parser",
-        "EventID": 1,
+        "eventID": 1,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='unit=<*> comm=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "7": {
@@ -218,13 +218,13 @@
         "parsedLogID": "17",
         "logID": "7",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "SERVICE_STOP",
             "Serial": "382",
             "Time": "1642723752.624",
             "Content": "pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "1",
@@ -241,7 +241,7 @@
         ],
         "log": "type=SERVICE_STOP msg=audit(1642723752.624:382): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'",
         "parserType": "matcher_parser",
-        "EventID": 1,
+        "eventID": 1,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='unit=<*> comm=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "8": {
@@ -249,13 +249,13 @@
         "parsedLogID": "18",
         "logID": "8",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "USER_ACCT",
             "Serial": "383",
             "Time": "1642724221.094",
             "Content": "pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
@@ -272,7 +272,7 @@
         ],
         "log": "type=USER_ACCT msg=audit(1642724221.094:383): pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "9": {
@@ -280,13 +280,13 @@
         "parsedLogID": "19",
         "logID": "9",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "CRED_ACQ",
             "Serial": "384",
             "Time": "1642724221.098",
             "Content": "pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
@@ -303,7 +303,7 @@
         ],
         "log": "type=CRED_ACQ msg=audit(1642724221.098:384): pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     },
     "10": {
@@ -311,13 +311,13 @@
         "parsedLogID": "20",
         "logID": "10",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "LOGIN",
             "Serial": "385",
             "Time": "1642724221.098",
             "Content": "pid=10197 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=66 res=1"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
@@ -331,7 +331,7 @@
         ],
         "log": "type=LOGIN msg=audit(1642724221.098:385): pid=10197 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=66 res=1",
         "parserType": "matcher_parser",
-        "EventID": 2,
+        "eventID": 2,
         "template": "pid=<*> uid=<*> old-auid=<*> auid=<*> tty=<*> old-ses=<*> ses=<*> res=<*>"
     },
     "11": {
@@ -339,13 +339,13 @@
         "parsedLogID": "21",
         "logID": "11",
         "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
+        "headerVariables": {
             "Type": "USER_START",
             "Serial": "386",
             "Time": "1642724221.102",
             "Content": "pid=10197 uid=0 auid=0 ses=66 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
@@ -362,7 +362,7 @@
         ],
         "log": "type=USER_START msg=audit(1642724221.102:386): pid=10197 uid=0 auid=0 ses=66 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
         "parserType": "matcher_parser",
-        "EventID": 0,
+        "eventID": 0,
         "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
     }
 }
\ No newline at end of file
diff --git a/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomDetector.py b/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomDetector.py
index a0e6414b..483b6d42 100644
--- a/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomDetector.py
+++ b/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomDetector.py
@@ -31,7 +31,7 @@ def test_run_detect_method(self) -> None:
         assert output.description == "Dummy detection process"
         if result:
             assert output.score == 1.0
-            assert "Anomaly detected" in output.alertsObtain["type"]
+            assert "Anomaly detected" in output.alertDetails["type"]
         else:
             assert output.score == 0.0
-            assert len(output.alertsObtain) == 0
+            assert len(output.alertDetails) == 0
diff --git a/src/detectmatelibrary/utils/sequence_encoding.py b/src/detectmatelibrary/utils/sequence_encoding.py
index 49f83ecd..21feece8 100644
--- a/src/detectmatelibrary/utils/sequence_encoding.py
+++ b/src/detectmatelibrary/utils/sequence_encoding.py
@@ -28,7 +28,7 @@ def build_count_vec(input_: List[schemas.ParserSchema]) -> tuple[int, ...]:
     """Count how often each EventID occurs in a window, indexed by EventID."""
     sequence, n = [0], 0
     for in_ in input_:
-        event = in_["EventID"]
+        event = in_["eventID"]
         if n < event:
             for _ in range(n, event):
                 sequence.append(0)
diff --git a/tests/test_alert_aggregators/test_basic_concat.py b/tests/test_alert_aggregators/test_basic_concat.py
index d07e1b49..46a7c52f 100644
--- a/tests/test_alert_aggregators/test_basic_concat.py
+++ b/tests/test_alert_aggregators/test_basic_concat.py
@@ -26,13 +26,13 @@
     "detectorID": "1",
     "detectorType": "dummy",
     "alertID": "2",
-    "detectionTimestamp": 0,
+    "detectedTimestamp": 0,
     "logIDs": ["logID1"],
     "score": 0.2,
-    "extractedTimestamps": [-1],
+    "logTimestamps": [-1],
     "description": "hello there",
     "receivedTimestamp": 1,
-    "alertsObtain": {"99 problems": "but logs aint one"}
+    "alertDetails": {"99 problems": "but logs aint one"}
 }
 
 
diff --git a/tests/test_base_detectors/test_deeplearning_detectors.py b/tests/test_base_detectors/test_deeplearning_detectors.py
index 585e835f..9adb0432 100644
--- a/tests/test_base_detectors/test_deeplearning_detectors.py
+++ b/tests/test_base_detectors/test_deeplearning_detectors.py
@@ -35,7 +35,7 @@ def test_normal_run_configure(self):
 
         for i in range(10):
             deep_learning_detector.configure(
-                [schemas.ParserSchema({"EventID": i})]
+                [schemas.ParserSchema({"eventID": i})]
             )
 
         for i in range(10):
@@ -51,7 +51,7 @@ def test_normal_run_train(self):
 
         for i in range(10):
             deep_learning_detector.train(
-                [schemas.ParserSchema({"EventID": i})]
+                [schemas.ParserSchema({"eventID": i})]
             )
 
         for i in range(10):
@@ -66,4 +66,4 @@ def test_check_that_check_anomaly_is_call(self):
         )
 
         with pytest.raises(Flag):
-            deep_learning_detector.process(schemas.ParserSchema({"EventID": 0}))
+            deep_learning_detector.process(schemas.ParserSchema({"eventID": 0}))
diff --git a/tests/test_base_detectors/test_tracker_detector.py b/tests/test_base_detectors/test_tracker_detector.py
index 9e42a3fa..4912d1cb 100644
--- a/tests/test_base_detectors/test_tracker_detector.py
+++ b/tests/test_base_detectors/test_tracker_detector.py
@@ -34,14 +34,14 @@
 def _event(event_id: int) -> schemas.ParserSchema:
     return schemas.ParserSchema({
         "parserType": "test",
-        "EventID": event_id,
+        "eventID": event_id,
         "template": "test template",
         "variables": [],
         "logID": str(event_id),
         "parsedLogID": str(event_id),
         "parserID": "test_parser",
         "log": "test log message",
-        "logFormatVariables": {},
+        "headerVariables": {},
     })
 
 
@@ -61,7 +61,7 @@ def _sync_from_state(self) -> None:
         self.synced += 1
 
     def train(self, input_: schemas.ParserSchema) -> None:  # type: ignore[override]
-        self._ingest(input_, {}, input_["EventID"])
+        self._ingest(input_, {}, input_["eventID"])
 
 
 class TestSyncFromState:
diff --git a/tests/test_base_detectors/test_variable_detector.py b/tests/test_base_detectors/test_variable_detector.py
index 81eaa19e..af0f7d86 100644
--- a/tests/test_base_detectors/test_variable_detector.py
+++ b/tests/test_base_detectors/test_variable_detector.py
@@ -29,9 +29,9 @@
 def train(detector: VariableDetector, *users) -> None:
     for u in users:
         detector.train(schemas.ParserSchema({
-            "parserType": "t", "EventID": 1, "template": "t", "variables": [u],
+            "parserType": "t", "eventID": 1, "template": "t", "variables": [u],
             "logID": "1", "parsedLogID": "1", "parserID": "p", "log": "l",
-            "logFormatVariables": {},
+            "headerVariables": {},
         }))
 
 
diff --git a/tests/test_common/test_core.py b/tests/test_common/test_core.py
index 0cb2d515..e3f523e6 100644
--- a/tests/test_common/test_core.py
+++ b/tests/test_common/test_core.py
@@ -43,7 +43,7 @@ class MockConfigWithTraining(CoreConfig):
 
 def _make_log(i: int) -> schemas.LogSchema:
     return schemas.LogSchema({
-        "__version__": "1.0.0",
+        "schemaVersion": "2.0.0",
         "logID": str(i),
         "logSource": "test",
         "hostname": "test_hostname"
@@ -241,7 +241,7 @@ def test_training(self) -> None:
         for i in range(10):
             component.process(
                 schemas.LogSchema({
-                    "__version__": "1.0.0",
+                    "schemaVersion": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
@@ -251,7 +251,7 @@ def test_training(self) -> None:
         assert len(component.train_data) == component.fitlogic.train_state.data_used
         for i, log in enumerate(component.train_data):
             expected = schemas.LogSchema({
-                "__version__": "1.0.0",
+                "schemaVersion": "2.0.0",
                 "logID": str(i),
                 "logSource": "test",
                 "hostname": "test_hostname"
@@ -267,7 +267,7 @@ def test_training_use_config_data(self) -> None:
         for i in range(10):
             component.process(
                 schemas.LogSchema({
-                    "__version__": "1.0.0",
+                    "schemaVersion": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
@@ -278,7 +278,7 @@ def test_training_use_config_data(self) -> None:
         assert len(component.train_data) == total
         for i, log in enumerate(component.train_data):
             expected = schemas.LogSchema({
-                "__version__": "1.0.0",
+                "schemaVersion": "2.0.0",
                 "logID": str(i),
                 "logSource": "test",
                 "hostname": "test_hostname"
@@ -293,7 +293,7 @@ def test_training_force_stop(self) -> None:
                 component.update_state("stop_training")
             component.process(
                 schemas.LogSchema({
-                    "__version__": "1.0.0",
+                    "schemaVersion": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
@@ -309,7 +309,7 @@ def test_training_keep_training(self) -> None:
         for i in range(10):
             component.process(
                 schemas.LogSchema({
-                    "__version__": "1.0.0",
+                    "schemaVersion": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
diff --git a/tests/test_common/test_core_alert_aggregator.py b/tests/test_common/test_core_alert_aggregator.py
index 1aa180dd..5c9148a7 100644
--- a/tests/test_common/test_core_alert_aggregator.py
+++ b/tests/test_common/test_core_alert_aggregator.py
@@ -52,13 +52,13 @@ def aggregate_alerts(self, input_, output_):
     "detectorID": "1",
     "detectorType": "dummy",
     "alertID": "2",
-    "detectionTimestamp": 0,
+    "detectedTimestamp": 0,
     "logIDs": ["logID1"],
     "score": 0.2,
-    "extractedTimestamps": [-1],
+    "logTimestamps": [-1],
     "description": "hello there",
     "receivedTimestamp": 1,
-    "alertsObtain": {"99 problems": "but logs aint one"}
+    "alertDetails": {"99 problems": "but logs aint one"}
 }
 
 
@@ -107,15 +107,15 @@ def test_process_correct_input_schema(self) -> None:
     def test_process_input_schema_not_serialized(self) -> None:
         alert_aggregator = MockupAlertAggregator(name="TestAAG", config=MockupConfig())
         expected_result = schemas.AggregateSchema({
-            "__version__": "1.0.0",
+            "schemaVersion": "2.0.0",
             "detectorIDs": ["1"],
             "detectorTypes": ["dummy"],
             "alertIDs": ["2"],
-            "outputTimestamp": 0,
+            "aggregatedTimestamp": 0,
             "logIDs": ["logID1"],
             "description": "Mockup aggregator",
-            "extractedTimestamps": [-1],
-            "alertsObtain": {}
+            "logTimestamps": [-1],
+            "alertDetails": {}
         })
         data = schemas.DetectorSchema(dummy_schema)
         result = alert_aggregator.process(data)
@@ -124,15 +124,15 @@ def test_process_input_schema_not_serialized(self) -> None:
     def test_process_input_schema_not_serialized_window_3(self) -> None:
         alert_aggregator = MockupAlertAggregator(name="TestDetector", config=MockupConfig(), buffer_size=3)
         expected_result = schemas.AggregateSchema({
-            "__version__": "1.0.0",
+            "schemaVersion": "2.0.0",
             "detectorIDs": ["1", "1", "1"],
             "detectorTypes": ["dummy", "dummy", "dummy"],
             "alertIDs": ["2", "2", "2"],
-            "outputTimestamp": 0,
+            "aggregatedTimestamp": 0,
             "logIDs": ["logID1", "logID1", "logID1"],
             "description": "Mockup aggregator",
-            "extractedTimestamps": [-1, -1, -1],
-            "alertsObtain": {}
+            "logTimestamps": [-1, -1, -1],
+            "alertDetails": {}
         })
         data = schemas.DetectorSchema(dummy_schema)
 
@@ -147,15 +147,15 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
             name="TestDetector", config=MockupConfig(), buffer_size=3
         )
         expected_result = schemas.AggregateSchema({
-            "__version__": "1.0.0",
+            "schemaVersion": "2.0.0",
             "detectorIDs": ["1", "1", "1"],
             "detectorTypes": ["dummy", "dummy", "dummy"],
             "alertIDs": ["2", "2", "2"],
-            "outputTimestamp": 0,
+            "aggregatedTimestamp": 0,
             "logIDs": ["logID1", "logID1", "logID1"],
             "description": "Mockup aggregator",
-            "extractedTimestamps": [-1, -1, -1],
-            "alertsObtain": {}
+            "logTimestamps": [-1, -1, -1],
+            "alertDetails": {}
         })
         data = schemas.DetectorSchema(dummy_schema)
 
diff --git a/tests/test_common/test_core_detector.py b/tests/test_common/test_core_detector.py
index 1c0fa308..dce2db58 100644
--- a/tests/test_common/test_core_detector.py
+++ b/tests/test_common/test_core_detector.py
@@ -72,14 +72,14 @@ def detect(self, input_, output_):
 
 dummy_schema = {
     "parserType": "a",
-    "EventID": 0,
+    "eventID": 0,
     "template": "asd",
     "variables": [""],
     "logID": "0",
     "parsedLogID": "22",
     "parserID": "test",
     "log": "This is a parsed log.",
-    "logFormatVariables": {"Time": "12121.12"},
+    "headerVariables": {"Time": "12121.12"},
 }
 
 
@@ -129,15 +129,15 @@ def test_process_correct_input_schema(self) -> None:
     def test_process_input_schema_not_serialized(self) -> None:
         detector = MockupDetector(name="TestDetector", config=MockupConfig())
         expected_result = schemas.DetectorSchema({
-            "__version__": "1.0.0",
+            "schemaVersion": "2.0.0",
             "detectorID": "TestDetector",
             "detectorType": "core_detector",
             "alertID": "TestDetector_10",
-            "detectionTimestamp": 0,
+            "detectedTimestamp": 0,
             "logIDs": ["0"],
             "score": 0.9,
             "description": "hii",
-            "extractedTimestamps": [12121],
+            "logTimestamps": [12121],
             "receivedTimestamp": 0,
         })
         data = schemas.ParserSchema(dummy_schema)
@@ -147,15 +147,15 @@ def test_process_input_schema_not_serialized(self) -> None:
     def test_process_input_schema_not_serialized_window_3(self) -> None:
         detector = MockupDetector_window(name="TestDetector", config=MockupConfig())
         expected_result = schemas.DetectorSchema({
-            "__version__": "1.0.0",
+            "schemaVersion": "2.0.0",
             "detectorID": "TestDetector",
             "detectorType": "core_detector",
             "alertID": "TestDetector_10",
-            "detectionTimestamp": 0,
+            "detectedTimestamp": 0,
             "logIDs": ["0", "0", "0"],
             "score": 0.9,
             "description": "hii",
-            "extractedTimestamps": [12121, 12121, 12121],
+            "logTimestamps": [12121, 12121, 12121],
             "receivedTimestamp": 0
         })
         data = schemas.ParserSchema(dummy_schema)
@@ -169,15 +169,15 @@ def test_process_input_schema_not_serialized_window_3(self) -> None:
     def test_process_input_schema_not_serialized_buffer_3(self) -> None:
         detector = MockupDetector_window(name="TestDetector01", config=MockupConfig())
         expected_result = schemas.DetectorSchema({
-            "__version__": "1.0.0",
+            "schemaVersion": "2.0.0",
             "detectorID": "TestDetector01",
             "detectorType": "core_detector",
             "alertID": "TestDetector01_10",
-            "detectionTimestamp": 0,
+            "detectedTimestamp": 0,
             "logIDs": ["0", "0", "0"],
             "score": 0.9,
             "description": "hii",
-            "extractedTimestamps": [12121, 12121, 12121],
+            "logTimestamps": [12121, 12121, 12121],
             "receivedTimestamp": 0,
         })
         data = schemas.ParserSchema(dummy_schema)
diff --git a/tests/test_common/test_core_parser.py b/tests/test_common/test_core_parser.py
index 18e34f28..4d466e3a 100644
--- a/tests/test_common/test_core_parser.py
+++ b/tests/test_common/test_core_parser.py
@@ -16,7 +16,7 @@ def __init__(self, name: str, config: CoreParserConfig) -> None:
         super().__init__(name=name, config=config)
 
     def parse(self, input_, output_):
-        output_.EventID = 1
+        output_.eventID = 1
         output_.template = "hello"
         output_.variables = ["a", "b"]
 
@@ -26,7 +26,7 @@ def __init__(self, name: str, config: CoreParserConfig) -> None:
         super().__init__(name=name, config=config)
 
     def parse(self, input_, output_):
-        output_.EventID = 1
+        output_.eventID = 1
         output_.variables = ["a", "b"]
 
 
@@ -38,7 +38,7 @@ def __init__(self, name: str, config: CoreParserConfig) -> None:
     def parse(self, input_, output_):
         self.value = not self.value
 
-        output_.EventID = 1
+        output_.eventID = 1
         output_.template = "hello"
         output_.variables = ["a", "b"]
 
@@ -89,10 +89,10 @@ def test_process_correct_input_schema(self) -> None:
     def test_process_correct_input_schema_not_serialize(self) -> None:
         parser = MockupParser(name="TestParser", config=MockupConfig())
         expected_result = schemas.ParserSchema({
-            "__version__": "1.0.0",
+            "schemaVersion": "2.0.0",
             "parserType": "core_parser",
             "parserID": "TestParser",
-            "EventID": 1,
+            "eventID": 1,
             "template": "hello",
             "parsedLogID": "TestParser_10",
             "logID": "1",
@@ -101,7 +101,7 @@ def test_process_correct_input_schema_not_serialize(self) -> None:
             "parsedTimestamp": 0,
         })
         expected_result.variables = ["a", "b"]
-        expected_result.logFormatVariables["Time"] = "0"
+        expected_result.headerVariables["Time"] = "0"
 
         data = schemas.LogSchema({"logID": "1", "log": "This is a log."})
         result = parser.process(data)
diff --git a/tests/test_common/test_extract_timestamp.py b/tests/test_common/test_extract_timestamp.py
index 304a3401..a775a621 100644
--- a/tests/test_common/test_extract_timestamp.py
+++ b/tests/test_common/test_extract_timestamp.py
@@ -8,14 +8,14 @@ def test_various_time_formats(self) -> None:
         formats."""
         dummy_schema = {
             "parserType": "a",
-            "EventID": 0,
+            "eventID": 0,
             "template": "asd",
             "variables": [""],
             "logID": "0",
             "parsedLogID": "22",
             "parserID": "test",
             "log": "This is a parsed log.",
-            "logFormatVariables": {"Time": "12121"},
+            "headerVariables": {"Time": "12121"},
         }
         # Compute expected value for timezone-naive formats at runtime
         EXPECTED_UTC = 1772633880
@@ -50,7 +50,7 @@ def test_various_time_formats(self) -> None:
             ("Wednesday, March 4, 2026 14:18:00", EXPECTED_UTC),
         ]
         for time_str, expected in test_cases:
-            schema = schemas.ParserSchema({**dummy_schema, "logFormatVariables": {"Time": time_str}})
+            schema = schemas.ParserSchema({**dummy_schema, "headerVariables": {"Time": time_str}})
             result = _extract_timestamp(schema)
             assert result == [expected], (
                 f"Format '{time_str}': expected [{expected}], got {result}"
@@ -60,12 +60,12 @@ def test_microsecond_epoch_fits_the_schema(self) -> None:
         """Issue #271: a microsecond epoch folded only once landed in
         milliseconds and overflowed the int32 timestamp fields."""
         schema = schemas.DetectorSchema({
-            "extractedTimestamps": _extract_timestamp(
-                schemas.ParserSchema({"logFormatVariables": {"Time": "1643114452000000"}})
+            "logTimestamps": _extract_timestamp(
+                schemas.ParserSchema({"headerVariables": {"Time": "1643114452000000"}})
             ),
         })
         assert str(schema)  # rebuilds the protobuf -- used to raise ValueError
-        assert schema["extractedTimestamps"] == [1643114452]
+        assert schema["logTimestamps"] == [1643114452]
 
     def test_timestamp_fields_hold_more_than_int32(self) -> None:
         """Timestamps are int64, so they survive 2038 (and a stray ms
@@ -73,9 +73,9 @@ def test_timestamp_fields_hold_more_than_int32(self) -> None:
         for schema, field, value in [
             (schemas.ParserSchema(), "receivedTimestamp", 2**31),
             (schemas.ParserSchema(), "parsedTimestamp", 2**31),
-            (schemas.DetectorSchema(), "detectionTimestamp", 2**31),
+            (schemas.DetectorSchema(), "detectedTimestamp", 2**31),
             (schemas.DetectorSchema(), "receivedTimestamp", 1643114452000),
-            (schemas.AggregateSchema(), "outputTimestamp", 2**31),
+            (schemas.AggregateSchema(), "aggregatedTimestamp", 2**31),
         ]:
             schema[field] = value
             assert getattr(schema.get_schema(), field) == value
diff --git a/tests/test_detectors/test_auto_config_params_survive.py b/tests/test_detectors/test_auto_config_params_survive.py
index 32fb0147..f2a62439 100644
--- a/tests/test_detectors/test_auto_config_params_survive.py
+++ b/tests/test_detectors/test_auto_config_params_survive.py
@@ -30,10 +30,10 @@
 def _schema(event_id: int, level: str, log_id: str):
     return {
         "logID": log_id,
-        "EventID": event_id,
+        "eventID": event_id,
         "template": "user <*> from <*>",
         "variables": ["alice", "10.0.0.1"],
-        "logFormatVariables": {"user": "alice", "src": "10.0.0.1", "level": level},
+        "headerVariables": {"user": "alice", "src": "10.0.0.1", "level": level},
     }
 
 
diff --git a/tests/test_detectors/test_bigram_frequency_detector.py b/tests/test_detectors/test_bigram_frequency_detector.py
index b92f0b77..25690a27 100644
--- a/tests/test_detectors/test_bigram_frequency_detector.py
+++ b/tests/test_detectors/test_bigram_frequency_detector.py
@@ -131,14 +131,14 @@ def test_train_multiple_values(self):
             for level in ["INFO", "WARNING", "ERROR"]:
                 parser_data = schemas.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["0", "assa"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {"level": level}
+                    "headerVariables": {"level": level}
                 })
                 detector.train(parser_data)
 
@@ -163,28 +163,28 @@ def test_detect_known_value_no_alert(self):
         # Train with a value
         train_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 12,
+            "eventID": 12,
             "template": "test template",
             "variables": ["adsasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -199,28 +199,28 @@ def test_detect_known_value_alert(self):
         # Train with a value
         train_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -391,7 +391,7 @@ def test_global_instance_detects_new_type(self):
         for log in logs[TRAIN_UNTIL:]:
             output = schemas.DetectorSchema()
             if detector.detect(log, output_=output):
-                assert all(key.startswith("Global -") for key in output["alertsObtain"])
+                assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
 
         assert len(detected_ids) > 0
@@ -419,14 +419,14 @@ def test_set_configuration_preserves_persist(self):
 def _parser_data(event_id, level, var_value):
     return schemas.ParserSchema({
         "parserType": "test",
-        "EventID": event_id,
+        "eventID": event_id,
         "template": "test template",
         "variables": ["0", var_value],
         "logID": "1",
         "parsedLogID": "1",
         "parserID": "test_parser",
         "log": "test log message",
-        "logFormatVariables": {"level": level},
+        "headerVariables": {"level": level},
     })
 
 
@@ -480,14 +480,14 @@ def test_detect_helper_survives_missing_variable(self):
         # Detect with a parser line that lacks the 'test' variable
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["0"],  # only pos 0 — no value at pos 1
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"},
+            "headerVariables": {"level": "INFO"},
         })
         output = schemas.DetectorSchema()
         # Must not raise TypeError
@@ -627,14 +627,14 @@ def test_two_variables_have_independent_freq_tables(self):
         detector = BigramFrequencyDetector(config=cfg, name="TwoVarDetector")
         parser_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["abc", "xyz"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {},
+            "headerVariables": {},
         })
         detector.train(parser_data)
 
diff --git a/tests/test_detectors/test_charset_detector.py b/tests/test_detectors/test_charset_detector.py
index 2aabd081..e4c3fcba 100644
--- a/tests/test_detectors/test_charset_detector.py
+++ b/tests/test_detectors/test_charset_detector.py
@@ -122,14 +122,14 @@ def test_train_multiple_values(self):
             for level in ["INFO", "WARNING", "ERROR"]:
                 parser_data = schemas.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["0", "assa"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {"level": level}
+                    "headerVariables": {"level": level}
                 })
                 detector.train(parser_data)
 
@@ -153,28 +153,28 @@ def test_detect_known_value_no_alert(self):
         # Train with a value
         train_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 12,
+            "eventID": 12,
             "template": "test template",
             "variables": ["adsasddddddaaa"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -189,28 +189,28 @@ def test_detect_known_value_alert(self):
         # Train with a value
         train_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["asas", "adsd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -242,17 +242,17 @@ def test_detect_unknown_chars_reported_per_variable(self):
         detector = CharsetDetector(config=cfg, name="Single")
 
         train = schemas.ParserSchema({
-            "parserType": "test", "EventID": 1, "template": "t",
+            "parserType": "test", "eventID": 1, "template": "t",
             "variables": ["abc"], "logID": "1", "parsedLogID": "1",
-            "parserID": "p", "log": "l", "logFormatVariables": {},
+            "parserID": "p", "log": "l", "headerVariables": {},
         })
         detector.train(train)
 
         # All known chars
         ok = schemas.ParserSchema({
-            "parserType": "test", "EventID": 1, "template": "t",
+            "parserType": "test", "eventID": 1, "template": "t",
             "variables": ["cba"], "logID": "2", "parsedLogID": "2",
-            "parserID": "p", "log": "l", "logFormatVariables": {},
+            "parserID": "p", "log": "l", "headerVariables": {},
         })
         out = schemas.DetectorSchema()
         assert not detector.detect(ok, out)
@@ -260,14 +260,14 @@ def test_detect_unknown_chars_reported_per_variable(self):
 
         # Unknown chars 'x' and 'y'
         bad = schemas.ParserSchema({
-            "parserType": "test", "EventID": 1, "template": "t",
+            "parserType": "test", "eventID": 1, "template": "t",
             "variables": ["axy"], "logID": "3", "parsedLogID": "3",
-            "parserID": "p", "log": "l", "logFormatVariables": {},
+            "parserID": "p", "log": "l", "headerVariables": {},
         })
         out = schemas.DetectorSchema()
         assert detector.detect(bad, out)
         assert out.score == 1.0
-        assert any("'x'" in msg and "'y'" in msg for msg in out["alertsObtain"].values())
+        assert any("'x'" in msg and "'y'" in msg for msg in out["alertDetails"].values())
 
 
 _PARSER_CONFIG = {
@@ -445,7 +445,7 @@ def test_global_instance_detects_new_type(self):
         for log in logs[TRAIN_UNTIL:]:
             output = schemas.DetectorSchema()
             if detector.detect(log, output_=output):
-                assert all(key.startswith("Global -") for key in output["alertsObtain"])
+                assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
 
         assert len(detected_ids) > 0
@@ -460,10 +460,10 @@ def test_persist_flag_survives_set_configuration(self):
         # Feed configure() with a couple of stable-variable samples
         for _ in range(5):
             sample = schemas.ParserSchema({
-                "parserType": "test", "EventID": 1, "template": "t",
+                "parserType": "test", "eventID": 1, "template": "t",
                 "variables": ["abc"], "logID": "x", "parsedLogID": "x",
                 "parserID": "p", "log": "l",
-                "logFormatVariables": {"level": "INFO"},
+                "headerVariables": {"level": "INFO"},
             })
             detector.configure(sample)
 
diff --git a/tests/test_detectors/test_deeplog_detector.py b/tests/test_detectors/test_deeplog_detector.py
index c4b9d8ad..ae64cc2b 100644
--- a/tests/test_detectors/test_deeplog_detector.py
+++ b/tests/test_detectors/test_deeplog_detector.py
@@ -35,7 +35,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                deeplog.process(schemas.ParserSchema({"EventID": i}))
+                deeplog.process(schemas.ParserSchema({"eventID": i}))
 
             if j == 0:
                 assert deeplog.get_state() == "Configuring"
@@ -44,7 +44,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for _ in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                deeplog.process(schemas.ParserSchema({"EventID": i}))
+                deeplog.process(schemas.ParserSchema({"eventID": i}))
         assert deeplog.get_state() == "Default"
 
     @pytest.mark.ignored
@@ -79,7 +79,7 @@ def test_end2end_no_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                deeplog.process(schemas.ParserSchema({"EventID": i}))
+                deeplog.process(schemas.ParserSchema({"eventID": i}))
             if j == 0:
                 assert deeplog.get_state() == "Training"
 
diff --git a/tests/test_detectors/test_ecvc_detector.py b/tests/test_detectors/test_ecvc_detector.py
index f2b4e380..b48fe650 100644
--- a/tests/test_detectors/test_ecvc_detector.py
+++ b/tests/test_detectors/test_ecvc_detector.py
@@ -15,7 +15,7 @@
 class TestECVCOP:
     def test_build_count_vec(self):
         input_ = [
-            schemas.ParserSchema({"EventID": i}) for i in [0, 1, 4, 0]
+            schemas.ParserSchema({"eventID": i}) for i in [0, 1, 4, 0]
         ]
         expected = tuple([2, 1, 0, 0, 1])
 
@@ -23,7 +23,7 @@ def test_build_count_vec(self):
 
     def test_build_one_vec(self):
         input_ = [
-            schemas.ParserSchema({"EventID": i}) for i in [0, 1, 4, 0]
+            schemas.ParserSchema({"eventID": i}) for i in [0, 1, 4, 0]
         ]
 
         expected = np.array([2, 1, 0, 0, 1, 0, 0, 0])
@@ -93,7 +93,7 @@ def test_ecvc(self):
 
         input_ = []
         for _ in range(10):
-            input_.extend([schemas.ParserSchema({"EventID": i}) for i in [0, 1, 4, 0]])
+            input_.extend([schemas.ParserSchema({"eventID": i}) for i in [0, 1, 4, 0]])
 
         for in_ in input_:
             ecvc.process(in_)
@@ -103,7 +103,7 @@ def test_ecvc(self):
             alert = ecvc.process(in_)
         assert alert is None
 
-        for in_ in [schemas.ParserSchema({"EventID": i}) for i in [4, 4, 4, 4, 4, 4, 1, 0, 1, 1]]:
+        for in_ in [schemas.ParserSchema({"eventID": i}) for i in [4, 4, 4, 4, 4, 4, 1, 0, 1, 1]]:
             alert = ecvc.process(in_)
         assert alert is not None
 
@@ -209,7 +209,7 @@ def test_audit_log_anomalie_fed(self):
 
 
 def _window(event_ids):
-    return [schemas.ParserSchema({"EventID": i}) for i in event_ids]
+    return [schemas.ParserSchema({"eventID": i}) for i in event_ids]
 
 
 def _fed_detector(window_size):
diff --git a/tests/test_detectors/test_event_sequence_detector.py b/tests/test_detectors/test_event_sequence_detector.py
index 614ab0f9..aab1629b 100644
--- a/tests/test_detectors/test_event_sequence_detector.py
+++ b/tests/test_detectors/test_event_sequence_detector.py
@@ -50,14 +50,14 @@
 def _make_schema(event_id, template="test template", log_id="1", log_format_variables=None):
     return schemas.ParserSchema({
         "parserType": "test",
-        "EventID": event_id,
+        "eventID": event_id,
         "template": template,
         "variables": ["adsasd", "asdasd"],
         "logID": log_id,
         "parsedLogID": log_id,
         "parserID": "test_parser",
         "log": "test log message",
-        "logFormatVariables": log_format_variables or {"level": "INFO"}
+        "headerVariables": log_format_variables or {"level": "INFO"}
     })
 
 
@@ -141,7 +141,7 @@ def test_detect_unknown_sequence_alert(self):
 
         assert result
         assert output.score == 1.0
-        assert any("Sequence" in key for key in output["alertsObtain"])
+        assert any("Sequence" in key for key in output["alertDetails"])
 
     def test_detect_below_window_length_no_alert(self):
         detector = EventSequenceDetector(config=config, name="MultipleDetector")
diff --git a/tests/test_detectors/test_logbert_detector.py b/tests/test_detectors/test_logbert_detector.py
index 55124a37..c5c5cc68 100644
--- a/tests/test_detectors/test_logbert_detector.py
+++ b/tests/test_detectors/test_logbert_detector.py
@@ -35,7 +35,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                logbert.process(schemas.ParserSchema({"EventID": i}))
+                logbert.process(schemas.ParserSchema({"eventID": i}))
 
             if j == 0:
                 assert logbert.get_state() == "Configuring"
@@ -44,7 +44,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for _ in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                logbert.process(schemas.ParserSchema({"EventID": i}))
+                logbert.process(schemas.ParserSchema({"eventID": i}))
         assert logbert.get_state() == "Default"
         
     @pytest.mark.ignored
@@ -84,7 +84,7 @@ def test_end2end_no_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                logbert.process(schemas.ParserSchema({"EventID": i}))
+                logbert.process(schemas.ParserSchema({"eventID": i}))
             if j == 0:
                 assert logbert.get_state() == "Training"
 
diff --git a/tests/test_detectors/test_mismatch_warnings.py b/tests/test_detectors/test_mismatch_warnings.py
index 40242b0b..438efc43 100644
--- a/tests/test_detectors/test_mismatch_warnings.py
+++ b/tests/test_detectors/test_mismatch_warnings.py
@@ -21,14 +21,14 @@ def _make_parser_schema(
 ) -> schemas.ParserSchema:
     return schemas.ParserSchema({
         "parserType": "test",
-        "EventID": event_id,
+        "eventID": event_id,
         "template": "test template",
         "variables": variables,
         "logID": "1",
         "parsedLogID": "1",
         "parserID": "test_parser",
         "log": "test log message",
-        "logFormatVariables": log_format_variables,
+        "headerVariables": log_format_variables,
     })
 
 
diff --git a/tests/test_detectors/test_new_event_detector.py b/tests/test_detectors/test_new_event_detector.py
index ebffb4bd..342cd1de 100644
--- a/tests/test_detectors/test_new_event_detector.py
+++ b/tests/test_detectors/test_new_event_detector.py
@@ -78,14 +78,14 @@ def test_train_multiple_event_ids(self):
         for event in event_ids:
             parser_data = schemas.ParserSchema({
                 "parserType": "test",
-                "EventID": event,
+                "eventID": event,
                 "template": "test template",
                 "variables": ["0", "assa"],
                 "logID": "1",
                 "parsedLogID": "1",
                 "parserID": "test_parser",
                 "log": "test log message",
-                "logFormatVariables": {"level": "INFO"}
+                "headerVariables": {"level": "INFO"}
             })
             detector.train(parser_data)
 
@@ -103,28 +103,28 @@ def test_detect_known_event_id_no_alert(self):
         # Train with an event_id
         train_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same event_id
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -305,7 +305,7 @@ def test_global_instance_detects_new_type(self):
         for log in logs[TRAIN_UNTIL:]:
             output = schemas.DetectorSchema()
             if detector.detect(log, output_=output):
-                assert all(key.startswith("Global -") for key in output["alertsObtain"])
+                assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
 
         assert len(detected_ids) > 0
@@ -315,7 +315,7 @@ class TestNewEventDetectorFederationCleanup:
     def test_finalize_federation_removes_the_slow_table(self, tmp_path, monkeypatch):
         monkeypatch.chdir(tmp_path)  # the slow store writes .temp/ CSVs here
         detector = NewEventDetector(config=NewEventDetectorConfig(allow_fed=True))
-        detector.train(schemas.ParserSchema({"EventID": 1, "template": "test template"}))
+        detector.train(schemas.ParserSchema({"eventID": 1, "template": "test template"}))
         assert (tmp_path / ".temp").exists()
 
         detector.finalize_federation()
diff --git a/tests/test_detectors/test_new_value_combo_detector.py b/tests/test_detectors/test_new_value_combo_detector.py
index 8cdce9c3..64eba628 100644
--- a/tests/test_detectors/test_new_value_combo_detector.py
+++ b/tests/test_detectors/test_new_value_combo_detector.py
@@ -91,14 +91,14 @@ def test_train_multiple_values(self):
             for level in ["INFO", "WARNING", "ERROR"]:
                 parser_data = schemas.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["0", "assa"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {"level": level}
+                    "headerVariables": {"level": level}
                 })
                 detector.train(parser_data)
 
@@ -115,41 +115,41 @@ def test_detect_known_value_no_alert(self):
         # Train with a value
         train_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         train_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "other_value"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         detector.train(train_data)
 
         # Detect with the same value
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 12,
+            "eventID": 12,
             "template": "test template",
             "variables": ["adsasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -164,41 +164,41 @@ def test_detect_known_value_alert(self):
         # Train with a value
         train_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         train_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "other_value"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         detector.train(train_data)
 
         # Detect with an unknown combination (pos 1 has a new value)
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "new_unknown_value"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -255,14 +255,14 @@ def test_configure_method_ingests_events(self):
         for event_id in [1, 2, 3]:
             parser_data = schemas.ParserSchema({
                 "parserType": "test",
-                "EventID": event_id,
+                "eventID": event_id,
                 "template": f"Template {event_id}",
                 "variables": ["val1", "val2", "val3"],
                 "logID": str(event_id),
                 "parsedLogID": str(event_id),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {"level": "INFO"}
+                "headerVariables": {"level": "INFO"}
             })
             detector.configure(parser_data)
 
@@ -281,14 +281,14 @@ def test_set_configuration_updates_config(self):
         for i in range(10):
             parser_data = schemas.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Template 1",
                 "variables": ["constant", f"varying_{i}", "another_constant"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {"level": "INFO"}
+                "headerVariables": {"level": "INFO"}
             })
             detector.configure(parser_data)
 
@@ -309,14 +309,14 @@ def test_configuration_workflow(self):
             for event_id in [1, 2]:
                 parser_data = schemas.ParserSchema({
                     "parserType": "test",
-                    "EventID": event_id,
+                    "eventID": event_id,
                     "template": f"Template {event_id}",
                     "variables": ["stable_val", f"var_{i % 3}", "another_stable"],
                     "logID": str(len(training_data)),
                     "parsedLogID": str(len(training_data)),
                     "parserID": "test_parser",
                     "log": "test log",
-                    "logFormatVariables": {"level": "INFO"}
+                    "headerVariables": {"level": "INFO"}
                 })
                 training_data.append(parser_data)
                 detector.configure(parser_data)
@@ -331,14 +331,14 @@ def test_configuration_workflow(self):
         # Step 4: Verify detector can detect anomalies
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "Template 1",
             "variables": ["stable_val", "new_value", "another_stable"],
             "logID": "999",
             "parsedLogID": "999",
             "parserID": "test_parser",
             "log": "test log",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         output = schemas.DetectorSchema()
 
@@ -354,14 +354,14 @@ def test_set_configuration_with_combo_size(self):
         for i in range(15):
             parser_data = schemas.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Multi-var template",
                 "variables": ["v1", "v2", "v3", "v4", "v5"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {}
+                "headerVariables": {}
             })
             detector.configure(parser_data)
 
@@ -379,14 +379,14 @@ def test_configuration_with_no_stable_variables(self):
         for i in range(10):
             parser_data = schemas.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Variable template",
                 "variables": [f"val_{i}_0", f"val_{i}_1"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {}
+                "headerVariables": {}
             })
             detector.configure(parser_data)
 
@@ -406,14 +406,14 @@ class TestNewValueComboDetectorEndToEnd:
     def _make_schema(event_id, template, variables, log_format_variables, log_id="1"):
         return schemas.ParserSchema({
             "parserType": "test",
-            "EventID": event_id,
+            "eventID": event_id,
             "template": template,
             "variables": variables,
             "logID": log_id,
             "parsedLogID": log_id,
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": log_format_variables,
+            "headerVariables": log_format_variables,
         })
 
     def test_configure_train_detect_anomalous_combo(self):
@@ -672,14 +672,14 @@ def test_classification_fields_survive_set_configuration(self):
         for i in range(10):
             parser_data = schemas.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Template 1",
                 "variables": ["constant", f"varying_{i}", "another_constant"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {"level": "081109 203615"},
+                "headerVariables": {"level": "081109 203615"},
             })
             detector.configure(parser_data)
 
@@ -698,14 +698,14 @@ def _configured(classification: ClassificationMethods) -> NewValueComboDetector:
         for i in range(10):
             detector.configure(schemas.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Template 1",
                 "variables": ["constant", f"varying_{i}", "another_constant"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {},
+                "headerVariables": {},
             }))
         return detector
 
@@ -755,14 +755,14 @@ def _records(classification=None):
             # so pass 2 gets a ("var_0", "var_1") combo tracker to look at.
             detector.configure(schemas.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "Template 1",
                 "variables": [f"a{i % 3}", f"b{i % 3}", "constant"],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log",
-                "logFormatVariables": {"ts": str(1700000000 + i * 60)},
+                "headerVariables": {"ts": str(1700000000 + i * 60)},
             }))
         return detector
 
@@ -840,7 +840,7 @@ class TestNewValueComboDetectorConfigureSpill:
     def _record(i: int) -> schemas.ParserSchema:
         return schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "Template 1",
             "variables": [f"a{min(i, 3)}", f"b{min(i, 4)}", f"c{min(i, 2)}"],
             "logID": str(i),
@@ -915,14 +915,14 @@ class TestNewValueComboDetectorAllCombos:
     def _record(variables, log_format_variables=None, event_id=1, log_id="1"):
         return schemas.ParserSchema({
             "parserType": "test",
-            "EventID": event_id,
+            "eventID": event_id,
             "template": "Template 1",
             "variables": variables,
             "logID": log_id,
             "parsedLogID": log_id,
             "parserID": "test_parser",
             "log": "test log",
-            "logFormatVariables": log_format_variables or {},
+            "headerVariables": log_format_variables or {},
         })
 
     @staticmethod
@@ -962,7 +962,7 @@ def test_unseen_value_pair_in_a_later_combo_alerts(self):
         output = schemas.DetectorSchema()
         assert detector.detect(self._record(["a", "x"], {"level": "ERROR"}), output)
         assert output.score == 1.0
-        assert list(output.alertsObtain) == ["EventID 1 - ('var_0', 'level')"]
+        assert list(output.alertDetails) == ["EventID 1 - ('var_0', 'level')"]
 
     def test_every_combo_is_trained(self):
         detector = self._two_combos()
@@ -1008,7 +1008,7 @@ def _configured(header_order):
         """Configure a detector whose header variables reach the first pass in
         ``header_order``.
 
-        ParserSchema keeps logFormatVariables in a protobuf map, whose
+        ParserSchema keeps headerVariables in a protobuf map, whose
         iteration order changes from process to process, so the order is
         fixed here by feeding the first-pass store directly.
         """
diff --git a/tests/test_detectors/test_new_value_detector.py b/tests/test_detectors/test_new_value_detector.py
index 283c4fbf..09a1d78c 100644
--- a/tests/test_detectors/test_new_value_detector.py
+++ b/tests/test_detectors/test_new_value_detector.py
@@ -99,14 +99,14 @@ def test_train_multiple_values(self):
             for level in ["INFO", "WARNING", "ERROR"]:
                 parser_data = schemas.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["0", "assa"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {"level": level}
+                    "headerVariables": {"level": level}
                 })
                 detector.train(parser_data)
 
@@ -131,28 +131,28 @@ def test_detect_known_value_no_alert(self):
         # Train with a value
         train_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 12,
+            "eventID": 12,
             "template": "test template",
             "variables": ["adsasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -167,28 +167,28 @@ def test_detect_known_value_alert(self):
         # Train with a value
         train_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "INFO"}
+            "headerVariables": {"level": "INFO"}
         })
         detector.train(train_data)
 
         # Detect with the same value
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "asdasd"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -349,14 +349,14 @@ def test_auto_config_off_keeps_explicit_events_through_configure_phase(self):
         for i in range(20):
             detector.process(schemas.ParserSchema({
                 "parserType": "test",
-                "EventID": [1, 2, 3][i % 3],
+                "eventID": [1, 2, 3][i % 3],
                 "template": "test template",
                 "variables": ["same", str(i)],
                 "logID": str(i),
                 "parsedLogID": str(i),
                 "parserID": "test_parser",
                 "log": "test log message",
-                "logFormatVariables": {"level": "INFO", "Time": str(1_700_000_000 + i)},
+                "headerVariables": {"level": "INFO", "Time": str(1_700_000_000 + i)},
             }))
 
         assert detector.config.events.model_dump() == explicit_events
@@ -400,7 +400,7 @@ def test_global_instance_detects_new_type(self):
         for log in logs[TRAIN_UNTIL:]:
             output = schemas.DetectorSchema()
             if detector.detect(log, output_=output):
-                assert all(key.startswith("Global -") for key in output["alertsObtain"])
+                assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
 
         assert len(detected_ids) > 0
diff --git a/tests/test_detectors/test_persist_integration.py b/tests/test_detectors/test_persist_integration.py
index 0564a595..a31412c3 100644
--- a/tests/test_detectors/test_persist_integration.py
+++ b/tests/test_detectors/test_persist_integration.py
@@ -289,7 +289,7 @@ def ingest_loop():
 
 
 def _window(event_ids):
-    return [schemas.ParserSchema({"EventID": i}) for i in event_ids]
+    return [schemas.ParserSchema({"eventID": i}) for i in event_ids]
 
 
 class TestStatelessComponents:
diff --git a/tests/test_detectors/test_pre_tracker_state.py b/tests/test_detectors/test_pre_tracker_state.py
index 988d3912..8631c138 100644
--- a/tests/test_detectors/test_pre_tracker_state.py
+++ b/tests/test_detectors/test_pre_tracker_state.py
@@ -36,7 +36,7 @@
 
 def _event(event_id: int, variables: list[str] | None = None) -> schemas.ParserSchema:
     return schemas.ParserSchema({
-        "EventID": event_id, "template": "login <*>", "variables": variables or [], "logID": "1",
+        "eventID": event_id, "template": "login <*>", "variables": variables or [], "logID": "1",
     })
 
 
diff --git a/tests/test_detectors/test_random_detector.py b/tests/test_detectors/test_random_detector.py
index 886ef1d4..471dab0d 100644
--- a/tests/test_detectors/test_random_detector.py
+++ b/tests/test_detectors/test_random_detector.py
@@ -51,14 +51,14 @@ def test_random_seed_consistency(self):
         detector = RandomDetector(name="TestDetector", config=deepcopy(config))
         parser_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["var1"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"timestamp": "123456"}
+            "headerVariables": {"timestamp": "123456"}
         })
         detector_output = schemas.DetectorSchema()
 
diff --git a/tests/test_detectors/test_rule_detector.py b/tests/test_detectors/test_rule_detector.py
index 5cb023f0..122e2664 100644
--- a/tests/test_detectors/test_rule_detector.py
+++ b/tests/test_detectors/test_rule_detector.py
@@ -6,12 +6,12 @@
 
 class TestCaseRules:
     def test_template_not_found(self) -> None:
-        parsed_log = schemas.ParserSchema({"EventID": -1})
+        parsed_log = schemas.ParserSchema({"eventID": -1})
         alert, msg = rd.template_not_found(parsed_log)
         assert alert
         assert "No template found by parser" == msg
 
-        parsed_log = schemas.ParserSchema({"EventID": 2})
+        parsed_log = schemas.ParserSchema({"eventID": 2})
         alert, _ = rd.template_not_found(parsed_log)
         assert not alert
 
@@ -44,14 +44,14 @@ def test_find_exceptions(self) -> None:
 
     def test_error_log(self) -> None:
         parsed_log = schemas.ParserSchema(
-            {"logFormatVariables": {"Level": "Error"}}
+            {"headerVariables": {"Level": "Error"}}
         )
         alert, msg = rd.error_log(parsed_log)
         assert alert
         assert "Error found" == msg
 
         parsed_log = schemas.ParserSchema(
-            {"logFormatVariables": {"Level": "Info"}}
+            {"headerVariables": {"Level": "Info"}}
         )
         alert, _ = rd.error_log(parsed_log)
         assert not alert
@@ -69,13 +69,13 @@ def test_run_all_rules(self) -> None:
 
         alert1 = rule_detector.process(schemas.ParserSchema(
             {
-                "EventID": -1,
+                "eventID": -1,
                 "log": "fail exception",
-                "logFormatVariables": {"Level": "Error"}
+                "headerVariables": {"Level": "Error"}
             }
         ))
         assert alert1 is not None
-        assert alert1["alertsObtain"] == {
+        assert alert1["alertDetails"] == {
             "R001 - TemplateNotFound": "No template found by parser",
             "R003 - CheckForExceptions": "Found word 'exception' in the logs",
             "R004 - ErrorLevelFound": "Error found",
@@ -89,15 +89,15 @@ def test_all_rules_serialize(self) -> None:
 
         alert1 = rule_detector.process(schemas.ParserSchema(
             {
-                "EventID": -1,
+                "eventID": -1,
                 "log": "fail exception",
-                "logFormatVariables": {"Level": "Error"}
+                "headerVariables": {"Level": "Error"}
             }
         ).serialize())
         assert alert1 is not None
 
         (alert := schemas.DetectorSchema()).deserialize(alert1)
-        assert alert["alertsObtain"] == {
+        assert alert["alertDetails"] == {
             "R001 - TemplateNotFound": "No template found by parser",
             "R003 - CheckForExceptions": "Found word 'exception' in the logs",
             "R004 - ErrorLevelFound": "Error found",
@@ -126,13 +126,13 @@ def test_run_single_rule(self) -> None:
 
         alert1 = rule_detector.process(schemas.ParserSchema(
             {
-                "EventID": -1,
+                "eventID": -1,
                 "log": "fail exception",
-                "logFormatVariables": {"Level": "Error"}
+                "headerVariables": {"Level": "Error"}
             }
         ))
         assert alert1 is not None
-        assert alert1["alertsObtain"] == {
+        assert alert1["alertDetails"] == {
             "R001 - TemplateNotFound": "No template found by parser",
         }
         assert alert1["score"] == 1
diff --git a/tests/test_detectors/test_scvs_detector.py b/tests/test_detectors/test_scvs_detector.py
index a169b091..02afd445 100644
--- a/tests/test_detectors/test_scvs_detector.py
+++ b/tests/test_detectors/test_scvs_detector.py
@@ -15,7 +15,7 @@
 class TestSCVSDetector:
     def test_build_count_vec(self):
         input_ = [
-            schemas.ParserSchema({"EventID": i}) for i in [0, 1, 4, 0]
+            schemas.ParserSchema({"eventID": i}) for i in [0, 1, 4, 0]
         ]
         expected = tuple([2, 1, 0, 0, 1])
 
@@ -43,7 +43,7 @@ def test_scvs(self):
 
         input_ = []
         for _ in range(10):
-            input_.extend([schemas.ParserSchema({"EventID": i}) for i in [0, 1, 4, 0]])
+            input_.extend([schemas.ParserSchema({"eventID": i}) for i in [0, 1, 4, 0]])
 
         for in_ in input_:
             scvs.process(in_)
@@ -53,7 +53,7 @@ def test_scvs(self):
             alert = scvs.process(in_)
         assert alert is None
 
-        for in_ in [schemas.ParserSchema({"EventID": i}) for i in [4, 4, 4, 4, 4, 4, 1, 0, 1, 1]]:
+        for in_ in [schemas.ParserSchema({"eventID": i}) for i in [4, 4, 4, 4, 4, 4, 1, 0, 1, 1]]:
             alert = scvs.process(in_)
         assert alert is not None
 
@@ -138,7 +138,7 @@ def test_audit_log_anomalie_fed(self):
 
 
 def _window(event_ids):
-    return [schemas.ParserSchema({"EventID": i}) for i in event_ids]
+    return [schemas.ParserSchema({"eventID": i}) for i in event_ids]
 
 
 def _fed_detector(window_size):
diff --git a/tests/test_detectors/test_value_range_detector.py b/tests/test_detectors/test_value_range_detector.py
index 9b096eeb..b9b62d4f 100644
--- a/tests/test_detectors/test_value_range_detector.py
+++ b/tests/test_detectors/test_value_range_detector.py
@@ -132,14 +132,14 @@ def test_train_multiple_values(self):
                     max_val = max(max_val, value)
                 parser_data = schemas.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["val0", str(value), "val2", "val3", "val4"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {}
+                    "headerVariables": {}
                 })
                 detector.train(parser_data)
 
@@ -150,14 +150,14 @@ def test_train_multiple_values(self):
                     max_val = max(max_val, value)
                 parser_data = schemas.ParserSchema({
                     "parserType": "test",
-                    "EventID": event,
+                    "eventID": event,
                     "template": "test template",
                     "variables": ["val0", str(value), "val2", "val3", "val4"],
                     "logID": "1",
                     "parsedLogID": "1",
                     "parserID": "test_parser",
                     "log": "test log message",
-                    "logFormatVariables": {}
+                    "headerVariables": {}
                 })
                 detector.train(parser_data)
 
@@ -177,27 +177,27 @@ def test_train_detect_non_numeric_raises(self):
         # Train with multiple values (the minimum and maximum value should be captured)
         parser_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["val0", f"val{random.randint(0, 300)}", "val2", "val3", "val4"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {}
+            "headerVariables": {}
         })
         with pytest.raises(ValueError):
             detector.train(parser_data)
         normal_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["val0", f"{random.randint(0, 300)}", "val2", "val3", "val4"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {}
+            "headerVariables": {}
         })
         detector.train(normal_data)
         with pytest.raises(ValueError):
@@ -211,26 +211,26 @@ def test_train_detect_non_numeric_ignore(self):
         # Train with multiple values (the minimum and maximum value should be captured)
         parser_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["val0", f"val{random.randint(0, 300)}", "val2", "val3", "val4"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {}
+            "headerVariables": {}
         })
         detector.train(parser_data)
         normal_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["val0", f"{random.randint(0, 300)}", "val2", "val3", "val4"],
             "logID": "1",
             "parsedLogID": "1",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {}
+            "headerVariables": {}
         })
         detector.train(normal_data)
         output = schemas.DetectorSchema()
@@ -247,28 +247,28 @@ def test_detect_learned_value_range_no_alert(self):
         for val in ["1", "5000", "2130"]:
             train_data = schemas.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "test template",
                 "variables": ["adsasd", val],
                 "logID": "1",
                 "parsedLogID": "1",
                 "parserID": "test_parser",
                 "log": "test log message",
-                "logFormatVariables": {"level": "INFO"}
+                "headerVariables": {"level": "INFO"}
             })
             detector.train(train_data)
 
         # Detect with the same value
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "4321"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -284,28 +284,28 @@ def test_detect_known_value_ranges_alert(self):
         for val in ["1", "5000", "2130"]:
             train_data = schemas.ParserSchema({
                 "parserType": "test",
-                "EventID": 1,
+                "eventID": 1,
                 "template": "test template",
                 "variables": ["adsasd", val],
                 "logID": "1",
                 "parsedLogID": "1",
                 "parserID": "test_parser",
                 "log": "test log message",
-                "logFormatVariables": {"level": "INFO"}
+                "headerVariables": {"level": "INFO"}
             })
             detector.train(train_data)
 
         # Detect with the different value
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "5001"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -317,14 +317,14 @@ def test_detect_known_value_ranges_alert(self):
         # Detect with the different value
         test_data = schemas.ParserSchema({
             "parserType": "test",
-            "EventID": 1,
+            "eventID": 1,
             "template": "test template",
             "variables": ["adsasd", "0"],
             "logID": "2",
             "parsedLogID": "2",
             "parserID": "test_parser",
             "log": "test log message",
-            "logFormatVariables": {"level": "CRITICAL"}
+            "headerVariables": {"level": "CRITICAL"}
         })
         output = schemas.DetectorSchema()
 
@@ -516,7 +516,7 @@ def test_global_instance_detects_new_type(self):
         for log in logs[TRAIN_UNTIL:]:
             output = schemas.DetectorSchema()
             if detector.detect(log, output_=output):
-                assert all(key.startswith("Global -") for key in output["alertsObtain"])
+                assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
 
         assert len(detected_ids) > 0
@@ -545,10 +545,10 @@ def test_set_configuration_preserves_persist(self):
         # Feed configure() with a couple of stable-variable samples
         for _ in range(5):
             sample = schemas.ParserSchema({
-                "parserType": "test", "EventID": 1, "template": "t",
+                "parserType": "test", "eventID": 1, "template": "t",
                 "variables": ["123"], "logID": "x", "parsedLogID": "x",
                 "parserID": "p", "log": "l",
-                "logFormatVariables": {"level": "INFO"},
+                "headerVariables": {"level": "INFO"},
             })
             detector.configure(sample)
 
diff --git a/tests/test_helper/test_from_to.py b/tests/test_helper/test_from_to.py
index 870d6ada..9a20ce2f 100644
--- a/tests/test_helper/test_from_to.py
+++ b/tests/test_helper/test_from_to.py
@@ -183,10 +183,10 @@ def test_frompolars(self):
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
-            "EventID": 0,
-            "logFormatVariables": {"Type": "A"}
+            "eventID": 0,
+            "headerVariables": {"Type": "A"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed1[field] == schema1[field], field
         assert parsed1["logID"] == "0"
 
@@ -195,10 +195,10 @@ def test_frompolars(self):
             "log": "general kenobi",
             "variables": ["c", "d"],
             "template": "<*> kenobi",
-            "EventID": 1,
-            "logFormatVariables": {"Type": "B"}
+            "eventID": 1,
+            "headerVariables": {"Type": "B"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed2[field] == schema2[field], field
         assert parsed2["logID"] == "1"
 
@@ -217,10 +217,10 @@ def test_frompolars_lazy(self):
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
-            "EventID": 0,
-            "logFormatVariables": {"Type": "A"}
+            "eventID": 0,
+            "headerVariables": {"Type": "A"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed1[field] == schema1[field], field
         assert parsed1["logID"] == "0"
 
@@ -229,10 +229,10 @@ def test_frompolars_lazy(self):
             "log": "general kenobi",
             "variables": ["c", "d"],
             "template": "<*> kenobi",
-            "EventID": 1,
-            "logFormatVariables": {"Type": "B"}
+            "eventID": 1,
+            "headerVariables": {"Type": "B"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed2[field] == schema2[field], field
         assert parsed2["logID"] == "1"
 
@@ -245,7 +245,7 @@ def test_frompolars_rename(self):
             "EventIDs": [0, 1]
         })
         renames = {
-            "Content": "log", "Vars": "variables", "EventIDs": "EventID", "Templates": "template"
+            "Content": "log", "Vars": "variables", "EventIDs": "eventID", "Templates": "template"
         }
         gen = From.polars(DummyDetector(), df=table, do_process=False, renames=renames)
 
@@ -254,10 +254,10 @@ def test_frompolars_rename(self):
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
-            "EventID": 0,
-            "logFormatVariables": {"Type": "A"}
+            "eventID": 0,
+            "headerVariables": {"Type": "A"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed1[field] == schema1[field], field
 
     def test_frompolars_rename_vars(self):
@@ -269,7 +269,7 @@ def test_frompolars_rename_vars(self):
             "EventIDs": [0, 1]
         })
         renames = {
-            "Content": "log", "Vars": "variables", "EventIDs": "EventID", "Templates": "template"
+            "Content": "log", "Vars": "variables", "EventIDs": "eventID", "Templates": "template"
         }
         gen = From.polars(DummyDetector(), df=table, do_process=False, renames=renames)
 
@@ -278,10 +278,10 @@ def test_frompolars_rename_vars(self):
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
-            "EventID": 0,
-            "logFormatVariables": {"Type": "A"}
+            "eventID": 0,
+            "headerVariables": {"Type": "A"}
         })
-        for field in ["log", "variables", "template", "EventID", "logFormatVariables"]:
+        for field in ["log", "variables", "template", "eventID", "headerVariables"]:
             assert parsed1[field] == schema1[field], field
 
 
diff --git a/tests/test_parsers/test_drain.py b/tests/test_parsers/test_drain.py
index d12d0d5a..9e33fc26 100644
--- a/tests/test_parsers/test_drain.py
+++ b/tests/test_parsers/test_drain.py
@@ -23,19 +23,19 @@ def test_train_process(self):
         parser = DrainParser(config=config_dict)
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, general kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, captain kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, sargent kenobi!"}))
-        assert parsed["EventID"] == 0
+        assert parsed["eventID"] == 0
         assert parsed["template"] == "hello there <*> kenobi"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, general R2D2!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "template not found"
 
     def test_reset_after_train(self):
@@ -54,15 +54,15 @@ def test_reset_after_train(self):
         parser = DrainParser(config=config_dict)
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, general kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, captain kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, sargent kenobi!"}))
-        assert parsed["EventID"] == 0
+        assert parsed["eventID"] == 0
         assert parsed["template"] == "hello there <*> kenobi"
 
         parser.update_state("keep_training")
@@ -70,7 +70,7 @@ def test_reset_after_train(self):
         parser.update_state("stop_training")
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, sargent kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "template not found"
 
     def test_not_reset_train(self):
@@ -89,15 +89,15 @@ def test_not_reset_train(self):
         parser = DrainParser(config=config_dict)
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, general kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, captain kenobi!"}))
-        assert parsed["EventID"] == -1
+        assert parsed["eventID"] == -1
         assert parsed["template"] == "templates not yet generated"
 
         parsed = parser.process(schemas.LogSchema({"log": "hello there, sargent kenobi!"}))
-        assert parsed["EventID"] == 0
+        assert parsed["eventID"] == 0
         assert parsed["template"] == "hello there <*> kenobi"
 
         parser.update_state("keep_training")
diff --git a/tests/test_parsers/test_json_parser.py b/tests/test_parsers/test_json_parser.py
index 35964071..73299688 100644
--- a/tests/test_parsers/test_json_parser.py
+++ b/tests/test_parsers/test_json_parser.py
@@ -63,13 +63,13 @@ def test_parse_json_without_message(self):
         # When no message field, template should be empty
         assert output.template == ""
         assert len(output.variables) == 0
-        assert output.EventID == 0
+        assert output.eventID == 0
 
         # But other fields should be present
-        assert "level" in output.logFormatVariables
-        assert output.logFormatVariables["level"] == "ERROR"
-        assert "error_code" in output.logFormatVariables
-        assert output.logFormatVariables["error_code"] == "404"
+        assert "level" in output.headerVariables
+        assert output.headerVariables["level"] == "ERROR"
+        assert "error_code" in output.headerVariables
+        assert output.headerVariables["error_code"] == "404"
 
     def test_parse_nested_json(self):
         """Test parsing nested JSON structure."""
@@ -96,11 +96,11 @@ def test_parse_nested_json(self):
         parser.parse(input_log, output)
 
         # Check flattened structure
-        assert "request.method" in output.logFormatVariables
-        assert output.logFormatVariables["request.method"] == "GET"
-        assert "request.path" in output.logFormatVariables
-        assert output.logFormatVariables["request.path"] == "/api/users"
-        assert "request.headers.content-type" in output.logFormatVariables
+        assert "request.method" in output.headerVariables
+        assert output.headerVariables["request.method"] == "GET"
+        assert "request.path" in output.headerVariables
+        assert output.headerVariables["request.path"] == "/api/users"
+        assert "request.headers.content-type" in output.headerVariables
 
     def test_parse_json_with_array(self):
         """Test parsing JSON with arrays."""
@@ -121,10 +121,10 @@ def test_parse_json_with_array(self):
         parser.parse(input_log, output)
 
         # Check array is flattened
-        assert "events.0" in output.logFormatVariables
-        assert output.logFormatVariables["events.0"] == "login"
-        assert "events.2" in output.logFormatVariables
-        assert output.logFormatVariables["events.2"] == "logout"
+        assert "events.0" in output.headerVariables
+        assert output.headerVariables["events.0"] == "login"
+        assert "events.2" in output.headerVariables
+        assert output.headerVariables["events.2"] == "logout"
 
     def test_parse_with_content_parser(self):
         """Test parsing with MatcherParser for message field."""
@@ -162,7 +162,7 @@ def test_parse_with_content_parser(self):
         # The content parser should have parsed the message
         assert output.template != ""
         assert len(output.variables) > 0
-        assert "level" in output.logFormatVariables
+        assert "level" in output.headerVariables
 
     def test_custom_field_names(self):
         """Test with custom timestamp and message field names."""
@@ -182,11 +182,11 @@ def test_custom_field_names(self):
         output = schemas.ParserSchema()
         parser.parse(input_log, output)
 
-        # Timestamp should be extracted and Time should be in logFormatVariables
-        assert "Time" in output.logFormatVariables
-        assert "severity" in output.logFormatVariables
+        # Timestamp should be extracted and Time should be in headerVariables
+        assert "Time" in output.headerVariables
+        assert "severity" in output.headerVariables
         # timestamp key should not appear in flattened dict (deleted after extraction)
-        assert "timestamp" not in output.logFormatVariables
+        assert "timestamp" not in output.headerVariables
 
     def test_process_method(self):
         """Test the full process method."""
@@ -207,6 +207,6 @@ def test_process_method(self):
         result = parser.process(input_log)
 
         assert isinstance(result, schemas.ParserSchema)
-        assert "Time" in result.logFormatVariables
-        assert "status" in result.logFormatVariables
-        assert result.logFormatVariables["status"] == "ok"
+        assert "Time" in result.headerVariables
+        assert "status" in result.headerVariables
+        assert result.headerVariables["status"] == "ok"
diff --git a/tests/test_parsers/test_logbatcher_parser.py b/tests/test_parsers/test_logbatcher_parser.py
index 79aa5df2..2f289e73 100644
--- a/tests/test_parsers/test_logbatcher_parser.py
+++ b/tests/test_parsers/test_logbatcher_parser.py
@@ -66,7 +66,7 @@ def test_event_id_is_int(self):
 
         result = parser.process(log_schema)
 
-        assert isinstance(result["EventID"], int)
+        assert isinstance(result["eventID"], int)
 
     def test_second_call_hits_cache(self):
         """Second identical log must not trigger a new LLM call."""
diff --git a/tests/test_parsers/test_template_matcher.py b/tests/test_parsers/test_template_matcher.py
index 3efeceb3..abe5b1ea 100644
--- a/tests/test_parsers/test_template_matcher.py
+++ b/tests/test_parsers/test_template_matcher.py
@@ -28,7 +28,7 @@ def test_no_path_templates(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == "<Not Found>"
-        assert output_data.EventID == -1
+        assert output_data.eventID == -1
         assert output_data.variables == []
 
     def test_templates_not_found(self):
@@ -60,7 +60,7 @@ def test_successful_match(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == test_template[0]
-        assert output_data.EventID == 0
+        assert output_data.eventID == 0
         assert len(output_data.variables) > 0
 
     def test_no_match(self):
@@ -79,7 +79,7 @@ def test_no_match(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == "<Not Found>"
-        assert output_data.EventID == -1
+        assert output_data.eventID == -1
         assert output_data.variables == []
 
     def test_custom_preprocessing_flags(self):
@@ -147,7 +147,7 @@ def test_match_produces_correct_variables(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == self.named_template_compiled
-        assert output_data.EventID == 0
+        assert output_data.eventID == 0
         assert len(output_data.variables) == 6
 
     def test_compile_resolves_named_positions(self):
@@ -200,7 +200,7 @@ def test_match_produces_correct_variables(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == self.named_template_compiled
-        assert output_data.EventID == 0
+        assert output_data.eventID == 0
         assert len(output_data.variables) == 6
 
     def test_compile_resolves_named_event_key(self):
diff --git a/tests/test_parsers/test_tree_matcher.py b/tests/test_parsers/test_tree_matcher.py
index ca3d1515..21c8c153 100644
--- a/tests/test_parsers/test_tree_matcher.py
+++ b/tests/test_parsers/test_tree_matcher.py
@@ -26,7 +26,7 @@ def test_no_path_templates(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == "template not found"
-        assert output_data.EventID == -1
+        assert output_data.eventID == -1
         assert output_data.variables == []
 
     def test_successful_match(self):
@@ -44,5 +44,5 @@ def test_successful_match(self):
         parser.parse(input_log, output_data)
 
         assert output_data.template == test_template[0]
-        assert output_data.EventID == 0
+        assert output_data.eventID == 0
         assert len(output_data.variables) > 0
diff --git a/tests/test_persistency/test_time_dependent_stability.py b/tests/test_persistency/test_time_dependent_stability.py
index 0e2ce703..3c8ad7cf 100644
--- a/tests/test_persistency/test_time_dependent_stability.py
+++ b/tests/test_persistency/test_time_dependent_stability.py
@@ -388,14 +388,14 @@ def test_event_tracker_detector_backed_round_trip(self):
 def _parser_record(ts_value, event_id=1):
     return schemas.ParserSchema({
         "parserType": "test",
-        "EventID": event_id,
+        "eventID": event_id,
         "template": "test template",
         "variables": ["abc"],
         "logID": "1",
         "parsedLogID": "1",
         "parserID": "test_parser",
         "log": "test log message",
-        "logFormatVariables": {"ts": ts_value},
+        "headerVariables": {"ts": ts_value},
     })
 
 
diff --git a/tests/test_pipelines/test_bad_players.py b/tests/test_pipelines/test_bad_players.py
index 279d7c90..2bfdec68 100644
--- a/tests/test_pipelines/test_bad_players.py
+++ b/tests/test_pipelines/test_bad_players.py
@@ -28,10 +28,10 @@ class MockupBadParser(CoreParser):
     def parse(self, input_, output_):
         input_.log = "This message was change!"
 
-        output_.EventID = 1
+        output_.eventID = 1
         output_.template = "hello"
         output_.variables.extend(["a", "b"])
-        output_.logFormatVariables["timestamp"] = "1"
+        output_.headerVariables["timestamp"] = "1"
 
 
 class MockupDetector(CoreDetector):
diff --git a/tests/test_pipelines/test_basic_pipelines.py b/tests/test_pipelines/test_basic_pipelines.py
index 53d95d70..83eb67fa 100644
--- a/tests/test_pipelines/test_basic_pipelines.py
+++ b/tests/test_pipelines/test_basic_pipelines.py
@@ -11,7 +11,7 @@
 
 class MockupParser(CoreParser):
     def parse(self, input_, output_):
-        output_.EventID = 1
+        output_.eventID = 1
         output_.template = "hello"
         output_.variables.extend(["a", "b"])
 
diff --git a/tests/test_pipelines/test_dummy_methods.py b/tests/test_pipelines/test_dummy_methods.py
index c8f2b333..13db8128 100644
--- a/tests/test_pipelines/test_dummy_methods.py
+++ b/tests/test_pipelines/test_dummy_methods.py
@@ -40,10 +40,10 @@ def test_run_detect_method(self) -> None:
         assert output.description == "Dummy detection process"
         if result:
             assert output.score == 1.0
-            assert "Anomaly detected by DummyDetector" in output.alertsObtain["type"]
+            assert "Anomaly detected by DummyDetector" in output.alertDetails["type"]
         else:
             assert output.score == 0.0
-            assert len(output.alertsObtain) == 0
+            assert len(output.alertDetails) == 0
 
     def test_parser_initialize_default(self) -> None:
         parser = DummyParser(name="DummyParser", config=default_args)
diff --git a/tests/test_schemas/test_default_values.py b/tests/test_schemas/test_default_values.py
index e08b7cd1..d6c7dd64 100644
--- a/tests/test_schemas/test_default_values.py
+++ b/tests/test_schemas/test_default_values.py
@@ -14,13 +14,13 @@ def test_initialize_parser_schema(self) -> None:
         values = {
             "parserType": "test",
             "parserID": "test",
-            "EventID": 0,
+            "eventID": 0,
             "template": "test template",
             "variables": ["a", "b"],
             "parsedLogID": "0",
             "logID": "0",
             "log": "test log",
-            "logFormatVariables": {"TimeStamp": "test timestamp"},
+            "headerVariables": {"TimeStamp": "test timestamp"},
             "receivedTimestamp": 0,
             "parsedTimestamp": 0,
         }
@@ -32,10 +32,10 @@ def test_initialize_detector_schema(self) -> None:
             "detectorID": "test id",
             "detectorType": "type test",
             "alertID": "0",
-            "detectionTimestamp": 0,
+            "detectedTimestamp": 0,
             "logIDs": ["0", "0", "0"],
             "score": 0.0,
-            "extractedTimestamps": [0, 0, 0],
+            "logTimestamps": [0, 0, 0],
             "description": "",
             "receivedTimestamp": 0,
         }
@@ -46,7 +46,7 @@ def test_initialize_parser_schema_empty_list_dict(self) -> None:
         values = {
             "parserType": "test",
             "parserID": "test",
-            "EventID": 0,
+            "eventID": 0,
             "template": "test template",
             "parsedLogID": "0",
             "logID": "0",
@@ -57,5 +57,5 @@ def test_initialize_parser_schema_empty_list_dict(self) -> None:
         schema = op_schemas.initialize(op_schemas.PARSER_SCHEMA, **values)
         op_schemas.check_if_schema_is_complete(schema)
 
-        assert len(schema.logFormatVariables) == 0
+        assert len(schema.headerVariables) == 0
         assert len(schema.variables) == 0
diff --git a/tests/test_schemas/test_field_rename.py b/tests/test_schemas/test_field_rename.py
new file mode 100644
index 00000000..389a499a
--- /dev/null
+++ b/tests/test_schemas/test_field_rename.py
@@ -0,0 +1,234 @@
+"""Tests for the schema field rename (schema version 1.0.0 -> 2.0.0).
+
+The rename changes field names only. Field numbers and types stay, so
+messages serialized with schema 1.0.0 still deserialize, and the old
+names fail loudly instead of being ignored.
+"""
+from detectmatelibrary.detectors.new_value_detector import NewValueDetector
+from detectmatelibrary._testutils.dummy_parser import DummyParser
+from detectmatelibrary.helper.from_to import From
+from detectmatelibrary.schemas import (
+    AggregateSchema, DetectorSchema, FieldNotFound, LogSchema, ParserSchema, schemas_pb2
+)
+
+import json
+
+import pytest
+
+
+# Field name -> field number. The numbers are the wire format and must not change.
+EXPECTED_FIELDS = {
+    "Schema": {"schemaVersion": 1},
+    "LogSchema": {
+        "schemaVersion": 1, "logID": 2, "log": 3, "logSource": 4, "hostname": 5,
+    },
+    "ParserSchema": {
+        "schemaVersion": 1, "parserType": 2, "parserID": 3, "eventID": 4, "template": 5,
+        "variables": 6, "parsedLogID": 7, "logID": 8, "log": 9, "headerVariables": 10,
+        "receivedTimestamp": 11, "parsedTimestamp": 12,
+    },
+    "DetectorSchema": {
+        "schemaVersion": 1, "detectorID": 2, "detectorType": 3, "alertID": 4,
+        "detectedTimestamp": 5, "logIDs": 6, "score": 8, "logTimestamps": 9,
+        "description": 10, "receivedTimestamp": 11, "alertDetails": 12,
+    },
+    "AggregateSchema": {
+        "schemaVersion": 1, "detectorIDs": 2, "detectorTypes": 3, "alertIDs": 4,
+        "aggregatedTimestamp": 5, "logIDs": 6, "logTimestamps": 9, "description": 10,
+        "alertDetails": 12,
+    },
+}
+
+SCHEMA_CLASSES = [LogSchema, ParserSchema, DetectorSchema, AggregateSchema]
+
+# Every old field name, on each schema that had it.
+OLD_FIELDS = [
+    (LogSchema, "__version__"),
+    (ParserSchema, "__version__"),
+    (ParserSchema, "EventID"),
+    (ParserSchema, "logFormatVariables"),
+    (DetectorSchema, "__version__"),
+    (DetectorSchema, "alertsObtain"),
+    (DetectorSchema, "extractedTimestamps"),
+    (DetectorSchema, "detectionTimestamp"),
+    (AggregateSchema, "__version__"),
+    (AggregateSchema, "alertsObtain"),
+    (AggregateSchema, "extractedTimestamps"),
+    (AggregateSchema, "outputTimestamp"),
+]
+
+# Messages serialized with schema 1.0.0, before the rename.
+V1_LOG = bytes.fromhex(
+    "0a05312e302e301201331a147573657220616c696365206c6f6767656420696e2208617574682e6c6f67"
+    "2a06686f73742d31"
+)
+V1_PARSER = bytes.fromhex(
+    "0a05312e302e3012076d6174636865721a087061727365722d6120072a1275736572203c2a3e206c6f67"
+    "67656420696e3205616c6963653a0231314201334a147573657220616c696365206c6f6767656420696e"
+    "520d0a054c6576656c1204494e464f52120a0454696d65120a313730303030303030305881e2cfaa0660"
+    "82e2cfaa06"
+)
+V1_DETECTOR = bytes.fromhex(
+    "0a05312e302e3012056465742d611a096e65775f76616c75652201352883e2cfaa06320133450000803f"
+    "4a0580e2cfaa0652096e65772076616c75655882e2cfaa06622a0a104576656e7449442037202d207573"
+    "65721216556e6b6e6f776e2076616c75653a2027616c69636527"
+)
+V1_AGGREGATE = bytes.fromhex(
+    "0a05312e302e3012056465742d611a096e65775f76616c75652201352884e2cfaa063201334a0580e2cf"
+    "aa065203616767622a0a104576656e7449442037202d20757365721216556e6b6e6f776e2076616c7565"
+    "3a2027616c69636527"
+)
+
+ALERT = {"EventID 7 - user": "Unknown value: 'alice'"}
+
+ALERT_KEY_CONFIG = {
+    "detectors": {
+        "KeyDetector": {
+            "method_type": "new_value_detector",
+            "auto_config": False,
+            "params": {},
+            "events": {
+                7: {
+                    "instance": {
+                        "params": {},
+                        "variables": [{"pos": 0, "name": "user", "params": {}}],
+                    }
+                }
+            }
+        }
+    }
+}
+
+
+def parsed_log(user: str, log_id: str) -> ParserSchema:
+    return ParserSchema({
+        "parserType": "test",
+        "parserID": "test_parser",
+        "eventID": 7,
+        "template": "user <*> logged in",
+        "variables": [user],
+        "logID": log_id,
+        "parsedLogID": log_id,
+        "log": f"user {user} logged in",
+    })
+
+
+class TestFieldNames:
+    @pytest.mark.parametrize("message", list(EXPECTED_FIELDS))
+    def test_names_and_numbers(self, message):
+        fields = getattr(schemas_pb2, message).DESCRIPTOR.fields
+
+        assert {field.name: field.number for field in fields} == EXPECTED_FIELDS[message]
+
+    @pytest.mark.parametrize("schema_class", SCHEMA_CLASSES)
+    def test_new_instance_reports_version_2(self, schema_class):
+        schema = schema_class()
+
+        assert schema.schemaVersion == "2.0.0"
+        assert schema["schemaVersion"] == "2.0.0"
+
+
+@pytest.mark.parametrize("schema_class, old_name", OLD_FIELDS)
+class TestOldNamesFail:
+    def test_constructor(self, schema_class, old_name):
+        with pytest.raises(ValueError, match=old_name):
+            schema_class({old_name: "1"})
+
+    def test_subscript_read(self, schema_class, old_name):
+        with pytest.raises(FieldNotFound):
+            schema_class()[old_name]
+
+    def test_subscript_write(self, schema_class, old_name):
+        with pytest.raises(FieldNotFound):
+            schema_class()[old_name] = "1"
+
+    def test_attribute_read(self, schema_class, old_name):
+        with pytest.raises(AttributeError):
+            getattr(schema_class(), old_name)
+
+
+class TestSchemaV1Bytes:
+    def test_log(self):
+        schema = LogSchema()
+        schema.deserialize(V1_LOG)
+
+        assert schema.schemaVersion == "1.0.0"
+        assert schema.logID == "3"
+        assert schema.log == "user alice logged in"
+        assert schema.logSource == "auth.log"
+        assert schema.hostname == "host-1"
+
+    def test_parser(self):
+        schema = ParserSchema()
+        schema.deserialize(V1_PARSER)
+
+        assert schema.schemaVersion == "1.0.0"
+        assert schema.parserType == "matcher"
+        assert schema.parserID == "parser-a"
+        assert schema.eventID == 7
+        assert schema.template == "user <*> logged in"
+        assert list(schema.variables) == ["alice"]
+        assert schema.parsedLogID == "11"
+        assert schema.logID == "3"
+        assert schema.log == "user alice logged in"
+        assert dict(schema.headerVariables) == {"Time": "1700000000", "Level": "INFO"}
+        assert schema.receivedTimestamp == 1700000001
+        assert schema.parsedTimestamp == 1700000002
+
+    def test_detector(self):
+        schema = DetectorSchema()
+        schema.deserialize(V1_DETECTOR)
+
+        assert schema.schemaVersion == "1.0.0"
+        assert schema.detectorID == "det-a"
+        assert schema.detectorType == "new_value"
+        assert schema.alertID == "5"
+        assert schema.detectedTimestamp == 1700000003
+        assert list(schema.logIDs) == ["3"]
+        assert schema.score == 1.0
+        assert list(schema.logTimestamps) == [1700000000]
+        assert schema.description == "new value"
+        assert schema.receivedTimestamp == 1700000002
+        assert dict(schema.alertDetails) == ALERT
+
+    def test_aggregate(self):
+        schema = AggregateSchema()
+        schema.deserialize(V1_AGGREGATE)
+
+        assert schema.schemaVersion == "1.0.0"
+        assert list(schema.detectorIDs) == ["det-a"]
+        assert list(schema.detectorTypes) == ["new_value"]
+        assert list(schema.alertIDs) == ["5"]
+        assert schema.aggregatedTimestamp == 1700000004
+        assert list(schema.logIDs) == ["3"]
+        assert list(schema.logTimestamps) == [1700000000]
+        assert schema.description == "agg"
+        assert dict(schema.alertDetails) == ALERT
+
+
+class TestStoredJson:
+    def test_old_names_are_rejected(self, tmp_path):
+        path = tmp_path / "old.json"
+        path.write_text(json.dumps({"0": {"__version__": "1.0.0", "logID": "3", "log": "a log"}}))
+
+        with pytest.raises(ValueError, match="__version__"):
+            next(From.json(DummyParser(), str(path), do_process=False))
+
+    def test_new_names_load(self, tmp_path):
+        path = tmp_path / "new.json"
+        path.write_text(json.dumps({"0": {"schemaVersion": "2.0.0", "logID": "3", "log": "a log"}}))
+
+        schema = next(From.json(DummyParser(), str(path), do_process=False))
+
+        assert schema.logID == "3"
+        assert schema.log == "a log"
+
+
+class TestAlertKeysUnchanged:
+    def test_new_value_detector_keeps_its_alert_key(self):
+        detector = NewValueDetector(config=ALERT_KEY_CONFIG, name="KeyDetector")
+        detector.train(parsed_log("bob", log_id="1"))
+        output = DetectorSchema()
+
+        assert detector.detect(parsed_log("alice", log_id="2"), output)
+        assert dict(output["alertDetails"]) == ALERT
diff --git a/tests/test_schemas/test_ops.py b/tests/test_schemas/test_ops.py
index 6bd6b9d9..44250b2b 100644
--- a/tests/test_schemas/test_ops.py
+++ b/tests/test_schemas/test_ops.py
@@ -7,7 +7,7 @@ class TestCaseSchemas:
     def test_initialize_basic(self):
         schema = op_schemas.initialize(op_schemas.BASE_SCHEMA, **{})
 
-        assert schema.__version__ == "1.0.0"
+        assert schema.schemaVersion == "2.0.0"
 
     def test_initialize_log_schema(self) -> None:
         values = {
@@ -15,7 +15,7 @@ def test_initialize_log_schema(self) -> None:
         }
         schema = op_schemas.initialize(op_schemas.LOG_SCHEMA, **values)
 
-        assert schema.__version__ == "1.0.0"
+        assert schema.schemaVersion == "2.0.0"
         assert schema.logID == "1"
         assert schema.log == "test"
         assert schema.logSource == "example"
@@ -25,70 +25,70 @@ def test_initialize_parser_schema(self) -> None:
         values = {
             "parserType": "test",
             "parserID": "test",
-            "EventID": 5,
+            "eventID": 5,
             "template": "test template",
             "variables": ["a", "b"],
             "parsedLogID": "2",
             "logID": "4",
             "log": "test log",
-            "logFormatVariables": {"TimeStamp": "test timestamp"}
+            "headerVariables": {"TimeStamp": "test timestamp"}
         }
         schema = op_schemas.initialize(op_schemas.PARSER_SCHEMA, **values)
 
-        assert schema.__version__ == "1.0.0"
-        assert schema.EventID == 5
+        assert schema.schemaVersion == "2.0.0"
+        assert schema.eventID == 5
         assert schema.template == "test template"
         assert schema.variables == ["a", "b"]
         assert schema.parserID == "test"
         assert schema.logID == "4"
         assert schema.parsedLogID == "2"
         assert schema.log == "test log"
-        assert schema.logFormatVariables == {"TimeStamp": "test timestamp"}
+        assert schema.headerVariables == {"TimeStamp": "test timestamp"}
 
     def test_initialize_detector_schema(self) -> None:
         values = {
             "detectorID": "test id",
             "detectorType": "type test",
             "alertID": "1",
-            "detectionTimestamp": 2,
+            "detectedTimestamp": 2,
             "logIDs": ["1", "2", "3"],
             "score": 0.5,
-            "extractedTimestamps": [4, 5, 6]
+            "logTimestamps": [4, 5, 6]
         }
         schema = op_schemas.initialize(op_schemas.DETECTOR_SCHEMA, **values)
 
-        assert schema.__version__ == "1.0.0"
+        assert schema.schemaVersion == "2.0.0"
         assert schema.detectorID == "test id"
         assert schema.detectorType == "type test"
         assert schema.alertID == "1"
-        assert schema.detectionTimestamp == 2
+        assert schema.detectedTimestamp == 2
         assert schema.logIDs == ["1", "2", "3"]
         assert schema.score == 0.5
-        assert schema.extractedTimestamps == [4, 5, 6]
+        assert schema.logTimestamps == [4, 5, 6]
 
     def test_initialize_output_schema(self) -> None:
         values = {
             "detectorIDs": ["test id", "another id"],
             "detectorTypes": ["type test", "another type"],
             "alertIDs": ["1", "2"],
-            "outputTimestamp": 2,
+            "aggregatedTimestamp": 2,
             "logIDs": ["1", "2", "3"],
-            "extractedTimestamps": [4, 5, 6],
+            "logTimestamps": [4, 5, 6],
             "description": "test description",
-            "alertsObtain": {"key": "value"}
+            "alertDetails": {"key": "value"}
         }
         schema = op_schemas.initialize(op_schemas.AGGREGATE_SCHEMA, **values)
 
-        assert schema.__version__ == "1.0.0"
+        assert schema.schemaVersion == "2.0.0"
         assert schema.detectorIDs == ["test id", "another id"]
         assert schema.detectorTypes == ["type test", "another type"]
         assert schema.alertIDs == ["1", "2"]
-        assert schema.outputTimestamp == 2
+        assert schema.aggregatedTimestamp == 2
         assert schema.logIDs == ["1", "2", "3"]
-        assert schema.extractedTimestamps == [4, 5, 6]
+        assert schema.logTimestamps == [4, 5, 6]
         assert schema.description == "test description"
-        assert schema.alertsObtain == {"key": "value"}
-        assert schema.extractedTimestamps == [4, 5, 6]
+        assert schema.alertDetails == {"key": "value"}
+        assert schema.logTimestamps == [4, 5, 6]
 
     def test_copy(self) -> None:
         values = {
@@ -118,7 +118,7 @@ def test_serialize_method(self) -> None:
 
         new_schema = op_schemas.deserialize(op_schemas.LOG_SCHEMA, bschema)
 
-        assert new_schema.__version__ == "1.0.0"
+        assert new_schema.schemaVersion == "2.0.0"
         assert new_schema.logID == "1"
         assert new_schema.log == "test"
         assert new_schema.logSource == "example"
@@ -147,7 +147,7 @@ def test_get_variables(self) -> None:
         }
         schema = op_schemas.initialize(op_schemas.LOG_SCHEMA, **values)
         vars = op_schemas.get_variables_names(schema)
-        expected_vars = ["logID", "log", "logSource", "hostname", "__version__"]
+        expected_vars = ["logID", "log", "logSource", "hostname", "schemaVersion"]
 
         assert set(vars) == set(expected_vars), f"{vars}"
         assert len(vars) == len(expected_vars), f"{vars}"
@@ -157,14 +157,14 @@ def test_is_repeated(self) -> None:
             "detectorID": "test id",
             "detectorType": "type test",
             "alertID": "1",
-            "detectionTimestamp": 2,
+            "detectedTimestamp": 2,
             "logIDs": ["1", "2", "3"],
             "score": 0.5,
-            "extractedTimestamps": [4, 5, 6]
+            "logTimestamps": [4, 5, 6]
         }
         schema = op_schemas.initialize(op_schemas.DETECTOR_SCHEMA, **values)
 
         assert not op_schemas.is_repeated(schema, "detectorID")
         assert not op_schemas.is_repeated(schema, "score")
         assert op_schemas.is_repeated(schema, "logIDs")
-        assert op_schemas.is_repeated(schema, "extractedTimestamps")
+        assert op_schemas.is_repeated(schema, "logTimestamps")
diff --git a/tests/test_schemas/test_schema_class.py b/tests/test_schemas/test_schema_class.py
index e809100b..bc448855 100644
--- a/tests/test_schemas/test_schema_class.py
+++ b/tests/test_schemas/test_schema_class.py
@@ -13,18 +13,18 @@ def test_basic_init(self):
         schema_var = SchemaVariables(schema_class=PARSER_SCHEMA)
 
         assert schema_var.schema_class == PARSER_SCHEMA
-        assert schema_var.get_schema().__version__ == "1.0.0"
+        assert schema_var.get_schema().schemaVersion == "2.0.0"
 
     def test_init_with_kwargs(self):
         values = {
             "parserType": "test",
             "parserID": "test",
-            "EventID": 0,
+            "eventID": 0,
             "template": "test template",
             "variables": ["a", "b"],
             "parsedLogID": "0",
             "log": "test log",
-            "logFormatVariables": {"TimeStamp": "test timestamp"},
+            "headerVariables": {"TimeStamp": "test timestamp"},
             "receivedTimestamp": 0,
             "parsedTimestamp": 0,
         }
@@ -33,13 +33,13 @@ def test_init_with_kwargs(self):
 
         assert schema_var.parserType == "test"
         assert schema_var.parserID == "test"
-        assert schema_var.EventID == 0
+        assert schema_var.eventID == 0
         assert schema_var.template == "test template"
         assert schema_var.variables == ["a", "b"]
         assert schema_var.parsedLogID == "0"
         assert schema_var.logID == "0"
         assert schema_var.log == "test log"
-        assert schema_var.logFormatVariables == {"TimeStamp": "test timestamp"}
+        assert schema_var.headerVariables == {"TimeStamp": "test timestamp"}
         assert schema_var.receivedTimestamp == 0
         assert schema_var.parsedTimestamp == 0
 
@@ -67,7 +67,7 @@ def test_basic_init(self):
         base_schema = BaseSchema()
 
         assert base_schema.schema_class == BASE_SCHEMA
-        assert base_schema.get_schema().__version__ == "1.0.0"
+        assert base_schema.get_schema().schemaVersion == "2.0.0"
 
     def test_all_initialize(self):
         LogSchema()
@@ -151,15 +151,15 @@ def test_is_field_list(self):
     def test_as_dict(self):
         detector_schema = DetectorSchema()
         assert detector_schema.as_dict() == {
-            "__version__": "1.0.0",
+            "schemaVersion": "2.0.0",
             "detectorID": detector_schema.detectorID,
             "detectorType": detector_schema.detectorType,
             "alertID": detector_schema.alertID,
-            "detectionTimestamp": detector_schema.detectionTimestamp,
+            "detectedTimestamp": detector_schema.detectedTimestamp,
             "logIDs": detector_schema.logIDs,
             "score": detector_schema.score,
-            "extractedTimestamps": detector_schema.extractedTimestamps,
+            "logTimestamps": detector_schema.logTimestamps,
             "description": detector_schema.description,
             "receivedTimestamp": detector_schema.receivedTimestamp,
-            "alertsObtain": detector_schema.alertsObtain,
+            "alertDetails": detector_schema.alertDetails,
         }

From 2a07b8bc8d9646293c3607b701b0ba8aacd7c786 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 13 Oct 2026 10:16:16 +0200
Subject: [PATCH 17/86] first counter version

---
 .../alert_aggregation/logid_count.py          | 78 +++++++++++++++++++
 .../test_logid_count.py                       | 15 ++++
 2 files changed, 93 insertions(+)
 create mode 100644 src/detectmatelibrary/alert_aggregation/logid_count.py
 create mode 100644 tests/test_alert_aggregators/test_logid_count.py

diff --git a/src/detectmatelibrary/alert_aggregation/logid_count.py b/src/detectmatelibrary/alert_aggregation/logid_count.py
new file mode 100644
index 00000000..09035959
--- /dev/null
+++ b/src/detectmatelibrary/alert_aggregation/logid_count.py
@@ -0,0 +1,78 @@
+from detectmatelibrary.common.alert_aggregator import (
+    CoreAlertAggregatorConfig, CoreAlertAggregator
+)
+
+from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
+from detectmatelibrary.utils.data_buffer import BufferMode
+
+from typing import Any, Optional
+from functools import lru_cache
+import polars as pl
+
+
+class Counter:
+    def __init__(self, max_count: int, overall_size: int) -> None:
+        self.max_count = max_count
+        
+        self._df = pl.DataFrame()
+        self._df = self._df.insert_column(0, pl.repeat("", n=overall_size).alias("LogID"))
+        self._df = self._df.insert_column(1, pl.zeros(overall_size, dtype=pl.UInt8).alias("Count"))
+        self._df = self._df.insert_column(2, pl.zeros(overall_size, dtype=pl.Boolean).alias("WasAlert"))
+        self._df = self._df.with_row_index(name="Index")
+
+        self.idx = 0
+
+    def __is_new_alert(self, idx: int) -> bool:
+        if not self._df[idx, "WasAlert"] and self._df[idx, "Count"] >= self.max_count:
+            self._df[idx, "WasAlert"] = True
+            return True
+        return False
+
+    @lru_cache(maxsize=32)
+    def __get_idx(self, logId: str) -> int:
+        indices = self._df.filter(pl.col("LogID") == logId).select("Index").to_series()
+
+        if indices.shape[0] == 0:
+            new_row = pl.DataFrame(
+                data=[[self.idx, logId, 0, False]], schema=self._df.schema, orient="row"
+            )
+            self._df = self._df.update(new_row, on="Index")
+            idx = self.idx
+            self.idx += 1
+        else:
+            idx = indices[0]
+
+        return idx
+
+    def add_and_check(self, logId: str) -> bool:
+        idx = self.__get_idx(logId)
+        self._df[idx, "Count"] += 1
+
+        return self.__is_new_alert(idx)
+
+
+class LogIDCountAggegationConfig(CoreAlertAggregatorConfig):
+    method_type: str = "logid_count_aggregator"
+    max_count: int = 3
+
+
+class LogIDCountAggegation(CoreAlertAggregator):
+    def __init__(
+        self,
+        name: str = "LogIDCountAggregator",
+        config: Optional[LogIDCountAggegationConfig | dict[str, Any]] = LogIDCountAggegationConfig(),
+    ) -> None:
+        if isinstance(config, dict):
+            config = LogIDCountAggegationConfig.from_dict(config, name)
+
+        super().__init__(name=name, config=config, buffer_mode=BufferMode.NO_BUF)
+        self.config: LogIDCountAggegationConfig
+
+        self.counter = Counter(max_count=self.config.max_count)
+
+    def aggregate_alerts(
+        self, input_: DetectorSchema, output_: AggregateSchema  # type: ignore
+    ) -> bool:
+
+        output_["description"] = "Basic aggregation by alert concatenation"
+        return True
diff --git a/tests/test_alert_aggregators/test_logid_count.py b/tests/test_alert_aggregators/test_logid_count.py
new file mode 100644
index 00000000..1eb4463c
--- /dev/null
+++ b/tests/test_alert_aggregators/test_logid_count.py
@@ -0,0 +1,15 @@
+
+from detectmatelibrary.alert_aggregation.logid_count import Counter
+
+
+class TestCounter:
+    def test_basic_count(self) -> None:
+        counter = Counter(max_count=2, overall_size=10)
+
+        assert not counter.add_and_check("a")
+        assert not counter.add_and_check("b")
+        assert counter.add_and_check("a")
+        assert counter.add_and_check("b")
+
+        assert not counter.add_and_check("a")  # should not generate new ones
+        assert not counter.add_and_check("b")  # should not generate new ones
\ No newline at end of file

From a7eb0ef826551c3b029b22a10e0cedf55d9a3116 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 13 Oct 2026 10:32:49 +0200
Subject: [PATCH 18/86] add memory limits

---
 .../alert_aggregation/logid_count.py            |  8 ++++----
 .../test_alert_aggregators/test_logid_count.py  | 17 ++++++++++++++++-
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/src/detectmatelibrary/alert_aggregation/logid_count.py b/src/detectmatelibrary/alert_aggregation/logid_count.py
index 09035959..dd76d419 100644
--- a/src/detectmatelibrary/alert_aggregation/logid_count.py
+++ b/src/detectmatelibrary/alert_aggregation/logid_count.py
@@ -20,6 +20,8 @@ def __init__(self, max_count: int, overall_size: int) -> None:
         self._df = self._df.insert_column(2, pl.zeros(overall_size, dtype=pl.Boolean).alias("WasAlert"))
         self._df = self._df.with_row_index(name="Index")
 
+        self._cached_search = lru_cache(maxsize=overall_size)(self.__get_idx)
+
         self.idx = 0
 
     def __is_new_alert(self, idx: int) -> bool:
@@ -28,7 +30,6 @@ def __is_new_alert(self, idx: int) -> bool:
             return True
         return False
 
-    @lru_cache(maxsize=32)
     def __get_idx(self, logId: str) -> int:
         indices = self._df.filter(pl.col("LogID") == logId).select("Index").to_series()
 
@@ -38,16 +39,15 @@ def __get_idx(self, logId: str) -> int:
             )
             self._df = self._df.update(new_row, on="Index")
             idx = self.idx
-            self.idx += 1
+            self.idx = self.idx + 1 if self.idx < self._df.shape[0] - 1 else 0
         else:
             idx = indices[0]
 
         return idx
 
     def add_and_check(self, logId: str) -> bool:
-        idx = self.__get_idx(logId)
+        idx = self._cached_search(logId)
         self._df[idx, "Count"] += 1
-
         return self.__is_new_alert(idx)
 
 
diff --git a/tests/test_alert_aggregators/test_logid_count.py b/tests/test_alert_aggregators/test_logid_count.py
index 1eb4463c..686f3b57 100644
--- a/tests/test_alert_aggregators/test_logid_count.py
+++ b/tests/test_alert_aggregators/test_logid_count.py
@@ -12,4 +12,19 @@ def test_basic_count(self) -> None:
         assert counter.add_and_check("b")
 
         assert not counter.add_and_check("a")  # should not generate new ones
-        assert not counter.add_and_check("b")  # should not generate new ones
\ No newline at end of file
+        assert not counter.add_and_check("b")  # should not generate new ones
+
+    def test_surpass_memory(self) -> None:
+        counter = Counter(max_count=2, overall_size=2)
+
+        assert not counter.add_and_check("a")
+        assert not counter.add_and_check("b")
+        assert not counter.add_and_check("c")
+
+        assert counter.add_and_check("b")
+        assert not counter.add_and_check("a")  # was rename by c 
+        assert counter.add_and_check("c")
+        assert counter.add_and_check("a")  
+
+        assert not counter.add_and_check("a")  # should not generate new ones
+        assert not counter.add_and_check("c")  # should not generate new ones
\ No newline at end of file

From 21cbcee33d063021727e6d12fef8a069096d3e95 Mon Sep 17 00:00:00 2001
From: thorinaboenke <thorina-boenke@web.de>
Date: Tue, 13 Oct 2026 11:03:42 +0200
Subject: [PATCH 19/86] move wording to description

---
 docs/alert_aggregators/basic_concatenation.md          |  4 ++--
 docs/detectors.md                                      |  4 ++--
 docs/detectors/bigram_frequency.md                     | 10 +++++-----
 docs/detectors/charset.md                              | 10 +++++-----
 docs/detectors/combo.md                                | 10 +++++-----
 docs/detectors/deeplog.md                              |  6 +++---
 docs/detectors/ecvc_detector.md                        | 10 +++++-----
 docs/detectors/event_sequence.md                       | 10 +++++-----
 docs/detectors/logbert.md                              |  6 +++---
 docs/detectors/new_event.md                            | 10 +++++-----
 docs/detectors/new_value.md                            | 10 +++++-----
 docs/detectors/random_detector.md                      |  6 +++---
 docs/detectors/rule_based.md                           |  6 +++---
 docs/detectors/scvs_detector.md                        | 10 +++++-----
 docs/detectors/value_range.md                          | 10 +++++-----
 docs/parsers.md                                        |  4 ++--
 docs/parsers/auto_parser.md                            |  4 ++--
 docs/parsers/drain_parser.md                           |  4 ++--
 docs/parsers/json_parser.md                            |  4 ++--
 docs/parsers/logbatcher_parser.md                      |  4 ++--
 docs/parsers/template_matcher.md                       |  4 ++--
 docs/parsers/template_tree_matcher.md                  |  4 ++--
 .../base_detectors/tracker_detector.py                 |  4 ++--
 src/detectmatelibrary/common/core.py                   |  4 ++--
 src/detectmatelibrary/common/detector.py               |  5 ++++-
 25 files changed, 83 insertions(+), 80 deletions(-)

diff --git a/docs/alert_aggregators/basic_concatenation.md b/docs/alert_aggregators/basic_concatenation.md
index 22554668..6ef41468 100644
--- a/docs/alert_aggregators/basic_concatenation.md
+++ b/docs/alert_aggregators/basic_concatenation.md
@@ -54,8 +54,8 @@ All parameters this alert aggregator accepts, grouped by the YAML block they go
     |---|---|---|---|---|
     | `buffer_size` | integer | 3 | specific | Number of most recent alerts aggregated together (size of the sliding window). |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/detectors.md b/docs/detectors.md
index 04a77388..b72de785 100644
--- a/docs/detectors.md
+++ b/docs/detectors.md
@@ -207,13 +207,13 @@ The detectors that keep their model in persistency stores ([New Event](detectors
 
     | Field | Type | Default | Description |
     |---|---|---|---|
-    | `persist` | object, null | None | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See [Saving state (persist)](detectors.md#saving-state-persist). |
+    | `persist` | object, null | None | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
     | Field | Type | Default | Description |
     |---|---|---|---|
-    | `allow_fed` | boolean | False | Builds the stores needed to take part in [federation](federation.md). |
+    | `allow_fed` | boolean | False | Builds the stores needed to take part in federation. |
 <!-- End tracker_arguments -->
 
 ### Per-variable model detectors
diff --git a/docs/detectors/bigram_frequency.md b/docs/detectors/bigram_frequency.md
index 5834fc32..434c4e22 100644
--- a/docs/detectors/bigram_frequency.md
+++ b/docs/detectors/bigram_frequency.md
@@ -50,10 +50,10 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | bigram_frequency_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
@@ -63,13 +63,13 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | `default_freqs` | boolean | False | specific | Initialize the probabilities with default values from https://github.com/markbaggett/freq. |
     | `skip_repetitions` | boolean | True | specific | Only use distinct values for character-pair counting. This counteracts the problem of imbalanced word frequencies that distort the frequency table generated in a single run. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/detectors/charset.md b/docs/detectors/charset.md
index 0d5a340c..dfc97c37 100644
--- a/docs/detectors/charset.md
+++ b/docs/detectors/charset.md
@@ -50,23 +50,23 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | charset_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ??? note "params"
 
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/detectors/combo.md b/docs/detectors/combo.md
index bcc0e094..8e18fd07 100644
--- a/docs/detectors/combo.md
+++ b/docs/detectors/combo.md
@@ -52,23 +52,23 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | new_value_combo_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ??? note "params"
 
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/detectors/deeplog.md b/docs/detectors/deeplog.md
index 16a0d78f..4cabdbae 100644
--- a/docs/detectors/deeplog.md
+++ b/docs/detectors/deeplog.md
@@ -50,7 +50,7 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | deeplog_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
 
@@ -59,8 +59,8 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/detectors/ecvc_detector.md b/docs/detectors/ecvc_detector.md
index af292b69..dcfe68d5 100644
--- a/docs/detectors/ecvc_detector.md
+++ b/docs/detectors/ecvc_detector.md
@@ -52,10 +52,10 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | ecvc_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
@@ -66,11 +66,11 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | `seed` | integer | 0 | specific | Random seed used to shuffle count vectors into train/validation splits. |
     | `threshold_method` | string | mean | specific | Method used to derive the anomaly threshold from the validation split: 'mean' averages the distance scores, 'default' uses a fixed threshold of 0. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 <!-- End arguments -->
diff --git a/docs/detectors/event_sequence.md b/docs/detectors/event_sequence.md
index a8751bf4..374283b4 100644
--- a/docs/detectors/event_sequence.md
+++ b/docs/detectors/event_sequence.md
@@ -78,10 +78,10 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | event_sequence_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
@@ -89,13 +89,13 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     |---|---|---|---|---|
     | `fixed_window_size` | integer, null | None | specific | Length of the sliding EventID window. A window whose exact EventID sequence was not seen during training is reported as an anomaly. When set it overrides the `auto_config_params` window range and skips auto-configuration; auto-configuration writes its own choice here. While it is None the detector is unconfigured and neither trains nor alerts. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/detectors/logbert.md b/docs/detectors/logbert.md
index 510a8eac..aecaf0a7 100644
--- a/docs/detectors/logbert.md
+++ b/docs/detectors/logbert.md
@@ -50,7 +50,7 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | logbert_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
 
@@ -59,8 +59,8 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/detectors/new_event.md b/docs/detectors/new_event.md
index e43e6022..c2c60022 100644
--- a/docs/detectors/new_event.md
+++ b/docs/detectors/new_event.md
@@ -50,21 +50,21 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | new_event_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ??? note "params"
 
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 <!-- End arguments -->
diff --git a/docs/detectors/new_value.md b/docs/detectors/new_value.md
index abb7b3b4..95157284 100644
--- a/docs/detectors/new_value.md
+++ b/docs/detectors/new_value.md
@@ -50,23 +50,23 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | new_value_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ??? note "params"
 
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/detectors/random_detector.md b/docs/detectors/random_detector.md
index 64840cc0..80e05d44 100644
--- a/docs/detectors/random_detector.md
+++ b/docs/detectors/random_detector.md
@@ -50,7 +50,7 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | random_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
 
@@ -59,8 +59,8 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/detectors/rule_based.md b/docs/detectors/rule_based.md
index ace49d2e..e57e4d86 100644
--- a/docs/detectors/rule_based.md
+++ b/docs/detectors/rule_based.md
@@ -66,7 +66,7 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | rule_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
 
@@ -76,8 +76,8 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     |---|---|---|---|---|
     | `rules` | array | [{'rule': 'R001 - TemplateNotFound'}, {'rule': 'R003 - CheckForExceptions'}, {'rule': 'R004 - ErrorLevelFound'}] | specific | List of rules to evaluate, each a dict with a 'rule' name and an optional 'args' list. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/detectors/scvs_detector.md b/docs/detectors/scvs_detector.md
index ce75278a..5918394d 100644
--- a/docs/detectors/scvs_detector.md
+++ b/docs/detectors/scvs_detector.md
@@ -52,10 +52,10 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | scvs_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
@@ -63,11 +63,11 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     |---|---|---|---|---|
     | `window_size` | integer | 10 | specific | Length of the event-ID window a count vector is built over. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 <!-- End arguments -->
diff --git a/docs/detectors/value_range.md b/docs/detectors/value_range.md
index 21220d98..60040bcd 100644
--- a/docs/detectors/value_range.md
+++ b/docs/detectors/value_range.md
@@ -50,10 +50,10 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
     | `method_type` | string | value_range_detector | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. |
+    | `auto_config` | boolean | True | shared | Runs the configuration step before the training process. Has no effect unless data_use_configure is set. |
     | `events` | object | {} | shared | Events configuration dict keyed by event_id. |
     | `global` | object | {} | shared | Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as `global` in YAML. |
-    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See the Persistency page. |
+    | `persist` | object, null | None | shared | Periodic state saving (path, interval_seconds, events_until_save, auto_load, storage_options). None disables it. See Saving state (persist) on the Detectors page. |
 
 ???+ note "params"
 
@@ -61,13 +61,13 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
     |---|---|---|---|---|
     | `ignore_non_numerical_val` | boolean | True | specific | Drop non-numeric values instead of raising when a configured variable cannot be cast to a number. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
     | `parser` | string | PARSER | shared | Name of the parser used. |
-    | `allow_fed` | boolean | False | shared | Allow to do the federation |
+    | `allow_fed` | boolean | False | shared | Builds the stores needed to take part in federation. |
 
 ??? note "auto_config_params (read only while auto_config is true)"
 
diff --git a/docs/parsers.md b/docs/parsers.md
index f7661259..0f2a8d43 100644
--- a/docs/parsers.md
+++ b/docs/parsers.md
@@ -143,8 +143,8 @@ There are some parameters, that **every** parser inherits from `CoreParserConfig
     | Field | Type | Default | Description |
     |---|---|---|---|
     | `start_id` | integer | 10 | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/auto_parser.md b/docs/parsers/auto_parser.md
index 4c768bb0..8a7c6d58 100644
--- a/docs/parsers/auto_parser.md
+++ b/docs/parsers/auto_parser.md
@@ -62,8 +62,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     |---|---|---|---|---|
     | `fix_type` | string |  | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/drain_parser.md b/docs/parsers/drain_parser.md
index e80bcf3e..dff7cf69 100644
--- a/docs/parsers/drain_parser.md
+++ b/docs/parsers/drain_parser.md
@@ -62,8 +62,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     | `reset_in_post_train` | boolean | False | specific | fitting description yet to find |
     | `Finetune` | array | [['depth', [1, 2, 3, 4]], ['max_childs', [10, 40]], ['sim_thres', [0.2, 0.4, 0.6, 0.8]]] | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/json_parser.md b/docs/parsers/json_parser.md
index 8b6ece4c..b5255074 100644
--- a/docs/parsers/json_parser.md
+++ b/docs/parsers/json_parser.md
@@ -56,8 +56,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     | `content_name` | string | message | specific | fitting description yet to find |
     | `content_parser` | string | JsonMatcherParser | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/logbatcher_parser.md b/docs/parsers/logbatcher_parser.md
index af199892..e92d5e47 100644
--- a/docs/parsers/logbatcher_parser.md
+++ b/docs/parsers/logbatcher_parser.md
@@ -78,8 +78,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     | `base_url` | string |  | specific | fitting description yet to find |
     | `batch_size` | integer | 10 | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/template_matcher.md b/docs/parsers/template_matcher.md
index a2c002a4..cfc38646 100644
--- a/docs/parsers/template_matcher.md
+++ b/docs/parsers/template_matcher.md
@@ -93,8 +93,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     | `lowercase` | boolean | True | specific | fitting description yet to find |
     | `path_templates` | string, null | None | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/parsers/template_tree_matcher.md b/docs/parsers/template_tree_matcher.md
index c6376987..99169d6a 100644
--- a/docs/parsers/template_tree_matcher.md
+++ b/docs/parsers/template_tree_matcher.md
@@ -64,8 +64,8 @@ All parameters this parser accepts, grouped by the YAML block they go in. **Scop
     |---|---|---|---|---|
     | `path_templates` | string, null | None | specific | fitting description yet to find |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/src/detectmatelibrary/base_detectors/tracker_detector.py b/src/detectmatelibrary/base_detectors/tracker_detector.py
index 8b168a2e..1da3988e 100644
--- a/src/detectmatelibrary/base_detectors/tracker_detector.py
+++ b/src/detectmatelibrary/base_detectors/tracker_detector.py
@@ -24,13 +24,13 @@ class TrackerDetectorConfig(CoreDetectorConfig):
         default=None,
         description=(
             "Periodic state saving (path, interval_seconds, events_until_save, auto_load, "
-            "storage_options). None disables it. See the Persistency page."
+            "storage_options). None disables it. See Saving state (persist) on the Detectors page."
         ),
     )
     allow_fed: bool = Field(
         default=False,
         description=(
-            "Allow to do the federation"
+            "Builds the stores needed to take part in federation."
         ),
     )
 
diff --git a/src/detectmatelibrary/common/core.py b/src/detectmatelibrary/common/core.py
index 3aec5409..db9154f6 100644
--- a/src/detectmatelibrary/common/core.py
+++ b/src/detectmatelibrary/common/core.py
@@ -34,11 +34,11 @@ class CoreConfig(BasicConfig):
     )
     data_use_training: int | None = Field(
         default=None,
-        description="Data used for training, if None, training is not done.",
+        description="Number of logs used for training. None skips training.",
     )
     data_use_configure: int | None = Field(
         default=None,
-        description="Data used for configuration, if None, configuration is not done.",
+        description="Number of logs used for the configuration step. None skips it.",
     )
     use_config_data_as_training: bool = Field(
         default=True,
diff --git a/src/detectmatelibrary/common/detector.py b/src/detectmatelibrary/common/detector.py
index fca3be7e..d17b69e5 100644
--- a/src/detectmatelibrary/common/detector.py
+++ b/src/detectmatelibrary/common/detector.py
@@ -39,7 +39,10 @@ class CoreDetectorConfig(CoreConfig):
 
     auto_config: bool = Field(
         default=True,
-        description="Runs the configuration step before the training process.",
+        description=(
+            "Runs the configuration step before the training process. "
+            "Has no effect unless data_use_configure is set."
+        ),
     )
     events: EventsConfig | dict[str, Any] = Field(
         default={},

From d89240750615e7fa72abd29d92cbe950505843c3 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 13 Oct 2026 12:17:51 +0200
Subject: [PATCH 20/86] functionality ready

---
 .../alert_aggregation/logid_count.py          | 23 ++++--
 .../test_logid_count.py                       | 70 ++++++++++++++++++-
 2 files changed, 86 insertions(+), 7 deletions(-)

diff --git a/src/detectmatelibrary/alert_aggregation/logid_count.py b/src/detectmatelibrary/alert_aggregation/logid_count.py
index dd76d419..5f15d117 100644
--- a/src/detectmatelibrary/alert_aggregation/logid_count.py
+++ b/src/detectmatelibrary/alert_aggregation/logid_count.py
@@ -53,7 +53,8 @@ def add_and_check(self, logId: str) -> bool:
 
 class LogIDCountAggegationConfig(CoreAlertAggregatorConfig):
     method_type: str = "logid_count_aggregator"
-    max_count: int = 3
+    max_count: int = 4
+    max_memory: int = 5000
 
 
 class LogIDCountAggegation(CoreAlertAggregator):
@@ -65,14 +66,26 @@ def __init__(
         if isinstance(config, dict):
             config = LogIDCountAggegationConfig.from_dict(config, name)
 
-        super().__init__(name=name, config=config, buffer_mode=BufferMode.NO_BUF)
+        super().__init__(name=name, config=config, buffer_mode=BufferMode.NO_BUF, buffer_size=None)
         self.config: LogIDCountAggegationConfig
 
-        self.counter = Counter(max_count=self.config.max_count)
+        self.counter = Counter(
+            max_count=self.config.max_count, overall_size=self.config.max_memory
+        )
 
     def aggregate_alerts(
         self, input_: DetectorSchema, output_: AggregateSchema  # type: ignore
     ) -> bool:
 
-        output_["description"] = "Basic aggregation by alert concatenation"
-        return True
+        alert_logs = []
+        for logID in input_["logIDs"]:
+            if self.counter.add_and_check(logID):
+                alert_logs.append(logID)
+
+        if (aggreated_alerts := len(alert_logs) > 0):
+            output_["description"] = (
+                "LogID count how many times a log was count as alert."
+                f"Logs that pass the limit count: {", ".join(alert_logs)}"
+            )
+            
+        return aggreated_alerts
diff --git a/tests/test_alert_aggregators/test_logid_count.py b/tests/test_alert_aggregators/test_logid_count.py
index 686f3b57..4bd259ff 100644
--- a/tests/test_alert_aggregators/test_logid_count.py
+++ b/tests/test_alert_aggregators/test_logid_count.py
@@ -1,5 +1,8 @@
 
-from detectmatelibrary.alert_aggregation.logid_count import Counter
+from detectmatelibrary.alert_aggregation.logid_count import (
+    Counter, LogIDCountAggegation, LogIDCountAggegationConfig
+)
+import detectmatelibrary.schemas as schemas
 
 
 class TestCounter:
@@ -27,4 +30,67 @@ def test_surpass_memory(self) -> None:
         assert counter.add_and_check("a")  
 
         assert not counter.add_and_check("a")  # should not generate new ones
-        assert not counter.add_and_check("c")  # should not generate new ones
\ No newline at end of file
+        assert not counter.add_and_check("c")  # should not generate new ones
+
+
+def generate_schema(log_id: str | list[str]) -> schemas.DetectorSchema:
+    log_id = log_id if isinstance(log_id, list) else [log_id]
+    return schemas.DetectorSchema({
+        "detectorID": "1",
+        "detectorType": "dummy",
+        "alertID": "2",
+        "detectionTimestamp": 0,
+        "logIDs": log_id,
+        "score": 0.2,
+        "extractedTimestamps": [-1],
+        "description": "hello there",
+        "receivedTimestamp": 1,
+        "alertsObtain": {"99 problems": "but logs aint one"}
+    })
+
+
+class TestLogIDCount:
+    def test_basic_count(self):
+        aggregator = LogIDCountAggegation(config=LogIDCountAggegationConfig(max_count=2))
+
+        assert aggregator.process(generate_schema("a")) is None
+        assert aggregator.process(generate_schema("b")) is None
+
+        assert aggregator.process(generate_schema("a")) is not None
+        assert aggregator.process(generate_schema("b")) is not None
+
+        assert aggregator.process(generate_schema("a")) is None
+        assert aggregator.process(generate_schema("b")) is None
+
+    def test_basic_count_as_list(self):
+        aggregator = LogIDCountAggegation(config=LogIDCountAggegationConfig(max_count=2))
+
+        assert aggregator.process(generate_schema(["a", "b"])) is None
+        assert aggregator.process(generate_schema(["a", "b"])) is not None
+        assert aggregator.process(generate_schema(["a", "b"])) is None
+
+    def test_surpass_memory(self):
+        aggregator = LogIDCountAggegation(
+            config=LogIDCountAggegationConfig(max_count=2, max_memory=2)
+        )
+
+        assert aggregator.process(generate_schema("a")) is None
+        assert aggregator.process(generate_schema("b")) is None
+        assert aggregator.process(generate_schema("c")) is None
+
+        assert aggregator.process(generate_schema("b")) is not None
+        assert aggregator.process(generate_schema("a")) is None  # was rename by c 
+        assert aggregator.process(generate_schema("c")) is not None
+        assert aggregator.process(generate_schema("a")) is not None
+
+        assert aggregator.process(generate_schema("a")) is None  # should not generate new ones
+        assert aggregator.process(generate_schema("c")) is None # should not generate new ones
+
+    def test_description(self):
+        aggregator = LogIDCountAggegation(config=LogIDCountAggegationConfig(max_count=1))
+        alert = aggregator.process(generate_schema(["a", "b"]))
+
+        expected = "LogID count how many times a log was count as alert."
+        expected += "Logs that pass the limit count: a, b"
+
+        assert alert["description"] == expected
\ No newline at end of file

From ed928d0ddb3eaa51023694dac649d5ed00828ad6 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 13 Oct 2026 12:20:35 +0200
Subject: [PATCH 21/86] add fields describption

---
 .../alert_aggregation/logid_count.py                | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/detectmatelibrary/alert_aggregation/logid_count.py b/src/detectmatelibrary/alert_aggregation/logid_count.py
index 5f15d117..deea9db2 100644
--- a/src/detectmatelibrary/alert_aggregation/logid_count.py
+++ b/src/detectmatelibrary/alert_aggregation/logid_count.py
@@ -7,6 +7,7 @@
 
 from typing import Any, Optional
 from functools import lru_cache
+from pydantic import Field
 import polars as pl
 
 
@@ -52,9 +53,13 @@ def add_and_check(self, logId: str) -> bool:
 
 
 class LogIDCountAggegationConfig(CoreAlertAggregatorConfig):
-    method_type: str = "logid_count_aggregator"
-    max_count: int = 4
-    max_memory: int = 5000
+    method_type: str = Field(
+        default="logid_count_aggregator", description="Indicates what type of method it is."
+    )
+    max_count: int = Field(default=4, description="Max count of alerts in a specific logID.")
+    max_memory: int = Field(
+        default=5000, description="Max number of logIDs store in the count memory."
+    )
 
 
 class LogIDCountAggegation(CoreAlertAggregator):
@@ -87,5 +92,5 @@ def aggregate_alerts(
                 "LogID count how many times a log was count as alert."
                 f"Logs that pass the limit count: {", ".join(alert_logs)}"
             )
-            
+
         return aggreated_alerts

From dd6be90d3c4f8a489173ec3f6cba352c5f53fbf2 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 13 Oct 2026 12:49:51 +0200
Subject: [PATCH 22/86] updating alert aggregation docs

---
 docs/alert_aggregator.md                      | 19 +++++++++++
 docs/alert_aggregators/basic_concatenation.md | 24 +++++++++++++
 docs/examples/config/update.py                | 34 +++++++++++++++++++
 .../alert_aggregation/basic_concat.py         |  9 +++--
 .../common/alert_aggregator.py                |  7 ++--
 5 files changed, 88 insertions(+), 5 deletions(-)

diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index deac6763..d9322853 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -19,6 +19,25 @@ This document explains the expected API and how to implement an alert aggregator
   With the default `buffer_size` of 1, it is called for every alert with a list of one.
 - Use a typed `Config` class (subclass of `CoreAlertAggregatorConfig`) to hold runtime parameters.
 
+<!-- Start common_arguments -->
+???+ note "Top level"
+
+    | Field | Type | Default | Description |
+    |---|---|---|---|
+    | `auto_config` | boolean | False | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Description |
+    |---|---|---|---|
+    | `start_id` | integer | 10 | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | Data used for training, if None, training is not done. |
+    | `data_use_configure` | integer, null | None | Data used for configuration, if None, configuration is not done. |
+    | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End common_arguments -->
+
 ## CoreAlertAggregator: minimal API
 
 ```python
diff --git a/docs/alert_aggregators/basic_concatenation.md b/docs/alert_aggregators/basic_concatenation.md
index 5e37b904..5fc254a9 100644
--- a/docs/alert_aggregators/basic_concatenation.md
+++ b/docs/alert_aggregators/basic_concatenation.md
@@ -8,6 +8,30 @@ The basic concat alert aggregation approach aggregates x number of alerts into o
 | **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
 
 
+## Configuration arguments
+
+<!-- Start arguments -->
+??? note "Top level"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `method_type` | string | basic_concat_aggregator | shared | Indicates what type of method it is. |
+    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `buffer_size` | integer | 3 | specific | Buffer size use in the aggregation. |
+    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
+    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End arguments -->
+
+
 # Configuration example
 
 ```yaml
diff --git a/docs/examples/config/update.py b/docs/examples/config/update.py
index 12b8d8aa..c6479a2b 100644
--- a/docs/examples/config/update.py
+++ b/docs/examples/config/update.py
@@ -25,11 +25,14 @@
 
 from detectmatelibrary.common.core import CoreConfig
 from detectmatelibrary.common.detector import CoreDetectorConfig
+from detectmatelibrary.common.alert_aggregator import CoreAlertAggregatorConfig
 from detectmatelibrary.common.parser import CoreParserConfig
 from detectmatelibrary.base_detectors import TrackerDetectorConfig
 from detectmatelibrary.base_detectors import VariableDetectorConfig
 from detectmatelibrary.base_detectors import DeepLearningDetectorConfig
 
+from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregationConfig
+
 from typing import Any
 
 
@@ -184,6 +187,25 @@ def update_shared_args_parsers(doc_path: str) -> None:
         raise Exception(f"While updating {doc_path} -> {str(e)}")
 
 
+def update_shared_args_aggregation(doc_path: str) -> None:
+    """Fill docs/alert_aggregation.md's tables of parameters shared across several
+    alert_aggregator: fields every parser has (CoreAlertAggregatorConfig)."""
+    try:
+        with open(doc_path, "r") as f:
+            docs = f.readlines()
+
+        docs = append_docs(
+            docs=docs,
+            start_cmd="<!-- Start common_arguments -->\n",
+            end_cmd="<!-- End common_arguments -->\n",
+            add=get_arguments(CoreAlertAggregatorConfig().get_docs(), with_scope=False),
+        )
+        with open(doc_path, "w") as f:
+            f.writelines(docs)
+    except Exception as e:
+        raise Exception(f"While updating {doc_path} -> {str(e)}")
+
+
 # %% Documentation update
 #
 # Every config below drives its own doc page: whenever a Field is added,
@@ -244,11 +266,23 @@ def update_shared_args_parsers(doc_path: str) -> None:
     ),
 ]
 
+AGGREGATOR_DOCS: list[tuple[CoreConfig, type[CoreConfig], str]] = [
+    (
+        BasicConcatAggregationConfig(),
+        CoreAlertAggregatorConfig,
+        "docs/alert_aggregators/basic_concatenation.md"
+    )
+]
+
 update_shared_args_detectors("docs/detectors.md")
 update_shared_args_parsers("docs/parsers.md")
+update_shared_args_aggregation("docs/alert_aggregator.md")
 
 for detector_config, shared_base, doc_path in DETECTOR_DOCS:
     update_docs(detector_config, doc_path=doc_path, shared_base=shared_base)
 
 for parser_config, shared_base, doc_path in PARSER_DOCS:
     update_docs(parser_config, doc_path=doc_path, shared_base=shared_base)
+
+for aggr_config, shared_base, doc_path in AGGREGATOR_DOCS:
+    update_docs(aggr_config, doc_path=doc_path, shared_base=shared_base)
diff --git a/src/detectmatelibrary/alert_aggregation/basic_concat.py b/src/detectmatelibrary/alert_aggregation/basic_concat.py
index 45883cf8..b863af3f 100644
--- a/src/detectmatelibrary/alert_aggregation/basic_concat.py
+++ b/src/detectmatelibrary/alert_aggregation/basic_concat.py
@@ -5,11 +5,16 @@
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
 
 from typing import Any, Optional
+from pydantic import Field
 
 
 class BasicConcatAggregationConfig(CoreAlertAggregatorConfig):
-    method_type: str = "basic_concat_aggregator"
-    buffer_size: int = 3
+    method_type: str = Field(
+        default="basic_concat_aggregator", description="Indicates what type of method it is."
+    )
+    buffer_size: int = Field(
+        default=3, description="Buffer size use in the aggregation."
+    )
 
 
 class BasicConcatAggregation(CoreAlertAggregator):
diff --git a/src/detectmatelibrary/common/alert_aggregator.py b/src/detectmatelibrary/common/alert_aggregator.py
index 44d84fda..3c41e5e9 100644
--- a/src/detectmatelibrary/common/alert_aggregator.py
+++ b/src/detectmatelibrary/common/alert_aggregator.py
@@ -6,8 +6,9 @@
 
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
 
-from typing import Any, Optional
 from typing_extensions import override
+from typing import Any, Optional
+from pydantic import Field
 
 
 def _extract_field(
@@ -31,8 +32,8 @@ def _extract_list_field(input_: list[DetectorSchema] | DetectorSchema, field: st
 
 
 class CoreAlertAggregatorConfig(CoreConfig):
-    component_type: str = "alert_aggregators"
-    method_type: str = "core_alert_aggregator"
+    component_type: str = Field(default="alert_aggregators", description="<$IGNORE$>")
+    method_type: str = Field(default="core_alert_aggregator", description="<$IGNORE$>")
 
 
 class CoreAlertAggregator(CoreComponent):

From 671deaff956ddf69ad7924b13f7be2892dc9121b Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 13 Oct 2026 12:58:40 +0200
Subject: [PATCH 23/86] update alert aggregation docs

---
 docs/alert_aggregator.md              | 51 ++++++++++++++++-----------
 docs/alert_aggregators/logid_count.md |  0
 2 files changed, 31 insertions(+), 20 deletions(-)
 create mode 100644 docs/alert_aggregators/logid_count.md

diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index d9322853..eaa7a340 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -19,24 +19,6 @@ This document explains the expected API and how to implement an alert aggregator
   With the default `buffer_size` of 1, it is called for every alert with a list of one.
 - Use a typed `Config` class (subclass of `CoreAlertAggregatorConfig`) to hold runtime parameters.
 
-<!-- Start common_arguments -->
-???+ note "Top level"
-
-    | Field | Type | Default | Description |
-    |---|---|---|---|
-    | `auto_config` | boolean | False | Runs the configuration step before the training process. |
-
-???+ note "params"
-
-    | Field | Type | Default | Description |
-    |---|---|---|---|
-    | `start_id` | integer | 10 | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | Data used for configuration, if None, configuration is not done. |
-    | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
-    | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
-    | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
-<!-- End common_arguments -->
 
 ## CoreAlertAggregator: minimal API
 
@@ -81,6 +63,35 @@ fields left for `aggregate_alerts()` to fill are `description` and `alertsObtain
     unless your `aggregate_alerts()` keeps it, including their `detectionTimestamp` and
     `receivedTimestamp`.
 
-## Available alert aggregators
+## Alert aggregator methods
+
+The alert aggregator are numbered from simplest to most complex, and the sidebar lists them in the same order.
+
+| # | Detector | What it detects |
+|---|---|---|
+| 00 | [Basic Concat Aggregator](alert_aggregators/basic_concatenation.md) | Concat a set of alerts. |
+| 01 | [LogID Count Aggregator](alert_aggregators/logid_count.md) | Count the amount of times a logID is in alerts. |
+
 
-- [Basic Concat](alert_aggregators/basic_concatenation.md)
+### Common parameters (all alerg aggregators)
+
+There are some parameters, that **every** alert aggregator inherits from `CoreAlertAggregatorConfig`/`CoreConfigCoreAlertAggregator`/`BasicConfig`, regardless of what it does. The other parameters, that are **specific** for the respective detector, are explained right at the detectors documentation page, later on.
+
+<!-- Start common_arguments -->
+???+ note "Top level"
+
+    | Field | Type | Default | Description |
+    |---|---|---|---|
+    | `auto_config` | boolean | False | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Description |
+    |---|---|---|---|
+    | `start_id` | integer | 10 | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | Data used for training, if None, training is not done. |
+    | `data_use_configure` | integer, null | None | Data used for configuration, if None, configuration is not done. |
+    | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End common_arguments -->
diff --git a/docs/alert_aggregators/logid_count.md b/docs/alert_aggregators/logid_count.md
new file mode 100644
index 00000000..e69de29b

From 05af24cdabf44e96e2696f239d2a9d4f2ed0a0eb Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 13 Oct 2026 13:11:22 +0200
Subject: [PATCH 24/86] update basic concat docs

---
 docs/alert_aggregator.md                      |  2 +-
 docs/alert_aggregators/basic_concatenation.md | 51 ++++++++++++-------
 .../alert_aggregators/basic_concat.py         | 16 ++----
 .../alert_aggregators/basic_concat.yaml       |  5 ++
 4 files changed, 44 insertions(+), 30 deletions(-)
 create mode 100644 docs/examples/alert_aggregators/basic_concat.yaml

diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index eaa7a340..83f73d86 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -73,7 +73,7 @@ The alert aggregator are numbered from simplest to most complex, and the sidebar
 | 01 | [LogID Count Aggregator](alert_aggregators/logid_count.md) | Count the amount of times a logID is in alerts. |
 
 
-### Common parameters (all alerg aggregators)
+### Common parameters (all alert aggregators)
 
 There are some parameters, that **every** alert aggregator inherits from `CoreAlertAggregatorConfig`/`CoreConfigCoreAlertAggregator`/`BasicConfig`, regardless of what it does. The other parameters, that are **specific** for the respective detector, are explained right at the detectors documentation page, later on.
 
diff --git a/docs/alert_aggregators/basic_concatenation.md b/docs/alert_aggregators/basic_concatenation.md
index 5fc254a9..5ac0b736 100644
--- a/docs/alert_aggregators/basic_concatenation.md
+++ b/docs/alert_aggregators/basic_concatenation.md
@@ -2,14 +2,48 @@
 
 The basic concat alert aggregation approach aggregates x number of alerts into one output schema.
 
+## In/out
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
 | **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
 
+## At a glance
+
+| Learns from training data | Auto-configuration | Needs `events` | Federation |
+|---|---|---|---|
+| ❌ | ❌ | ❌ | ❌ |
+
+## Description
+
+A basic approach that simply concatenates the alerts without verifying anything specific.
+
+
+## Example
+
+```python
+--8<-- "docs/examples/alert_aggregators/basic_concat.py:example_1"
+```
+
+## Configuration file
+
+The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
+
+```yaml
+--8<-- "docs/examples/alert_aggregators/basic_concat.yaml"
+```
+
+## Example
+
+```python
+--8<-- "docs/examples/alert_aggregators/basic_concat.py:example_1"
+```
 
 ## Configuration arguments
 
+All parameters this detector accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this detector or `shared` with other detectors (see the [Alert Aggregation overview](../alert_aggregator.md#common-parameters-all-alert-aggregators)). Where this detector changes a shared default, the shared value is shown in brackets.
+
 <!-- Start arguments -->
 ??? note "Top level"
 
@@ -30,20 +64,3 @@ The basic concat alert aggregation approach aggregates x number of alerts into o
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
 <!-- End arguments -->
-
-
-# Configuration example
-
-```yaml
-alert_aggregators:
-    BasicConcatAggregator:
-        method_type: "basic_concat_aggregator"
-        buffer_size: 3
-        auto_config: False
-```
-
-## Example usage
-
-```python
---8<-- "docs/examples/alert_aggregators/basic_concat.py:example_1"
-```
diff --git a/docs/examples/alert_aggregators/basic_concat.py b/docs/examples/alert_aggregators/basic_concat.py
index ea1bc53a..d3d73b54 100644
--- a/docs/examples/alert_aggregators/basic_concat.py
+++ b/docs/examples/alert_aggregators/basic_concat.py
@@ -4,17 +4,11 @@
 
 import detectmatelibrary.schemas as schemas
 
+import yaml
 
-aggregations_config = {
-    "alert_aggregators": {
-        "BasicConcatAggregator": {
-            "method_type": "basic_concat_aggregator",
-            "buffer_size": 3,
-            "auto_config": False,
-        }
-    }
-}
 
+with open("docs/examples/alert_aggregators/basic_concat.yaml") as f:
+    config = yaml.safe_load(f)
 
 input_ = schemas.DetectorSchema({
     "detectorID": "1",
@@ -29,9 +23,7 @@
     "alertsObtain": {"99 problems": "but logs aint one"}
 })
 
-alert_aggregator = BasicConcatAggregation(
-    "BasicConcatAggregator", aggregations_config
-)
+alert_aggregator = BasicConcatAggregation("BasicConcatAggregator", config)
 alert_aggregator.process(input_)
 
 # --8<-- [end:example_1]
diff --git a/docs/examples/alert_aggregators/basic_concat.yaml b/docs/examples/alert_aggregators/basic_concat.yaml
new file mode 100644
index 00000000..8eef83ca
--- /dev/null
+++ b/docs/examples/alert_aggregators/basic_concat.yaml
@@ -0,0 +1,5 @@
+alert_aggregators:
+    BasicConcatAggregator:
+        method_type: "basic_concat_aggregator"
+        buffer_size: 3
+        auto_config: False

From 8fbae7f0c1a1e6c6fc05cb7119dbabead4434bf9 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 13 Oct 2026 13:33:40 +0200
Subject: [PATCH 25/86] update logid docs

---
 docs/alert_aggregators/basic_concatenation.md | 32 ++++------
 docs/alert_aggregators/logid_count.md         | 60 +++++++++++++++++++
 .../examples/alert_aggregators/logid_count.py | 35 +++++++++++
 .../alert_aggregators/logid_count.yaml        |  5 ++
 mkdocs.yml                                    |  1 +
 5 files changed, 114 insertions(+), 19 deletions(-)
 create mode 100644 docs/examples/alert_aggregators/logid_count.py
 create mode 100644 docs/examples/alert_aggregators/logid_count.yaml

diff --git a/docs/alert_aggregators/basic_concatenation.md b/docs/alert_aggregators/basic_concatenation.md
index 5ac0b736..e3332bbc 100644
--- a/docs/alert_aggregators/basic_concatenation.md
+++ b/docs/alert_aggregators/basic_concatenation.md
@@ -34,12 +34,6 @@ The configuration used by the example above. It sets only what this use case nee
 --8<-- "docs/examples/alert_aggregators/basic_concat.yaml"
 ```
 
-## Example
-
-```python
---8<-- "docs/examples/alert_aggregators/basic_concat.py:example_1"
-```
-
 ## Configuration arguments
 
 All parameters this detector accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this detector or `shared` with other detectors (see the [Alert Aggregation overview](../alert_aggregator.md#common-parameters-all-alert-aggregators)). Where this detector changes a shared default, the shared value is shown in brackets.
@@ -47,20 +41,20 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
 <!-- Start arguments -->
 ??? note "Top level"
 
-    | Field | Type | Default | Scope | Description |
-    |---|---|---|---|---|
-    | `method_type` | string | basic_concat_aggregator | shared | Indicates what type of method it is. |
-    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+| Field | Type | Default | Scope | Description |
+|---|---|---|---|---|
+| `method_type` | string | basic_concat_aggregator | shared | Indicates what type of method it is. |
+| `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
 
 ???+ note "params"
 
-    | Field | Type | Default | Scope | Description |
-    |---|---|---|---|---|
-    | `buffer_size` | integer | 3 | specific | Buffer size use in the aggregation. |
-    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
-    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
-    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
-    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+| Field | Type | Default | Scope | Description |
+|---|---|---|---|---|
+| `buffer_size` | integer | 3 | specific | Buffer size use in the aggregation. |
+| `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+| `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
+| `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+| `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+| `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+| `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
 <!-- End arguments -->
diff --git a/docs/alert_aggregators/logid_count.md b/docs/alert_aggregators/logid_count.md
index e69de29b..1a868e22 100644
--- a/docs/alert_aggregators/logid_count.md
+++ b/docs/alert_aggregators/logid_count.md
@@ -0,0 +1,60 @@
+# LogID Count Alert Aggregation
+
+The logID count alert aggregation tracks how many times each log ID appears in the alerts, and if it exceeds a specified threshold, it triggers the aggregation.
+
+## In/out
+
+|            | Schema                     | Description        |
+|------------|----------------------------|--------------------|
+| **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
+| **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
+
+## At a glance
+
+| Learns from training data | Auto-configuration | Needs `events` | Federation |
+|---|---|---|---|
+| ❌ | ❌ | ❌ | ❌ |
+
+## Description
+
+A log ID counter stores, in a fixed-size table, the counts for different log IDs. If the count for any log ID from the Detector Schemas exceeds a defined threshold, it returns an alert aggregation.
+
+The fixed-size table operates as a FIFO: once it is full, it removes the oldest entry and inserts the new log ID.
+## Example
+
+```python
+--8<-- "docs/examples/alert_aggregators/logid_count.py:example_1"
+```
+
+## Configuration file
+
+The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
+
+```yaml
+--8<-- "docs/examples/alert_aggregators/logid_count.yaml"
+```
+
+## Configuration arguments
+
+All parameters this detector accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this detector or `shared` with other detectors (see the [Alert Aggregation overview](../alert_aggregator.md#common-parameters-all-alert-aggregators)). Where this detector changes a shared default, the shared value is shown in brackets.
+
+<!-- Start arguments -->
+??? note "Top level"
+
+| Field | Type | Default | Scope | Description |
+|---|---|---|---|---|
+| `method_type` | string | basic_concat_aggregator | shared | Indicates what type of method it is. |
+| `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+| Field | Type | Default | Scope | Description |
+|---|---|---|---|---|
+| `buffer_size` | integer | 3 | specific | Buffer size use in the aggregation. |
+| `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+| `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
+| `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+| `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+| `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+| `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End arguments -->
diff --git a/docs/examples/alert_aggregators/logid_count.py b/docs/examples/alert_aggregators/logid_count.py
new file mode 100644
index 00000000..01af127c
--- /dev/null
+++ b/docs/examples/alert_aggregators/logid_count.py
@@ -0,0 +1,35 @@
+# --8<-- [start:example_1]
+from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegation
+
+import detectmatelibrary.schemas as schemas
+
+import yaml
+
+
+with open("docs/examples/alert_aggregators/logid_count.yaml") as f:
+    config = yaml.safe_load(f)
+
+
+def generate_schema(log_id: str | list[str]) -> schemas.DetectorSchema:
+    log_id = log_id if isinstance(log_id, list) else [log_id]
+    return schemas.DetectorSchema({
+        "detectorID": "1",
+        "detectorType": "dummy",
+        "alertID": "2",
+        "detectionTimestamp": 0,
+        "logIDs": log_id,
+        "score": 0.2,
+        "extractedTimestamps": [-1],
+        "description": "hello there",
+        "receivedTimestamp": 1,
+        "alertsObtain": {"99 problems": "but logs aint one"}
+    })
+
+
+alert_aggregator = LogIDCountAggegation("LogIDCountAggegation", config)
+
+print(alert_aggregator.process(generate_schema("a")) is None)  # True
+print(alert_aggregator.process(generate_schema("b")) is None)  # True
+print(alert_aggregator.process(generate_schema("a")) is None)  # False
+
+# --8<-- [end:example_1]
diff --git a/docs/examples/alert_aggregators/logid_count.yaml b/docs/examples/alert_aggregators/logid_count.yaml
new file mode 100644
index 00000000..78a96e45
--- /dev/null
+++ b/docs/examples/alert_aggregators/logid_count.yaml
@@ -0,0 +1,5 @@
+alert_aggregators:
+    BasicConcatAggregator:
+        method_type: "logid_count_aggregator"
+        max_count: 2
+        max_memory: 5000
diff --git a/mkdocs.yml b/mkdocs.yml
index b5b8fa43..ffe48996 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -66,6 +66,7 @@ nav:
       - 12_LogBERT Detector: detectors/logbert.md
     - Alert Aggregation methods:
       - 00_Basic Concat: alert_aggregators/basic_concatenation.md
+      - 01_LogID Count: alert_aggregators/logid_count.md
     - Helpers:
       - FromTo: helper/from_to.md
     - Auxiliary:

From 241bad683dac5548de98bd03a0b3095676e19d8e Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 13 Oct 2026 13:46:03 +0200
Subject: [PATCH 26/86] solve merge issues

---
 .../alert_aggregation/basic_concat.py           | 17 ++++++++---------
 .../test_alert_aggregators/test_basic_concat.py | 11 +++++------
 2 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/src/detectmatelibrary/alert_aggregation/basic_concat.py b/src/detectmatelibrary/alert_aggregation/basic_concat.py
index b51c0026..b863af3f 100644
--- a/src/detectmatelibrary/alert_aggregation/basic_concat.py
+++ b/src/detectmatelibrary/alert_aggregation/basic_concat.py
@@ -1,5 +1,9 @@
-from detectmatelibrary.common.alert_aggregator import (CoreAlertAggregatorConfig, CoreAlertAggregator)
+from detectmatelibrary.common.alert_aggregator import (
+    CoreAlertAggregatorConfig, CoreAlertAggregator
+)
+
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
+
 from typing import Any, Optional
 from pydantic import Field
 
@@ -21,18 +25,13 @@ def __init__(
     ) -> None:
         if isinstance(config, dict):
             config = BasicConcatAggregationConfig.from_dict(config, name)
+
         buffer_size: int = config.buffer_size  # type: ignore
-        self.deduplicate_values: bool = config.deduplicate_values  # type: ignore
         super().__init__(name=name, buffer_size=buffer_size, config=config)
 
     def aggregate_alerts(
-        self, input_: list[DetectorSchema] | DetectorSchema, output_: AggregateSchema
+        self, input_: list[DetectorSchema], output_: AggregateSchema  # type: ignore
     ) -> bool:
+
         output_["description"] = "Basic aggregation by alert concatenation"
-        if self.deduplicate_values:
-            output_["detectorIDs"] = list(dict.fromkeys(output_["detectorIDs"]))
-            output_["detectorTypes"] = list(dict.fromkeys(output_["detectorTypes"]))
-            output_["alertIDs"] = list(dict.fromkeys(output_["alertIDs"]))
-            output_["logIDs"] = list(dict.fromkeys(output_["logIDs"]))
-            output_["extractedTimestamps"] = list(dict.fromkeys(output_["extractedTimestamps"]))
         return True
diff --git a/tests/test_alert_aggregators/test_basic_concat.py b/tests/test_alert_aggregators/test_basic_concat.py
index 221c14ff..1a788856 100644
--- a/tests/test_alert_aggregators/test_basic_concat.py
+++ b/tests/test_alert_aggregators/test_basic_concat.py
@@ -18,7 +18,6 @@
         "Buffer_6": {
             "method_type": "basic_concat_aggregator",
             "buffer_size": 6,
-            "deduplicate_values": True,
             "auto_config": False,
             "params": {},
         },
@@ -87,10 +86,10 @@ def test_with_buffer_6(self):
         assert result is not None
         assert isinstance(result, AggregateSchema)
         res_dict = result.as_dict()
-        assert res_dict["detectorIDs"] == ["1", "2", "3"]
-        assert res_dict["alertIDs"] == ["1", "2", "3"]
+        assert res_dict["detectorIDs"] == ['1', '2', '3', '1', '1', '1']
+        assert res_dict["alertIDs"] == ['1', '2', '3', '1', '1', '1']
         assert res_dict["outputTimestamp"] == 0
-        assert res_dict["logIDs"] == ["logID1", "logID2", "logID3"]
-        assert len(res_dict["extractedTimestamps"]) == 3
+        assert set(res_dict["logIDs"]) == {"logID1", "logID2", "logID3"}
+        assert len(res_dict["extractedTimestamps"]) == 6
         assert res_dict["description"] == "Basic aggregation by alert concatenation"
-        assert res_dict["detectorTypes"] == ["dummy"]
+        assert set(res_dict["detectorTypes"]) == {"dummy"}

From cda9547c4511e486d714ebe74ac54ec9b44890a8 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 13 Oct 2026 14:01:37 +0200
Subject: [PATCH 27/86] fix issues after merge

---
 .../common/alert_aggregator.py                |   4 +-
 .../test_CustomAlertAggregator.py             |  11 +-
 .../test_basic_concat.py                      | 103 ++++++------------
 .../test_common/test_core_alert_aggregator.py |  20 ++--
 4 files changed, 51 insertions(+), 87 deletions(-)

diff --git a/src/detectmatelibrary/common/alert_aggregator.py b/src/detectmatelibrary/common/alert_aggregator.py
index 3c41e5e9..74213ef5 100644
--- a/src/detectmatelibrary/common/alert_aggregator.py
+++ b/src/detectmatelibrary/common/alert_aggregator.py
@@ -17,7 +17,7 @@ def _extract_field(
     if not isinstance(input_, list):
         input_ = [input_]
 
-    return [str(i[field]) for i in input_]
+    return list(set([str(i[field]) for i in input_]))
 
 
 def _extract_list_field(input_: list[DetectorSchema] | DetectorSchema, field: str) -> list[str]:
@@ -28,7 +28,7 @@ def _extract_list_field(input_: list[DetectorSchema] | DetectorSchema, field: st
     for i in input_:
         final.extend(i[field])
 
-    return final
+    return list(set(final))
 
 
 class CoreAlertAggregatorConfig(CoreConfig):
diff --git a/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomAlertAggregator.py b/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomAlertAggregator.py
index ff111148..0a1fc343 100644
--- a/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomAlertAggregator.py
+++ b/src/detectmatelibrary/tools/workspace/templates/test_templates/test_CustomAlertAggregator.py
@@ -39,11 +39,12 @@ def test_run_aggregate_alerts_method(self) -> None:
             output = alert_aggregator.process(data)
             if i % 3 == 2:
                 assert getattr(output, "description") == "Custom alert aggregation"
-                assert getattr(output, "detectorIDs") == ["MyCoolThing"]*3
+                assert getattr(output, "detectorIDs") == ["MyCoolThing"]
                 assert getattr(output, "alertsObtain")["type"] == \
                        "Anomalies aggregated by CustomAlertAggregator"
-                assert getattr(output, "detectorTypes") == ["MyCoolThing_detector"]*3
-                assert getattr(output, "alertIDs") == [
-                    f"MyCoolThing_{i + 8}", f"MyCoolThing_{i + 9}", f"MyCoolThing_{i + 10}"]
-                assert getattr(output, "logIDs") == [str(i-2), str(i-1), str(i)]
+                assert getattr(output, "detectorTypes") == ["MyCoolThing_detector"]
+                assert set(getattr(output, "alertIDs")) == set([
+                    f"MyCoolThing_{i + 8}", f"MyCoolThing_{i + 9}", f"MyCoolThing_{i + 10}"
+                ])
+                assert set(getattr(output, "logIDs")) == set([str(i-2), str(i-1), str(i)])
             i += 1
diff --git a/tests/test_alert_aggregators/test_basic_concat.py b/tests/test_alert_aggregators/test_basic_concat.py
index 1a788856..d07e1b49 100644
--- a/tests/test_alert_aggregators/test_basic_concat.py
+++ b/tests/test_alert_aggregators/test_basic_concat.py
@@ -1,95 +1,58 @@
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation
-from detectmatelibrary.schemas import AggregateSchema
+
+
 from detectmatelibrary.utils.aux import time_test_mode
+
 import detectmatelibrary.schemas as schemas
-from datetime import datetime
 
 
 time_test_mode()
 
 aggregations_config = {
     "alert_aggregators": {
-        "Buffer_4": {
+        "Buffer_3": {
             "method_type": "basic_concat_aggregator",
-            "buffer_size": 4,
-            "auto_config": False,
-            "params": {},
+            "buffer_size": 3,
         },
-        "Buffer_6": {
+        "Buffer_5": {
             "method_type": "basic_concat_aggregator",
-            "buffer_size": 6,
-            "auto_config": False,
-            "params": {},
+            "buffer_size": 5,
         },
-    },
-    "auto_config": False
+    }
 }
 
 
-data_global = [schemas.DetectorSchema({
-    "detectorID": str(i),
-    "detectorType": "dummy",
-    "alertID": str(i),
-    "detectionTimestamp": 0,
-    "logIDs": [f"logID{i}"],
-    "score": 0.2 + i / 10,
-    "extractedTimestamps": [int(datetime.now().timestamp() + i)],
-    "description": "hello there",
-    "receivedTimestamp": 1,
-    "alertsObtain": {"99 problems": "but logs aint one"}
-}) for i in range(1, 4)]
-
-data_global += [schemas.DetectorSchema({
+dummy_schema = {
     "detectorID": "1",
     "detectorType": "dummy",
-    "alertID": "1",
+    "alertID": "2",
     "detectionTimestamp": 0,
-    "logIDs": [f"logID{1}"],
-    "score": 0.3,
-    "extractedTimestamps": [int(datetime.now().timestamp() + 1)],
+    "logIDs": ["logID1"],
+    "score": 0.2,
+    "extractedTimestamps": [-1],
     "description": "hello there",
     "receivedTimestamp": 1,
     "alertsObtain": {"99 problems": "but logs aint one"}
-}) for i in range(1, 4)]
+}
 
 
 class TestBasicAggregation:
-    def test_with_buffer_4(self):
-        alert_aggregator = BasicConcatAggregation("Buffer_4", aggregations_config)
-        data = data_global
-
-        assert alert_aggregator.process(data[0]) is None
-        assert alert_aggregator.process(data[1]) is None
-        assert alert_aggregator.process(data[2]) is None
-        result = alert_aggregator.process(data[3])
-        assert result is not None
-        assert isinstance(result, AggregateSchema)
-        res_dict = result.as_dict()
-        assert res_dict["detectorIDs"] == ["1", "2", "3", "1"]
-        assert res_dict["alertIDs"] == ["1", "2", "3", "1"]
-        assert res_dict["outputTimestamp"] == 0
-        assert res_dict["logIDs"] == ["logID1", "logID2", "logID3", "logID1"]
-        assert len(res_dict["extractedTimestamps"]) == 4
-        assert res_dict["description"] == "Basic aggregation by alert concatenation"
-        assert res_dict["detectorTypes"] == ["dummy"]*4
-
-    def test_with_buffer_6(self):
-        alert_aggregator = BasicConcatAggregation("Buffer_6", aggregations_config)
-        data = data_global
-
-        assert alert_aggregator.process(data[0]) is None
-        assert alert_aggregator.process(data[1]) is None
-        assert alert_aggregator.process(data[2]) is None
-        assert alert_aggregator.process(data[3]) is None
-        assert alert_aggregator.process(data[4]) is None
-        result = alert_aggregator.process(data[5])
-        assert result is not None
-        assert isinstance(result, AggregateSchema)
-        res_dict = result.as_dict()
-        assert res_dict["detectorIDs"] == ['1', '2', '3', '1', '1', '1']
-        assert res_dict["alertIDs"] == ['1', '2', '3', '1', '1', '1']
-        assert res_dict["outputTimestamp"] == 0
-        assert set(res_dict["logIDs"]) == {"logID1", "logID2", "logID3"}
-        assert len(res_dict["extractedTimestamps"]) == 6
-        assert res_dict["description"] == "Basic aggregation by alert concatenation"
-        assert set(res_dict["detectorTypes"]) == {"dummy"}
+    def test_with_buffer_3(self):
+        alert_aggregator = BasicConcatAggregation("Buffer_3", aggregations_config)
+        data = schemas.DetectorSchema(dummy_schema).serialize()
+
+        assert alert_aggregator.process(data) is None
+        assert alert_aggregator.process(data) is None
+        assert (result := alert_aggregator.process(data)) is not None
+        assert isinstance(result, bytes)
+
+    def test_with_buffer_5(self):
+        alert_aggregator = BasicConcatAggregation("Buffer_5", aggregations_config)
+        data = schemas.DetectorSchema(dummy_schema).serialize()
+
+        assert alert_aggregator.process(data) is None
+        assert alert_aggregator.process(data) is None
+        assert alert_aggregator.process(data) is None
+        assert alert_aggregator.process(data) is None
+        assert (result := alert_aggregator.process(data)) is not None
+        assert isinstance(result, bytes)
diff --git a/tests/test_common/test_core_alert_aggregator.py b/tests/test_common/test_core_alert_aggregator.py
index 1aa180dd..2240ef1b 100644
--- a/tests/test_common/test_core_alert_aggregator.py
+++ b/tests/test_common/test_core_alert_aggregator.py
@@ -125,13 +125,13 @@ def test_process_input_schema_not_serialized_window_3(self) -> None:
         alert_aggregator = MockupAlertAggregator(name="TestDetector", config=MockupConfig(), buffer_size=3)
         expected_result = schemas.AggregateSchema({
             "__version__": "1.0.0",
-            "detectorIDs": ["1", "1", "1"],
-            "detectorTypes": ["dummy", "dummy", "dummy"],
-            "alertIDs": ["2", "2", "2"],
+            "detectorIDs": ["1"],
+            "detectorTypes": ["dummy"],
+            "alertIDs": ["2"],
             "outputTimestamp": 0,
-            "logIDs": ["logID1", "logID1", "logID1"],
+            "logIDs": ["logID1"],
             "description": "Mockup aggregator",
-            "extractedTimestamps": [-1, -1, -1],
+            "extractedTimestamps": [-1],
             "alertsObtain": {}
         })
         data = schemas.DetectorSchema(dummy_schema)
@@ -148,13 +148,13 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
         )
         expected_result = schemas.AggregateSchema({
             "__version__": "1.0.0",
-            "detectorIDs": ["1", "1", "1"],
-            "detectorTypes": ["dummy", "dummy", "dummy"],
-            "alertIDs": ["2", "2", "2"],
+            "detectorIDs": ["1"],
+            "detectorTypes": ["dummy"],
+            "alertIDs": ["2"],
             "outputTimestamp": 0,
-            "logIDs": ["logID1", "logID1", "logID1"],
+            "logIDs": ["logID1"],
             "description": "Mockup aggregator",
-            "extractedTimestamps": [-1, -1, -1],
+            "extractedTimestamps": [-1],
             "alertsObtain": {}
         })
         data = schemas.DetectorSchema(dummy_schema)

From 2876d675a9e69fff1c6a618b2f6f50c6f8c8d299 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 13 Oct 2026 14:02:55 +0200
Subject: [PATCH 28/86] update yaml

---
 docs/examples/alert_aggregators/logid_count.py   | 2 +-
 docs/examples/alert_aggregators/logid_count.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/examples/alert_aggregators/logid_count.py b/docs/examples/alert_aggregators/logid_count.py
index 01af127c..f3e2f230 100644
--- a/docs/examples/alert_aggregators/logid_count.py
+++ b/docs/examples/alert_aggregators/logid_count.py
@@ -26,7 +26,7 @@ def generate_schema(log_id: str | list[str]) -> schemas.DetectorSchema:
     })
 
 
-alert_aggregator = LogIDCountAggegation("LogIDCountAggegation", config)
+alert_aggregator = LogIDCountAggegation("LogIDCountAggregator", config=config)
 
 print(alert_aggregator.process(generate_schema("a")) is None)  # True
 print(alert_aggregator.process(generate_schema("b")) is None)  # True
diff --git a/docs/examples/alert_aggregators/logid_count.yaml b/docs/examples/alert_aggregators/logid_count.yaml
index 78a96e45..bc646f55 100644
--- a/docs/examples/alert_aggregators/logid_count.yaml
+++ b/docs/examples/alert_aggregators/logid_count.yaml
@@ -1,5 +1,5 @@
 alert_aggregators:
-    BasicConcatAggregator:
+    LogIDCountAggregator:
         method_type: "logid_count_aggregator"
         max_count: 2
         max_memory: 5000

From 9830ab4f9936aba2da3ccee08c0d596e017dde07 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 13 Oct 2026 14:08:20 +0200
Subject: [PATCH 29/86] Automated documentation update

---
 docs/alert_aggregators/basic_concatenation.md | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/docs/alert_aggregators/basic_concatenation.md b/docs/alert_aggregators/basic_concatenation.md
index e3332bbc..6334c7ef 100644
--- a/docs/alert_aggregators/basic_concatenation.md
+++ b/docs/alert_aggregators/basic_concatenation.md
@@ -41,20 +41,20 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
 <!-- Start arguments -->
 ??? note "Top level"
 
-| Field | Type | Default | Scope | Description |
-|---|---|---|---|---|
-| `method_type` | string | basic_concat_aggregator | shared | Indicates what type of method it is. |
-| `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `method_type` | string | basic_concat_aggregator | shared | Indicates what type of method it is. |
+    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
 
 ???+ note "params"
 
-| Field | Type | Default | Scope | Description |
-|---|---|---|---|---|
-| `buffer_size` | integer | 3 | specific | Buffer size use in the aggregation. |
-| `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-| `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-| `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
-| `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
-| `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
-| `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `buffer_size` | integer | 3 | specific | Buffer size use in the aggregation. |
+    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
+    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
 <!-- End arguments -->

From d99946cfb0d69afa01b05c8c77e4fa0803370f96 Mon Sep 17 00:00:00 2001
From: viktorbeck98 <viktor.beck98@gmail.com>
Date: Wed, 14 Oct 2026 09:22:43 +0200
Subject: [PATCH 30/86] Keep __version__ as the schema-version field name

Reverts the __version__ -> schemaVersion part of the rename. The schema version value stays at 2.0.0 for the other six renames.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/helper/from_to.md                        | 12 +++----
 src/detectmatelibrary/schemas/_op.py          |  2 +-
 src/detectmatelibrary/schemas/schemas.proto   | 10 +++---
 src/detectmatelibrary/schemas/schemas_pb2.py  | 32 ++++++++---------
 .../tools/workspace/templates/data/logs.json  | 24 ++++++-------
 .../workspace/templates/data/parsed_log.json  | 24 ++++++-------
 tests/test_common/test_core.py                | 14 ++++----
 .../test_common/test_core_alert_aggregator.py |  6 ++--
 tests/test_common/test_core_detector.py       |  6 ++--
 tests/test_common/test_core_parser.py         |  2 +-
 tests/test_schemas/test_field_rename.py       | 35 +++++++++----------
 tests/test_schemas/test_ops.py                | 14 ++++----
 tests/test_schemas/test_schema_class.py       |  6 ++--
 13 files changed, 92 insertions(+), 95 deletions(-)

diff --git a/docs/helper/from_to.md b/docs/helper/from_to.md
index c5bb1c67..887c706b 100644
--- a/docs/helper/from_to.md
+++ b/docs/helper/from_to.md
@@ -103,14 +103,14 @@ Example JSON save file format:
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "schemaVersion": "2.0.0"
+        "__version__": "2.0.0"
     },
     "1": {
         "logID": "1",
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='unit=<*> comm=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "schemaVersion": "2.0.0"
+        "__version__": "2.0.0"
     }
 }
 ```
@@ -236,14 +236,14 @@ Example input data:
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "schemaVersion": "2.0.0"
+        "__version__": "2.0.0"
     },
     "1": {
         "logID": "1",
         "hostname": "",
         "log": "pid=<*> uid=<*> auid=<*> ses=<*> msg='unit=<*> comm=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'",
         "logSource": "",
-        "schemaVersion": "2.0.0"
+        "__version__": "2.0.0"
     }
 }
 ```
@@ -267,7 +267,7 @@ Example output data after parsing:
         ],
         "receivedTimestamp": 1771336089,
         "logID": "0",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "parsedLogID": "10"
     },
     "1": {
@@ -285,7 +285,7 @@ Example output data after parsing:
         ],
         "receivedTimestamp": 1771336089,
         "logID": "1",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "parsedLogID": "11"
     }
 }
diff --git a/src/detectmatelibrary/schemas/_op.py b/src/detectmatelibrary/schemas/_op.py
index c63ebc92..7c2f97c3 100644
--- a/src/detectmatelibrary/schemas/_op.py
+++ b/src/detectmatelibrary/schemas/_op.py
@@ -88,7 +88,7 @@ def get_variables_names(schema: SchemaT) -> list[str]:
 def initialize(schema: SchemaT, **kwargs: Any) -> SchemaT:
     """Initialize a protobuf schema, it uses its arguments and the assigned
     id."""
-    kwargs["schemaVersion"] = __current_version
+    kwargs["__version__"] = __current_version
     return schema(**kwargs)
 
 
diff --git a/src/detectmatelibrary/schemas/schemas.proto b/src/detectmatelibrary/schemas/schemas.proto
index 7eb5a344..fda74cc3 100644
--- a/src/detectmatelibrary/schemas/schemas.proto
+++ b/src/detectmatelibrary/schemas/schemas.proto
@@ -1,11 +1,11 @@
 syntax = "proto3";
 
 message Schema {
-    string schemaVersion = 1;
+    string __version__ = 1;
 }
 
 message LogSchema {
-    optional string schemaVersion = 1;
+    optional string __version__ = 1;
     optional string logID = 2;
     optional string log = 3;
     optional string logSource = 4;
@@ -13,7 +13,7 @@ message LogSchema {
 }
 
 message ParserSchema {
-    optional string schemaVersion = 1;
+    optional string __version__ = 1;
     optional string parserType = 2;
     optional string parserID = 3;
     optional int32 eventID = 4;
@@ -28,7 +28,7 @@ message ParserSchema {
 }
 
 message DetectorSchema {
-    optional string schemaVersion = 1;
+    optional string __version__ = 1;
     optional string detectorID = 2;
     optional string detectorType = 3;
     optional string alertID = 4;
@@ -42,7 +42,7 @@ message DetectorSchema {
 }
 
 message AggregateSchema {
-    optional string schemaVersion = 1;
+    optional string __version__ = 1;
     repeated string detectorIDs = 2;
     repeated string detectorTypes = 3;
     repeated string alertIDs = 4;
diff --git a/src/detectmatelibrary/schemas/schemas_pb2.py b/src/detectmatelibrary/schemas/schemas_pb2.py
index 2b28ea23..5874c4af 100644
--- a/src/detectmatelibrary/schemas/schemas_pb2.py
+++ b/src/detectmatelibrary/schemas/schemas_pb2.py
@@ -13,7 +13,7 @@
 
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\rschemas.proto\"\x1f\n\x06Schema\x12\x15\n\rschemaVersion\x18\x01 \x01(\t\"\xbb\x01\n\tLogSchema\x12\x1a\n\rschemaVersion\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05logID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x10\n\x03log\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x16\n\tlogSource\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x15\n\x08hostname\x18\x05 \x01(\tH\x04\x88\x01\x01\x42\x10\n\x0e_schemaVersionB\x08\n\x06_logIDB\x06\n\x04_logB\x0c\n\n_logSourceB\x0b\n\t_hostname\"\xa0\x04\n\x0cParserSchema\x12\x1a\n\rschemaVersion\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\nparserType\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x15\n\x08parserID\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x65ventID\x18\x04 \x01(\x05H\x03\x88\x01\x01\x12\x15\n\x08template\x18\x05 \x01(\tH\x04\x88\x01\x01\x12\x11\n\tvariables\x18\x06 \x03(\t\x12\x18\n\x0bparsedLogID\x18\x07 \x01(\tH\x05\x88\x01\x01\x12\x12\n\x05logID\x18\x08 \x01(\tH\x06\x88\x01\x01\x12\x10\n\x03log\x18\t \x01(\tH\x07\x88\x01\x01\x12;\n\x0fheaderVariables\x18\n \x03(\x0b\x32\".ParserSchema.HeaderVariablesEntry\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x08\x88\x01\x01\x12\x1c\n\x0fparsedTimestamp\x18\x0c \x01(\x03H\t\x88\x01\x01\x1a\x36\n\x14HeaderVariablesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x10\n\x0e_schemaVersionB\r\n\x0b_parserTypeB\x0b\n\t_parserIDB\n\n\x08_eventIDB\x0b\n\t_templateB\x0e\n\x0c_parsedLogIDB\x08\n\x06_logIDB\x06\n\x04_logB\x14\n\x12_receivedTimestampB\x12\n\x10_parsedTimestamp\"\xfd\x03\n\x0e\x44\x65tectorSchema\x12\x1a\n\rschemaVersion\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\ndetectorID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x19\n\x0c\x64\x65tectorType\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x61lertID\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x1e\n\x11\x64\x65tectedTimestamp\x18\x05 \x01(\x03H\x04\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x12\n\x05score\x18\x08 \x01(\x02H\x05\x88\x01\x01\x12\x15\n\rlogTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x06\x88\x01\x01\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x07\x88\x01\x01\x12\x37\n\x0c\x61lertDetails\x18\x0c \x03(\x0b\x32!.DetectorSchema.AlertDetailsEntry\x1a\x33\n\x11\x41lertDetailsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x10\n\x0e_schemaVersionB\r\n\x0b_detectorIDB\x0f\n\r_detectorTypeB\n\n\x08_alertIDB\x14\n\x12_detectedTimestampB\x08\n\x06_scoreB\x0e\n\x0c_descriptionB\x14\n\x12_receivedTimestamp\"\xf7\x02\n\x0f\x41ggregateSchema\x12\x1a\n\rschemaVersion\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x13\n\x0b\x64\x65tectorIDs\x18\x02 \x03(\t\x12\x15\n\rdetectorTypes\x18\x03 \x03(\t\x12\x10\n\x08\x61lertIDs\x18\x04 \x03(\t\x12 \n\x13\x61ggregatedTimestamp\x18\x05 \x01(\x03H\x01\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x15\n\rlogTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x02\x88\x01\x01\x12\x38\n\x0c\x61lertDetails\x18\x0c \x03(\x0b\x32\".AggregateSchema.AlertDetailsEntry\x1a\x33\n\x11\x41lertDetailsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x10\n\x0e_schemaVersionB\x16\n\x14_aggregatedTimestampB\x0e\n\x0c_descriptionb\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\rschemas.proto\"\x1d\n\x06Schema\x12\x13\n\x0b__version__\x18\x01 \x01(\t\"\xb7\x01\n\tLogSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05logID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x10\n\x03log\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x16\n\tlogSource\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x15\n\x08hostname\x18\x05 \x01(\tH\x04\x88\x01\x01\x42\x0e\n\x0cX__version__B\x08\n\x06_logIDB\x06\n\x04_logB\x0c\n\n_logSourceB\x0b\n\t_hostname\"\x9c\x04\n\x0cParserSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\nparserType\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x15\n\x08parserID\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x65ventID\x18\x04 \x01(\x05H\x03\x88\x01\x01\x12\x15\n\x08template\x18\x05 \x01(\tH\x04\x88\x01\x01\x12\x11\n\tvariables\x18\x06 \x03(\t\x12\x18\n\x0bparsedLogID\x18\x07 \x01(\tH\x05\x88\x01\x01\x12\x12\n\x05logID\x18\x08 \x01(\tH\x06\x88\x01\x01\x12\x10\n\x03log\x18\t \x01(\tH\x07\x88\x01\x01\x12;\n\x0fheaderVariables\x18\n \x03(\x0b\x32\".ParserSchema.HeaderVariablesEntry\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x08\x88\x01\x01\x12\x1c\n\x0fparsedTimestamp\x18\x0c \x01(\x03H\t\x88\x01\x01\x1a\x36\n\x14HeaderVariablesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\r\n\x0b_parserTypeB\x0b\n\t_parserIDB\n\n\x08_eventIDB\x0b\n\t_templateB\x0e\n\x0c_parsedLogIDB\x08\n\x06_logIDB\x06\n\x04_logB\x14\n\x12_receivedTimestampB\x12\n\x10_parsedTimestamp\"\xf9\x03\n\x0e\x44\x65tectorSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x17\n\ndetectorID\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x19\n\x0c\x64\x65tectorType\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x14\n\x07\x61lertID\x18\x04 \x01(\tH\x03\x88\x01\x01\x12\x1e\n\x11\x64\x65tectedTimestamp\x18\x05 \x01(\x03H\x04\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x12\n\x05score\x18\x08 \x01(\x02H\x05\x88\x01\x01\x12\x15\n\rlogTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x06\x88\x01\x01\x12\x1e\n\x11receivedTimestamp\x18\x0b \x01(\x03H\x07\x88\x01\x01\x12\x37\n\x0c\x61lertDetails\x18\x0c \x03(\x0b\x32!.DetectorSchema.AlertDetailsEntry\x1a\x33\n\x11\x41lertDetailsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\r\n\x0b_detectorIDB\x0f\n\r_detectorTypeB\n\n\x08_alertIDB\x14\n\x12_detectedTimestampB\x08\n\x06_scoreB\x0e\n\x0c_descriptionB\x14\n\x12_receivedTimestamp\"\xf3\x02\n\x0f\x41ggregateSchema\x12\x18\n\x0b__version__\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x13\n\x0b\x64\x65tectorIDs\x18\x02 \x03(\t\x12\x15\n\rdetectorTypes\x18\x03 \x03(\t\x12\x10\n\x08\x61lertIDs\x18\x04 \x03(\t\x12 \n\x13\x61ggregatedTimestamp\x18\x05 \x01(\x03H\x01\x88\x01\x01\x12\x0e\n\x06logIDs\x18\x06 \x03(\t\x12\x15\n\rlogTimestamps\x18\t \x03(\x03\x12\x18\n\x0b\x64\x65scription\x18\n \x01(\tH\x02\x88\x01\x01\x12\x38\n\x0c\x61lertDetails\x18\x0c \x03(\x0b\x32\".AggregateSchema.AlertDetailsEntry\x1a\x33\n\x11\x41lertDetailsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x0e\n\x0cX__version__B\x16\n\x14_aggregatedTimestampB\x0e\n\x0c_descriptionb\x06proto3')
 
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, globals())
 _builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'schemas_pb2', globals())
@@ -27,19 +27,19 @@
   _AGGREGATESCHEMA_ALERTDETAILSENTRY._options = None
   _AGGREGATESCHEMA_ALERTDETAILSENTRY._serialized_options = b'8\001'
   _SCHEMA._serialized_start=17
-  _SCHEMA._serialized_end=48
-  _LOGSCHEMA._serialized_start=51
-  _LOGSCHEMA._serialized_end=238
-  _PARSERSCHEMA._serialized_start=241
-  _PARSERSCHEMA._serialized_end=785
-  _PARSERSCHEMA_HEADERVARIABLESENTRY._serialized_start=584
-  _PARSERSCHEMA_HEADERVARIABLESENTRY._serialized_end=638
-  _DETECTORSCHEMA._serialized_start=788
-  _DETECTORSCHEMA._serialized_end=1297
-  _DETECTORSCHEMA_ALERTDETAILSENTRY._serialized_start=1114
-  _DETECTORSCHEMA_ALERTDETAILSENTRY._serialized_end=1165
-  _AGGREGATESCHEMA._serialized_start=1300
-  _AGGREGATESCHEMA._serialized_end=1675
-  _AGGREGATESCHEMA_ALERTDETAILSENTRY._serialized_start=1114
-  _AGGREGATESCHEMA_ALERTDETAILSENTRY._serialized_end=1165
+  _SCHEMA._serialized_end=46
+  _LOGSCHEMA._serialized_start=49
+  _LOGSCHEMA._serialized_end=232
+  _PARSERSCHEMA._serialized_start=235
+  _PARSERSCHEMA._serialized_end=775
+  _PARSERSCHEMA_HEADERVARIABLESENTRY._serialized_start=576
+  _PARSERSCHEMA_HEADERVARIABLESENTRY._serialized_end=630
+  _DETECTORSCHEMA._serialized_start=778
+  _DETECTORSCHEMA._serialized_end=1283
+  _DETECTORSCHEMA_ALERTDETAILSENTRY._serialized_start=1102
+  _DETECTORSCHEMA_ALERTDETAILSENTRY._serialized_end=1153
+  _AGGREGATESCHEMA._serialized_start=1286
+  _AGGREGATESCHEMA._serialized_end=1657
+  _AGGREGATESCHEMA_ALERTDETAILSENTRY._serialized_start=1102
+  _AGGREGATESCHEMA_ALERTDETAILSENTRY._serialized_end=1153
 # @@protoc_insertion_point(module_scope)
diff --git a/src/detectmatelibrary/tools/workspace/templates/data/logs.json b/src/detectmatelibrary/tools/workspace/templates/data/logs.json
index 5bdf9021..f646e103 100644
--- a/src/detectmatelibrary/tools/workspace/templates/data/logs.json
+++ b/src/detectmatelibrary/tools/workspace/templates/data/logs.json
@@ -1,84 +1,84 @@
 {
     "0": {
         "log": "type=USER_ACCT msg=audit(1642723741.072:375): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "0"
     },
     "1": {
         "log": "type=CRED_ACQ msg=audit(1642723741.072:376): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "1"
     },
     "2": {
         "log": "type=LOGIN msg=audit(1642723741.076:377): pid=10125 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=65 res=1",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "2"
     },
     "3": {
         "log": "type=USER_START msg=audit(1642723741.080:378): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "3"
     },
     "4": {
         "log": "type=CRED_DISP msg=audit(1642723741.084:379): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "4"
     },
     "5": {
         "log": "type=USER_END msg=audit(1642723741.084:380): pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "5"
     },
     "6": {
         "log": "type=SERVICE_START msg=audit(1642723752.624:381): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "6"
     },
     "7": {
         "log": "type=SERVICE_STOP msg=audit(1642723752.624:382): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "7"
     },
     "8": {
         "log": "type=USER_ACCT msg=audit(1642724221.094:383): pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "8"
     },
     "9": {
         "log": "type=CRED_ACQ msg=audit(1642724221.098:384): pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "9"
     },
     "10": {
         "log": "type=LOGIN msg=audit(1642724221.098:385): pid=10197 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=66 res=1",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "10"
     },
     "11": {
         "log": "type=USER_START msg=audit(1642724221.102:386): pid=10197 uid=0 auid=0 ses=66 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "hostname": "",
         "logSource": "",
         "logID": "11"
diff --git a/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json b/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json
index 5b7b358b..2e5d6d8b 100644
--- a/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json
+++ b/src/detectmatelibrary/tools/workspace/templates/data/parsed_log.json
@@ -10,7 +10,7 @@
             "Time": "1642723741.072",
             "Content": "pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -41,7 +41,7 @@
             "Time": "1642723741.072",
             "Content": "pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -72,7 +72,7 @@
             "Time": "1642723741.076",
             "Content": "pid=10125 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=65 res=1"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -100,7 +100,7 @@
             "Time": "1642723741.080",
             "Content": "pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -131,7 +131,7 @@
             "Time": "1642723741.084",
             "Content": "pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -162,7 +162,7 @@
             "Time": "1642723741.084",
             "Content": "pid=10125 uid=0 auid=0 ses=65 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10125",
@@ -193,7 +193,7 @@
             "Time": "1642723752.624",
             "Content": "pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "1",
@@ -224,7 +224,7 @@
             "Time": "1642723752.624",
             "Content": "pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=phpsessionclean comm=\"systemd\" exe=\"/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "1",
@@ -255,7 +255,7 @@
             "Time": "1642724221.094",
             "Content": "pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
@@ -286,7 +286,7 @@
             "Time": "1642724221.098",
             "Content": "pid=10197 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
@@ -317,7 +317,7 @@
             "Time": "1642724221.098",
             "Content": "pid=10197 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=66 res=1"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
@@ -345,7 +345,7 @@
             "Time": "1642724221.102",
             "Content": "pid=10197 uid=0 auid=0 ses=66 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
         },
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "receivedTimestamp": 1772027171,
         "variables": [
             "10197",
diff --git a/tests/test_common/test_core.py b/tests/test_common/test_core.py
index e3f523e6..e4142e6f 100644
--- a/tests/test_common/test_core.py
+++ b/tests/test_common/test_core.py
@@ -43,7 +43,7 @@ class MockConfigWithTraining(CoreConfig):
 
 def _make_log(i: int) -> schemas.LogSchema:
     return schemas.LogSchema({
-        "schemaVersion": "2.0.0",
+        "__version__": "2.0.0",
         "logID": str(i),
         "logSource": "test",
         "hostname": "test_hostname"
@@ -241,7 +241,7 @@ def test_training(self) -> None:
         for i in range(10):
             component.process(
                 schemas.LogSchema({
-                    "schemaVersion": "2.0.0",
+                    "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
@@ -251,7 +251,7 @@ def test_training(self) -> None:
         assert len(component.train_data) == component.fitlogic.train_state.data_used
         for i, log in enumerate(component.train_data):
             expected = schemas.LogSchema({
-                "schemaVersion": "2.0.0",
+                "__version__": "2.0.0",
                 "logID": str(i),
                 "logSource": "test",
                 "hostname": "test_hostname"
@@ -267,7 +267,7 @@ def test_training_use_config_data(self) -> None:
         for i in range(10):
             component.process(
                 schemas.LogSchema({
-                    "schemaVersion": "2.0.0",
+                    "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
@@ -278,7 +278,7 @@ def test_training_use_config_data(self) -> None:
         assert len(component.train_data) == total
         for i, log in enumerate(component.train_data):
             expected = schemas.LogSchema({
-                "schemaVersion": "2.0.0",
+                "__version__": "2.0.0",
                 "logID": str(i),
                 "logSource": "test",
                 "hostname": "test_hostname"
@@ -293,7 +293,7 @@ def test_training_force_stop(self) -> None:
                 component.update_state("stop_training")
             component.process(
                 schemas.LogSchema({
-                    "schemaVersion": "2.0.0",
+                    "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
@@ -309,7 +309,7 @@ def test_training_keep_training(self) -> None:
         for i in range(10):
             component.process(
                 schemas.LogSchema({
-                    "schemaVersion": "2.0.0",
+                    "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
                     "hostname": "test_hostname"
diff --git a/tests/test_common/test_core_alert_aggregator.py b/tests/test_common/test_core_alert_aggregator.py
index 5c9148a7..88d09fdf 100644
--- a/tests/test_common/test_core_alert_aggregator.py
+++ b/tests/test_common/test_core_alert_aggregator.py
@@ -107,7 +107,7 @@ def test_process_correct_input_schema(self) -> None:
     def test_process_input_schema_not_serialized(self) -> None:
         alert_aggregator = MockupAlertAggregator(name="TestAAG", config=MockupConfig())
         expected_result = schemas.AggregateSchema({
-            "schemaVersion": "2.0.0",
+            "__version__": "2.0.0",
             "detectorIDs": ["1"],
             "detectorTypes": ["dummy"],
             "alertIDs": ["2"],
@@ -124,7 +124,7 @@ def test_process_input_schema_not_serialized(self) -> None:
     def test_process_input_schema_not_serialized_window_3(self) -> None:
         alert_aggregator = MockupAlertAggregator(name="TestDetector", config=MockupConfig(), buffer_size=3)
         expected_result = schemas.AggregateSchema({
-            "schemaVersion": "2.0.0",
+            "__version__": "2.0.0",
             "detectorIDs": ["1", "1", "1"],
             "detectorTypes": ["dummy", "dummy", "dummy"],
             "alertIDs": ["2", "2", "2"],
@@ -147,7 +147,7 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
             name="TestDetector", config=MockupConfig(), buffer_size=3
         )
         expected_result = schemas.AggregateSchema({
-            "schemaVersion": "2.0.0",
+            "__version__": "2.0.0",
             "detectorIDs": ["1", "1", "1"],
             "detectorTypes": ["dummy", "dummy", "dummy"],
             "alertIDs": ["2", "2", "2"],
diff --git a/tests/test_common/test_core_detector.py b/tests/test_common/test_core_detector.py
index dce2db58..20dfe73b 100644
--- a/tests/test_common/test_core_detector.py
+++ b/tests/test_common/test_core_detector.py
@@ -129,7 +129,7 @@ def test_process_correct_input_schema(self) -> None:
     def test_process_input_schema_not_serialized(self) -> None:
         detector = MockupDetector(name="TestDetector", config=MockupConfig())
         expected_result = schemas.DetectorSchema({
-            "schemaVersion": "2.0.0",
+            "__version__": "2.0.0",
             "detectorID": "TestDetector",
             "detectorType": "core_detector",
             "alertID": "TestDetector_10",
@@ -147,7 +147,7 @@ def test_process_input_schema_not_serialized(self) -> None:
     def test_process_input_schema_not_serialized_window_3(self) -> None:
         detector = MockupDetector_window(name="TestDetector", config=MockupConfig())
         expected_result = schemas.DetectorSchema({
-            "schemaVersion": "2.0.0",
+            "__version__": "2.0.0",
             "detectorID": "TestDetector",
             "detectorType": "core_detector",
             "alertID": "TestDetector_10",
@@ -169,7 +169,7 @@ def test_process_input_schema_not_serialized_window_3(self) -> None:
     def test_process_input_schema_not_serialized_buffer_3(self) -> None:
         detector = MockupDetector_window(name="TestDetector01", config=MockupConfig())
         expected_result = schemas.DetectorSchema({
-            "schemaVersion": "2.0.0",
+            "__version__": "2.0.0",
             "detectorID": "TestDetector01",
             "detectorType": "core_detector",
             "alertID": "TestDetector01_10",
diff --git a/tests/test_common/test_core_parser.py b/tests/test_common/test_core_parser.py
index 4d466e3a..c28117dd 100644
--- a/tests/test_common/test_core_parser.py
+++ b/tests/test_common/test_core_parser.py
@@ -89,7 +89,7 @@ def test_process_correct_input_schema(self) -> None:
     def test_process_correct_input_schema_not_serialize(self) -> None:
         parser = MockupParser(name="TestParser", config=MockupConfig())
         expected_result = schemas.ParserSchema({
-            "schemaVersion": "2.0.0",
+            "__version__": "2.0.0",
             "parserType": "core_parser",
             "parserID": "TestParser",
             "eventID": 1,
diff --git a/tests/test_schemas/test_field_rename.py b/tests/test_schemas/test_field_rename.py
index 389a499a..d3a8ebe1 100644
--- a/tests/test_schemas/test_field_rename.py
+++ b/tests/test_schemas/test_field_rename.py
@@ -5,6 +5,7 @@
 names fail loudly instead of being ignored.
 """
 from detectmatelibrary.detectors.new_value_detector import NewValueDetector
+from detectmatelibrary._testutils.dummy_detector import DummyDetector
 from detectmatelibrary._testutils.dummy_parser import DummyParser
 from detectmatelibrary.helper.from_to import From
 from detectmatelibrary.schemas import (
@@ -18,22 +19,22 @@
 
 # Field name -> field number. The numbers are the wire format and must not change.
 EXPECTED_FIELDS = {
-    "Schema": {"schemaVersion": 1},
+    "Schema": {"__version__": 1},
     "LogSchema": {
-        "schemaVersion": 1, "logID": 2, "log": 3, "logSource": 4, "hostname": 5,
+        "__version__": 1, "logID": 2, "log": 3, "logSource": 4, "hostname": 5,
     },
     "ParserSchema": {
-        "schemaVersion": 1, "parserType": 2, "parserID": 3, "eventID": 4, "template": 5,
+        "__version__": 1, "parserType": 2, "parserID": 3, "eventID": 4, "template": 5,
         "variables": 6, "parsedLogID": 7, "logID": 8, "log": 9, "headerVariables": 10,
         "receivedTimestamp": 11, "parsedTimestamp": 12,
     },
     "DetectorSchema": {
-        "schemaVersion": 1, "detectorID": 2, "detectorType": 3, "alertID": 4,
+        "__version__": 1, "detectorID": 2, "detectorType": 3, "alertID": 4,
         "detectedTimestamp": 5, "logIDs": 6, "score": 8, "logTimestamps": 9,
         "description": 10, "receivedTimestamp": 11, "alertDetails": 12,
     },
     "AggregateSchema": {
-        "schemaVersion": 1, "detectorIDs": 2, "detectorTypes": 3, "alertIDs": 4,
+        "__version__": 1, "detectorIDs": 2, "detectorTypes": 3, "alertIDs": 4,
         "aggregatedTimestamp": 5, "logIDs": 6, "logTimestamps": 9, "description": 10,
         "alertDetails": 12,
     },
@@ -43,15 +44,11 @@
 
 # Every old field name, on each schema that had it.
 OLD_FIELDS = [
-    (LogSchema, "__version__"),
-    (ParserSchema, "__version__"),
     (ParserSchema, "EventID"),
     (ParserSchema, "logFormatVariables"),
-    (DetectorSchema, "__version__"),
     (DetectorSchema, "alertsObtain"),
     (DetectorSchema, "extractedTimestamps"),
     (DetectorSchema, "detectionTimestamp"),
-    (AggregateSchema, "__version__"),
     (AggregateSchema, "alertsObtain"),
     (AggregateSchema, "extractedTimestamps"),
     (AggregateSchema, "outputTimestamp"),
@@ -124,8 +121,8 @@ def test_names_and_numbers(self, message):
     def test_new_instance_reports_version_2(self, schema_class):
         schema = schema_class()
 
-        assert schema.schemaVersion == "2.0.0"
-        assert schema["schemaVersion"] == "2.0.0"
+        assert schema.__version__ == "2.0.0"
+        assert schema["__version__"] == "2.0.0"
 
 
 @pytest.mark.parametrize("schema_class, old_name", OLD_FIELDS)
@@ -152,7 +149,7 @@ def test_log(self):
         schema = LogSchema()
         schema.deserialize(V1_LOG)
 
-        assert schema.schemaVersion == "1.0.0"
+        assert schema.__version__ == "1.0.0"
         assert schema.logID == "3"
         assert schema.log == "user alice logged in"
         assert schema.logSource == "auth.log"
@@ -162,7 +159,7 @@ def test_parser(self):
         schema = ParserSchema()
         schema.deserialize(V1_PARSER)
 
-        assert schema.schemaVersion == "1.0.0"
+        assert schema.__version__ == "1.0.0"
         assert schema.parserType == "matcher"
         assert schema.parserID == "parser-a"
         assert schema.eventID == 7
@@ -179,7 +176,7 @@ def test_detector(self):
         schema = DetectorSchema()
         schema.deserialize(V1_DETECTOR)
 
-        assert schema.schemaVersion == "1.0.0"
+        assert schema.__version__ == "1.0.0"
         assert schema.detectorID == "det-a"
         assert schema.detectorType == "new_value"
         assert schema.alertID == "5"
@@ -195,7 +192,7 @@ def test_aggregate(self):
         schema = AggregateSchema()
         schema.deserialize(V1_AGGREGATE)
 
-        assert schema.schemaVersion == "1.0.0"
+        assert schema.__version__ == "1.0.0"
         assert list(schema.detectorIDs) == ["det-a"]
         assert list(schema.detectorTypes) == ["new_value"]
         assert list(schema.alertIDs) == ["5"]
@@ -209,14 +206,14 @@ def test_aggregate(self):
 class TestStoredJson:
     def test_old_names_are_rejected(self, tmp_path):
         path = tmp_path / "old.json"
-        path.write_text(json.dumps({"0": {"__version__": "1.0.0", "logID": "3", "log": "a log"}}))
+        path.write_text(json.dumps({"0": {"__version__": "1.0.0", "EventID": 7, "logID": "3"}}))
 
-        with pytest.raises(ValueError, match="__version__"):
-            next(From.json(DummyParser(), str(path), do_process=False))
+        with pytest.raises(ValueError, match="EventID"):
+            next(From.json(DummyDetector(), str(path), do_process=False))
 
     def test_new_names_load(self, tmp_path):
         path = tmp_path / "new.json"
-        path.write_text(json.dumps({"0": {"schemaVersion": "2.0.0", "logID": "3", "log": "a log"}}))
+        path.write_text(json.dumps({"0": {"__version__": "2.0.0", "logID": "3", "log": "a log"}}))
 
         schema = next(From.json(DummyParser(), str(path), do_process=False))
 
diff --git a/tests/test_schemas/test_ops.py b/tests/test_schemas/test_ops.py
index 44250b2b..0704980b 100644
--- a/tests/test_schemas/test_ops.py
+++ b/tests/test_schemas/test_ops.py
@@ -7,7 +7,7 @@ class TestCaseSchemas:
     def test_initialize_basic(self):
         schema = op_schemas.initialize(op_schemas.BASE_SCHEMA, **{})
 
-        assert schema.schemaVersion == "2.0.0"
+        assert schema.__version__ == "2.0.0"
 
     def test_initialize_log_schema(self) -> None:
         values = {
@@ -15,7 +15,7 @@ def test_initialize_log_schema(self) -> None:
         }
         schema = op_schemas.initialize(op_schemas.LOG_SCHEMA, **values)
 
-        assert schema.schemaVersion == "2.0.0"
+        assert schema.__version__ == "2.0.0"
         assert schema.logID == "1"
         assert schema.log == "test"
         assert schema.logSource == "example"
@@ -35,7 +35,7 @@ def test_initialize_parser_schema(self) -> None:
         }
         schema = op_schemas.initialize(op_schemas.PARSER_SCHEMA, **values)
 
-        assert schema.schemaVersion == "2.0.0"
+        assert schema.__version__ == "2.0.0"
         assert schema.eventID == 5
         assert schema.template == "test template"
         assert schema.variables == ["a", "b"]
@@ -57,7 +57,7 @@ def test_initialize_detector_schema(self) -> None:
         }
         schema = op_schemas.initialize(op_schemas.DETECTOR_SCHEMA, **values)
 
-        assert schema.schemaVersion == "2.0.0"
+        assert schema.__version__ == "2.0.0"
         assert schema.detectorID == "test id"
         assert schema.detectorType == "type test"
         assert schema.alertID == "1"
@@ -79,7 +79,7 @@ def test_initialize_output_schema(self) -> None:
         }
         schema = op_schemas.initialize(op_schemas.AGGREGATE_SCHEMA, **values)
 
-        assert schema.schemaVersion == "2.0.0"
+        assert schema.__version__ == "2.0.0"
         assert schema.detectorIDs == ["test id", "another id"]
         assert schema.detectorTypes == ["type test", "another type"]
         assert schema.alertIDs == ["1", "2"]
@@ -118,7 +118,7 @@ def test_serialize_method(self) -> None:
 
         new_schema = op_schemas.deserialize(op_schemas.LOG_SCHEMA, bschema)
 
-        assert new_schema.schemaVersion == "2.0.0"
+        assert new_schema.__version__ == "2.0.0"
         assert new_schema.logID == "1"
         assert new_schema.log == "test"
         assert new_schema.logSource == "example"
@@ -147,7 +147,7 @@ def test_get_variables(self) -> None:
         }
         schema = op_schemas.initialize(op_schemas.LOG_SCHEMA, **values)
         vars = op_schemas.get_variables_names(schema)
-        expected_vars = ["logID", "log", "logSource", "hostname", "schemaVersion"]
+        expected_vars = ["logID", "log", "logSource", "hostname", "__version__"]
 
         assert set(vars) == set(expected_vars), f"{vars}"
         assert len(vars) == len(expected_vars), f"{vars}"
diff --git a/tests/test_schemas/test_schema_class.py b/tests/test_schemas/test_schema_class.py
index bc448855..7f7dcf0d 100644
--- a/tests/test_schemas/test_schema_class.py
+++ b/tests/test_schemas/test_schema_class.py
@@ -13,7 +13,7 @@ def test_basic_init(self):
         schema_var = SchemaVariables(schema_class=PARSER_SCHEMA)
 
         assert schema_var.schema_class == PARSER_SCHEMA
-        assert schema_var.get_schema().schemaVersion == "2.0.0"
+        assert schema_var.get_schema().__version__ == "2.0.0"
 
     def test_init_with_kwargs(self):
         values = {
@@ -67,7 +67,7 @@ def test_basic_init(self):
         base_schema = BaseSchema()
 
         assert base_schema.schema_class == BASE_SCHEMA
-        assert base_schema.get_schema().schemaVersion == "2.0.0"
+        assert base_schema.get_schema().__version__ == "2.0.0"
 
     def test_all_initialize(self):
         LogSchema()
@@ -151,7 +151,7 @@ def test_is_field_list(self):
     def test_as_dict(self):
         detector_schema = DetectorSchema()
         assert detector_schema.as_dict() == {
-            "schemaVersion": "2.0.0",
+            "__version__": "2.0.0",
             "detectorID": detector_schema.detectorID,
             "detectorType": detector_schema.detectorType,
             "alertID": detector_schema.alertID,

From d8ecd8e504a718caf19468c84391364a0f88e433 Mon Sep 17 00:00:00 2001
From: viktorbeck98 <viktor.beck98@gmail.com>
Date: Thu, 15 Oct 2026 14:07:24 +0200
Subject: [PATCH 31/86] Remove redundant field rename test file

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/test_schemas/test_field_rename.py | 231 ------------------------
 1 file changed, 231 deletions(-)
 delete mode 100644 tests/test_schemas/test_field_rename.py

diff --git a/tests/test_schemas/test_field_rename.py b/tests/test_schemas/test_field_rename.py
deleted file mode 100644
index d3a8ebe1..00000000
--- a/tests/test_schemas/test_field_rename.py
+++ /dev/null
@@ -1,231 +0,0 @@
-"""Tests for the schema field rename (schema version 1.0.0 -> 2.0.0).
-
-The rename changes field names only. Field numbers and types stay, so
-messages serialized with schema 1.0.0 still deserialize, and the old
-names fail loudly instead of being ignored.
-"""
-from detectmatelibrary.detectors.new_value_detector import NewValueDetector
-from detectmatelibrary._testutils.dummy_detector import DummyDetector
-from detectmatelibrary._testutils.dummy_parser import DummyParser
-from detectmatelibrary.helper.from_to import From
-from detectmatelibrary.schemas import (
-    AggregateSchema, DetectorSchema, FieldNotFound, LogSchema, ParserSchema, schemas_pb2
-)
-
-import json
-
-import pytest
-
-
-# Field name -> field number. The numbers are the wire format and must not change.
-EXPECTED_FIELDS = {
-    "Schema": {"__version__": 1},
-    "LogSchema": {
-        "__version__": 1, "logID": 2, "log": 3, "logSource": 4, "hostname": 5,
-    },
-    "ParserSchema": {
-        "__version__": 1, "parserType": 2, "parserID": 3, "eventID": 4, "template": 5,
-        "variables": 6, "parsedLogID": 7, "logID": 8, "log": 9, "headerVariables": 10,
-        "receivedTimestamp": 11, "parsedTimestamp": 12,
-    },
-    "DetectorSchema": {
-        "__version__": 1, "detectorID": 2, "detectorType": 3, "alertID": 4,
-        "detectedTimestamp": 5, "logIDs": 6, "score": 8, "logTimestamps": 9,
-        "description": 10, "receivedTimestamp": 11, "alertDetails": 12,
-    },
-    "AggregateSchema": {
-        "__version__": 1, "detectorIDs": 2, "detectorTypes": 3, "alertIDs": 4,
-        "aggregatedTimestamp": 5, "logIDs": 6, "logTimestamps": 9, "description": 10,
-        "alertDetails": 12,
-    },
-}
-
-SCHEMA_CLASSES = [LogSchema, ParserSchema, DetectorSchema, AggregateSchema]
-
-# Every old field name, on each schema that had it.
-OLD_FIELDS = [
-    (ParserSchema, "EventID"),
-    (ParserSchema, "logFormatVariables"),
-    (DetectorSchema, "alertsObtain"),
-    (DetectorSchema, "extractedTimestamps"),
-    (DetectorSchema, "detectionTimestamp"),
-    (AggregateSchema, "alertsObtain"),
-    (AggregateSchema, "extractedTimestamps"),
-    (AggregateSchema, "outputTimestamp"),
-]
-
-# Messages serialized with schema 1.0.0, before the rename.
-V1_LOG = bytes.fromhex(
-    "0a05312e302e301201331a147573657220616c696365206c6f6767656420696e2208617574682e6c6f67"
-    "2a06686f73742d31"
-)
-V1_PARSER = bytes.fromhex(
-    "0a05312e302e3012076d6174636865721a087061727365722d6120072a1275736572203c2a3e206c6f67"
-    "67656420696e3205616c6963653a0231314201334a147573657220616c696365206c6f6767656420696e"
-    "520d0a054c6576656c1204494e464f52120a0454696d65120a313730303030303030305881e2cfaa0660"
-    "82e2cfaa06"
-)
-V1_DETECTOR = bytes.fromhex(
-    "0a05312e302e3012056465742d611a096e65775f76616c75652201352883e2cfaa06320133450000803f"
-    "4a0580e2cfaa0652096e65772076616c75655882e2cfaa06622a0a104576656e7449442037202d207573"
-    "65721216556e6b6e6f776e2076616c75653a2027616c69636527"
-)
-V1_AGGREGATE = bytes.fromhex(
-    "0a05312e302e3012056465742d611a096e65775f76616c75652201352884e2cfaa063201334a0580e2cf"
-    "aa065203616767622a0a104576656e7449442037202d20757365721216556e6b6e6f776e2076616c7565"
-    "3a2027616c69636527"
-)
-
-ALERT = {"EventID 7 - user": "Unknown value: 'alice'"}
-
-ALERT_KEY_CONFIG = {
-    "detectors": {
-        "KeyDetector": {
-            "method_type": "new_value_detector",
-            "auto_config": False,
-            "params": {},
-            "events": {
-                7: {
-                    "instance": {
-                        "params": {},
-                        "variables": [{"pos": 0, "name": "user", "params": {}}],
-                    }
-                }
-            }
-        }
-    }
-}
-
-
-def parsed_log(user: str, log_id: str) -> ParserSchema:
-    return ParserSchema({
-        "parserType": "test",
-        "parserID": "test_parser",
-        "eventID": 7,
-        "template": "user <*> logged in",
-        "variables": [user],
-        "logID": log_id,
-        "parsedLogID": log_id,
-        "log": f"user {user} logged in",
-    })
-
-
-class TestFieldNames:
-    @pytest.mark.parametrize("message", list(EXPECTED_FIELDS))
-    def test_names_and_numbers(self, message):
-        fields = getattr(schemas_pb2, message).DESCRIPTOR.fields
-
-        assert {field.name: field.number for field in fields} == EXPECTED_FIELDS[message]
-
-    @pytest.mark.parametrize("schema_class", SCHEMA_CLASSES)
-    def test_new_instance_reports_version_2(self, schema_class):
-        schema = schema_class()
-
-        assert schema.__version__ == "2.0.0"
-        assert schema["__version__"] == "2.0.0"
-
-
-@pytest.mark.parametrize("schema_class, old_name", OLD_FIELDS)
-class TestOldNamesFail:
-    def test_constructor(self, schema_class, old_name):
-        with pytest.raises(ValueError, match=old_name):
-            schema_class({old_name: "1"})
-
-    def test_subscript_read(self, schema_class, old_name):
-        with pytest.raises(FieldNotFound):
-            schema_class()[old_name]
-
-    def test_subscript_write(self, schema_class, old_name):
-        with pytest.raises(FieldNotFound):
-            schema_class()[old_name] = "1"
-
-    def test_attribute_read(self, schema_class, old_name):
-        with pytest.raises(AttributeError):
-            getattr(schema_class(), old_name)
-
-
-class TestSchemaV1Bytes:
-    def test_log(self):
-        schema = LogSchema()
-        schema.deserialize(V1_LOG)
-
-        assert schema.__version__ == "1.0.0"
-        assert schema.logID == "3"
-        assert schema.log == "user alice logged in"
-        assert schema.logSource == "auth.log"
-        assert schema.hostname == "host-1"
-
-    def test_parser(self):
-        schema = ParserSchema()
-        schema.deserialize(V1_PARSER)
-
-        assert schema.__version__ == "1.0.0"
-        assert schema.parserType == "matcher"
-        assert schema.parserID == "parser-a"
-        assert schema.eventID == 7
-        assert schema.template == "user <*> logged in"
-        assert list(schema.variables) == ["alice"]
-        assert schema.parsedLogID == "11"
-        assert schema.logID == "3"
-        assert schema.log == "user alice logged in"
-        assert dict(schema.headerVariables) == {"Time": "1700000000", "Level": "INFO"}
-        assert schema.receivedTimestamp == 1700000001
-        assert schema.parsedTimestamp == 1700000002
-
-    def test_detector(self):
-        schema = DetectorSchema()
-        schema.deserialize(V1_DETECTOR)
-
-        assert schema.__version__ == "1.0.0"
-        assert schema.detectorID == "det-a"
-        assert schema.detectorType == "new_value"
-        assert schema.alertID == "5"
-        assert schema.detectedTimestamp == 1700000003
-        assert list(schema.logIDs) == ["3"]
-        assert schema.score == 1.0
-        assert list(schema.logTimestamps) == [1700000000]
-        assert schema.description == "new value"
-        assert schema.receivedTimestamp == 1700000002
-        assert dict(schema.alertDetails) == ALERT
-
-    def test_aggregate(self):
-        schema = AggregateSchema()
-        schema.deserialize(V1_AGGREGATE)
-
-        assert schema.__version__ == "1.0.0"
-        assert list(schema.detectorIDs) == ["det-a"]
-        assert list(schema.detectorTypes) == ["new_value"]
-        assert list(schema.alertIDs) == ["5"]
-        assert schema.aggregatedTimestamp == 1700000004
-        assert list(schema.logIDs) == ["3"]
-        assert list(schema.logTimestamps) == [1700000000]
-        assert schema.description == "agg"
-        assert dict(schema.alertDetails) == ALERT
-
-
-class TestStoredJson:
-    def test_old_names_are_rejected(self, tmp_path):
-        path = tmp_path / "old.json"
-        path.write_text(json.dumps({"0": {"__version__": "1.0.0", "EventID": 7, "logID": "3"}}))
-
-        with pytest.raises(ValueError, match="EventID"):
-            next(From.json(DummyDetector(), str(path), do_process=False))
-
-    def test_new_names_load(self, tmp_path):
-        path = tmp_path / "new.json"
-        path.write_text(json.dumps({"0": {"__version__": "2.0.0", "logID": "3", "log": "a log"}}))
-
-        schema = next(From.json(DummyParser(), str(path), do_process=False))
-
-        assert schema.logID == "3"
-        assert schema.log == "a log"
-
-
-class TestAlertKeysUnchanged:
-    def test_new_value_detector_keeps_its_alert_key(self):
-        detector = NewValueDetector(config=ALERT_KEY_CONFIG, name="KeyDetector")
-        detector.train(parsed_log("bob", log_id="1"))
-        output = DetectorSchema()
-
-        assert detector.detect(parsed_log("alice", log_id="2"), output)
-        assert dict(output["alertDetails"]) == ALERT

From 2dc4c288c39b58c1032db3f96c3dccd31a6175d1 Mon Sep 17 00:00:00 2001
From: viktorbeck98 <viktor.beck98@gmail.com>
Date: Thu, 15 Oct 2026 16:40:40 +0200
Subject: [PATCH 32/86] JsonParser: eventID -2 without message field, warn when
 no templates

A log without a message field now gets eventID -2 and an empty template,
so it no longer shares -1 with a message that matches no template (and no
longer triggers the template_not_found rule). A parser whose content
parser has no templates logs one warning at the first message.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/parsers/json_parser.md                  | 10 ++++
 src/detectmatelibrary/parsers/json_parser.py | 13 ++++-
 tests/test_parsers/test_json_parser.py       | 50 +++++++++++++++++---
 3 files changed, 66 insertions(+), 7 deletions(-)

diff --git a/docs/parsers/json_parser.md b/docs/parsers/json_parser.md
index 7f3b1ccc..cca796e4 100644
--- a/docs/parsers/json_parser.md
+++ b/docs/parsers/json_parser.md
@@ -23,6 +23,16 @@ With the configuration file below, the `message` field is also matched against t
 --8<-- "docs/examples/parsers/json_parser.py:dict-based"
 ```
 
+## Event IDs
+
+| Log | Event ID | Template |
+|-----|----------|----------|
+| `message` matches a template | that template's ID | the template |
+| `message` matches no template | `-1` | `<Not Found>` |
+| no `message` field | `-2` | empty |
+
+If the content parser has no templates (for example with the defaults, as in the first example), every message gets `-1`. The parser then logs a warning at the first message.
+
 ## Configuration file
 
 The configuration used by the second example above (the first one runs with all defaults). It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
diff --git a/src/detectmatelibrary/parsers/json_parser.py b/src/detectmatelibrary/parsers/json_parser.py
index e500013f..c6519b04 100644
--- a/src/detectmatelibrary/parsers/json_parser.py
+++ b/src/detectmatelibrary/parsers/json_parser.py
@@ -4,6 +4,7 @@
 )
 from detectmatelibrary.common.parser import CoreParser, CoreParserConfig
 from detectmatelibrary.utils.key_extractor import KeyExtractor
+from detectmatelibrary.tools.logging import logger
 from detectmatelibrary import schemas
 
 from collections.abc import Mapping
@@ -11,6 +12,9 @@
 import json
 from pydantic import Field
 
+# eventID of a log without a message field (-1 is a message that matches no template)
+NO_MESSAGE_EVENT_ID = -2
+
 
 def iter_flatten(obj: dict[str, Any], sep: str = ".") -> Iterable[tuple[str, Any]]:
     """Iteratively flattens a nested dict/list JSON-like object. Yields
@@ -79,6 +83,7 @@ def __init__(
             self.content_parser = MatcherParser()
         super().__init__(name=name, config=config)
         self.config: JsonParserConfig
+        self._warn_no_templates = self.content_parser.config.path_templates is None
 
         self.time_extractor = KeyExtractor(key_substr=config.timestamp_name)
         self.content_extractor = KeyExtractor(key_substr=config.content_name)
@@ -89,9 +94,15 @@ def parse(self, input_: schemas.LogSchema, output_: schemas.ParserSchema) -> Non
         timestamp = self.time_extractor.extract(obj=log, delete=True)
         content = self.content_extractor.extract(obj=log, delete=True)
 
-        parsed = {"EventTemplate": "<Not Found>", "Params": [], "EventId": -1}
+        parsed = {"EventTemplate": "", "Params": [], "EventId": NO_MESSAGE_EVENT_ID}
         # if the json also contains a message field, parse it for template and parameters
         if content:
+            if self._warn_no_templates:
+                logger.warning(
+                    f"<<{self.name}>> the content parser has no templates, so every message gets "
+                    "eventID -1. Define the content parser with path_templates in a config dict."
+                )
+                self._warn_no_templates = False
             log_ = schemas.LogSchema({"log": content})
             parsed_content = self.content_parser.process(log_)
             parsed["EventTemplate"] = parsed_content["template"]  # type: ignore
diff --git a/tests/test_parsers/test_json_parser.py b/tests/test_parsers/test_json_parser.py
index 72f3660e..eb6a8e26 100644
--- a/tests/test_parsers/test_json_parser.py
+++ b/tests/test_parsers/test_json_parser.py
@@ -1,4 +1,5 @@
 import json
+import logging
 from detectmatelibrary.parsers.json_parser import (
     JsonParser,
     JsonParserConfig,
@@ -60,10 +61,10 @@ def test_parse_json_without_message(self):
         output = schemas.ParserSchema()
         parser.parse(input_log, output)
 
-        # When no message field, no template is found
-        assert output.template == "<Not Found>"
+        # When no message field, the template is empty and the eventID is -2
+        assert output.template == ""
         assert len(output.variables) == 0
-        assert output.eventID == -1
+        assert output.eventID == -2
 
         # But other fields should be present
         assert "level" in output.headerVariables
@@ -185,8 +186,9 @@ def test_parse_message_with_config_object(self):
         assert output.template == "<Not Found>"
         assert output.eventID == -1
 
-    def test_no_message_differs_from_first_template(self):
-        """Logs without message do not share the first template's EventID."""
+    def test_no_message_differs_from_first_template_and_no_match(self):
+        """Logs without message share neither the first template's eventID nor
+        the eventID of a message that matches no template."""
         config_dict = {
             "parsers": {
                 "TestParser": {
@@ -204,6 +206,7 @@ def test_no_message_differs_from_first_template(self):
 
         json_logs = [
             {"message": "pid=9699 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\""},
+            {"message": "matches no template"},
             {"level": "INFO"},
         ]
 
@@ -213,7 +216,42 @@ def test_no_message_differs_from_first_template(self):
             parser.parse(schemas.LogSchema({"logID": "1", "log": json.dumps(json_log)}), output)
             event_ids.append(output.eventID)
 
-        assert event_ids == [0, -1]
+        assert event_ids == [0, -1, -2]
+
+    def test_warns_once_when_message_meets_no_templates(self, caplog):
+        """A parser without templates warns once, at the first message."""
+        parser = JsonParser(name="TestParser", config=JsonParserConfig())
+
+        def parse(json_log):
+            parser.parse(schemas.LogSchema({"log": json.dumps(json_log)}), schemas.ParserSchema())
+
+        with caplog.at_level(logging.WARNING):
+            parse({"level": "INFO"})
+            assert not caplog.records
+            parse({"message": "hello"})
+            parse({"message": "world"})
+
+        warnings = [r for r in caplog.records if "no templates" in r.message]
+        assert len(warnings) == 1
+
+    def test_no_warning_with_templates(self, caplog):
+        """A parser with templates does not warn about missing templates."""
+        config_dict = {
+            "parsers": {
+                "TestParser": {"auto_config": True, "method_type": "json_parser"},
+                "JsonMatcherParser": {
+                    "auto_config": True,
+                    "method_type": "matcher_parser",
+                    "path_templates": TEST_TEMPLATES
+                }
+            }
+        }
+        parser = JsonParser(name="TestParser", config=config_dict)
+
+        with caplog.at_level(logging.WARNING):
+            parser.parse(schemas.LogSchema({"log": json.dumps({"message": "hello"})}), schemas.ParserSchema())
+
+        assert not [r for r in caplog.records if "no templates" in r.message]
 
     def test_custom_field_names(self):
         """Test with custom timestamp and message field names."""

From 2730373fa0f414a0f542154e60a8629ab26e3841 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Sat, 17 Oct 2026 18:54:48 +0200
Subject: [PATCH 33/86] solve bug missmatch timestamp with logIDs

---
 .../common/alert_aggregator.py                | 23 +++++++++----
 .../test_common/test_core_alert_aggregator.py | 32 ++++++++++++++++++-
 2 files changed, 47 insertions(+), 8 deletions(-)

diff --git a/src/detectmatelibrary/common/alert_aggregator.py b/src/detectmatelibrary/common/alert_aggregator.py
index 74213ef5..f2917210 100644
--- a/src/detectmatelibrary/common/alert_aggregator.py
+++ b/src/detectmatelibrary/common/alert_aggregator.py
@@ -20,15 +20,23 @@ def _extract_field(
     return list(set([str(i[field]) for i in input_]))
 
 
-def _extract_list_field(input_: list[DetectorSchema] | DetectorSchema, field: str) -> list[str]:
+def _extract_list_fields(
+    input_: list[DetectorSchema] | DetectorSchema, field1: str, field2: str
+) -> tuple[list[str], list[str]]:
+
     if not isinstance(input_, list):
         input_ = [input_]
 
-    final = []
-    for i in input_:
-        final.extend(i[field])
+    final1, final2 = [], []
+    already_checked = set()
+    for in_ in input_:
+        for i_1, i_2 in zip(in_[field1], in_[field2]):
+            if i_1 not in already_checked:
+                final1.append(i_1)
+                final2.append(i_2)
+                already_checked.add(i_1)
 
-    return list(set(final))
+    return final1, final2
 
 
 class CoreAlertAggregatorConfig(CoreConfig):
@@ -64,8 +72,9 @@ def run(
         output_["detectorIDs"] = _extract_field(input_, "detectorID")
         output_["detectorTypes"] = _extract_field(input_, "detectorType")
         output_["alertIDs"] = _extract_field(input_, "alertID")
-        output_["logIDs"] = _extract_list_field(input_, "logIDs")
-        output_["extractedTimestamps"] = _extract_list_field(input_, "extractedTimestamps")
+        output_["logIDs"], output_["extractedTimestamps"] = _extract_list_fields(
+            input_, "logIDs", "extractedTimestamps"
+        )
 
         if (alert := self.aggregate_alerts(input_=input_, output_=output_)):
             output_["outputTimestamp"] = get_timestamp()
diff --git a/tests/test_common/test_core_alert_aggregator.py b/tests/test_common/test_core_alert_aggregator.py
index 2240ef1b..b7e96a8c 100644
--- a/tests/test_common/test_core_alert_aggregator.py
+++ b/tests/test_common/test_core_alert_aggregator.py
@@ -1,5 +1,5 @@
 from detectmatelibrary.common.alert_aggregator import (
-    CoreAlertAggregatorConfig, CoreAlertAggregator, BufferMode
+    CoreAlertAggregatorConfig, CoreAlertAggregator, BufferMode, _extract_field, _extract_list_fields
 )
 
 from detectmatelibrary.utils.aux import time_test_mode
@@ -74,6 +74,36 @@ def aggregate_alerts(self, input_, output_):
 time_test_mode()
 
 
+class TestAuxiliar:
+    def test_get_field(self) -> None:
+        expected = {"dummy2", "dummy"}
+
+        dummy_schema2 = dummy_schema.copy()
+        dummy_schema2["detectorType"] = "dummy2"
+        input_ = [dummy_schema, dummy_schema2]
+        input_ = [schemas.DetectorSchema(in_) for in_ in input_]
+
+        assert len(field := _extract_field(input_, "detectorType")) == 2
+        assert expected == set(field)
+
+    def test_get_logID_timestamp(self) -> None:
+        expected_logID = ["logID1", "logID2", "logID3"]
+        expected_times = [-1, 0, 1]
+
+        dummy_schema2 = dummy_schema.copy()
+        dummy_schema2["logIDs"] = ["logID2", "logID3", "logID1"]
+        dummy_schema2["extractedTimestamps"] = [0, 1, 3]
+        input_ = [dummy_schema, dummy_schema2]
+        input_ = [schemas.DetectorSchema(in_) for in_ in input_]
+
+        logids, times = _extract_list_fields(
+            input_, field1="logIDs", field2="extractedTimestamps"
+        )
+
+        assert expected_logID == logids
+        assert times == expected_times
+
+
 class TestCoreAlertAggregator:
     def test_initialize_default(self) -> None:
         detector = MockupAlertAggregator(name="TestAAG", config=dummy_config)

From d08ac336e4d541e1ebb5a0f50c52227b1d436477 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Sat, 17 Oct 2026 18:59:26 +0200
Subject: [PATCH 34/86] improve testing

---
 .../test_common/test_core_alert_aggregator.py | 27 +++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/tests/test_common/test_core_alert_aggregator.py b/tests/test_common/test_core_alert_aggregator.py
index b7e96a8c..bf033693 100644
--- a/tests/test_common/test_core_alert_aggregator.py
+++ b/tests/test_common/test_core_alert_aggregator.py
@@ -75,7 +75,14 @@ def aggregate_alerts(self, input_, output_):
 
 
 class TestAuxiliar:
-    def test_get_field(self) -> None:
+    def test_get_field_single(self) -> None:
+        expected = {"dummy"}
+        input_ = schemas.DetectorSchema(dummy_schema)
+
+        assert len(field := _extract_field(input_, "detectorType")) == 1
+        assert expected == set(field)
+
+    def test_get_field_multiple(self) -> None:
         expected = {"dummy2", "dummy"}
 
         dummy_schema2 = dummy_schema.copy()
@@ -86,7 +93,23 @@ def test_get_field(self) -> None:
         assert len(field := _extract_field(input_, "detectorType")) == 2
         assert expected == set(field)
 
-    def test_get_logID_timestamp(self) -> None:
+    def test_get_logID_timestamp_single(self) -> None:
+        expected_logID = ["logID1", "logID2", "logID3"]
+        expected_times = [-1, 0, 1]
+
+        dummy_schema2 = dummy_schema.copy()
+        dummy_schema2["logIDs"] = ["logID1", "logID2", "logID3", "logID1"]
+        dummy_schema2["extractedTimestamps"] = [-1, 0, 1, 3]
+        input_ = schemas.DetectorSchema(dummy_schema2)
+
+        logids, times = _extract_list_fields(
+            input_, field1="logIDs", field2="extractedTimestamps"
+        )
+
+        assert expected_logID == logids
+        assert times == expected_times
+
+    def test_get_logID_timestamp_multiple(self) -> None:
         expected_logID = ["logID1", "logID2", "logID3"]
         expected_times = [-1, 0, 1]
 

From dbc6ad9ced4e02fb53b3bd2213c67a3e782d4bc9 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Sat, 17 Oct 2026 19:21:51 +0200
Subject: [PATCH 35/86] update README and add logo

---
 README.md         |  99 ++++------------------------------------------
 docs/img/logo.png | Bin 0 -> 20302 bytes
 docs/index.md     |   2 +
 3 files changed, 10 insertions(+), 91 deletions(-)
 create mode 100644 docs/img/logo.png

diff --git a/README.md b/README.md
index 72a284da..22f98718 100644
--- a/README.md
+++ b/README.md
@@ -1,105 +1,22 @@
-# DetectMateLibrary
-
-Main library to run the different components in DetectMate.
-
-## Main structure
-
-The library contains the next components:
-
-* **Parsers**: parse the logs received from the reader.
-* **Detectors**: return alerts if anomalies are detected.
-* **Alert Aggregation**: aggregate the alerts produced by the detectors.
-* **Schemas**: standard data classes used in DetectMate.
-```
- +--------+     +-----------+    +-------------------+
- | Parser | --> |  Detector | -> | Alert Aggregation |
- +--------+     +-----------+    +-------------------+
-```
-## Developer setup:
-
-### Step 1: Install python dependencies
-Set up the dev environment and install pre-commit hooks:
-
-```bash
-uv sync --dev
-uv run prek install
-```
-
-### Step 2: Install Protobuf dependencies
-
-To install in Linux do:
-
-```bash
-sudo apt install -y protobuf-compiler
-protoc --version
-```
-
-This dependency is only needed if a proto file is modified. To compile the proto file do:
-```bash
-protoc --proto_path=src/detectmatelibrary/schemas/ --python_out=src/detectmatelibrary/schemas/ src/detectmatelibrary/schemas/schemas.proto
-```
 
-### Step 3: Run unit tests
-Run the tests:
-
-```bash
-uv run --dev pytest -q
-```
-
-Run the tests with coverage (add --cov-report=html to generate an HTML report):
-
-```bash
-uv run --dev pytest --cov=. --cov-report=term-missing
-```
-
-## Workspace generator (`mate create`)
-
-DetectMateLibrary includes a small CLI helper to bootstrap standalone workspaces
-for custom parsers and detectors. This is useful if you want to develop and test
-components in isolation while still using the same library and schemas.
-
-### Usage
-
-The CLI entry point is `mate` with a `create` command:
-
-```bash
-mate create --type <parser|detector> --name <workspace_name> --dir <target_dir>
-```
+# DetectMateLibrary
 
-| Option   | Description                                                                                                                                                                   |
-|----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `--type` | Component type to generate:<br>- `parser`: CoreParser-based template<br>- `detector`: CoreDetector-based template                                                             |
-| `--name` | Name of the component and package:<br>- Creates package dir: `<target_dir>/<name>/`<br>- Creates main file: `<name>.py`<br>- Derives class names: `<Name>` and `<Name>Config` |
-| `--dir`  | Directory where the workspace will be created                                                                                                                                 |
+![UML](docs/img/logo.png)
 
+DetectMate is a flexible, component-based library for parsing and log anomaly detection.
 
-### What gets generated
+## Installation
 
-For example:
+Download us from `Pip`!!
 
 ```bash
-mate create --type parser --name custom_parser --dir ./workspaces/custom_parser
-```
-
-will create:
-
-```text
-workspaces/custom_parser/          # workspace root
-├── custom_parser/                 # Python package
-│   ├── __init__.py
-│   └── custom_parser.py           # CoreParser-based template
-├── tests/
-│   └── test_custom_parser.py      # generated from template to test custom_parser
-├── data.json                      # example data to run the code
-├── LICENSE.md                     # copied from main project
-├── .gitignore                     # copied from main project
-├── .pre-commit-config.yaml        # copied from main project
-├── pyproject.toml                 # minimal project + dev extras
-└── README.md                      # setup instructions
+pip install detectmatelibrary
 ```
 
 ## Documentation
 
+Main documentations:
+
 - [Project Documentation](https://ait-detectmate.github.io/DetectMateLibrary/latest/)
 
 ## Contribution
diff --git a/docs/img/logo.png b/docs/img/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..a1e6491d93737517758f7381ef9f98ae94ec646c
GIT binary patch
literal 20302
zcmeFZbx_>Rwl0iAaF<}i;O_1Y!CeCkFj$bm2@b(sf@>g1a00>I2_BrFA-D(Ed_&%M
z@3VKEQ}xxUy0_~7u~W$~^lz=zYd!t+>h3i?iBwmW$3T6F3IhX!p{O9E2?GP00DXUf
zf&_j2QVHRK{^<4A)_2ncc>*9VPFA+|V1V0O2p9nNvbBPN@mg|Fcfjlgpgf*1dLZ1E
z_BbCd(Y1ERiQ_BpH>AO+P0}ZfUmv`R$3#$V(_u7x#aHv$oEx|}6&60)i?wT6vpwB^
zhQcaKI2^Aj(la{vj^qQ$cSosTF+ClGJYo{JxKda%!ut;>R2WoJ>=GzEl*~ja-jpEm
zb5v)gmD&o2-`V93Ckuy^QX(%HvgnysVceM`4cXC6kAMj;2NS6>3zwvxj%<N`Fud3X
z8u&<rWYG9RZKb8v6{V&B5e_tnY`?^IrCtf*fxO~ZMcOilfFB7TJU&N93CuC!e~>CA
zFm&f=zCg<)PQoXW@BXsBK4?DM-EW|WtS5>60CR?gO)pEtc-H=L5;!0ncYn5gFS6W@
zj579ex+0e*f3G1!rKHanB#Yh-jFHTw>H}Mm)Fr(SI=N|)4?OXFk-KGjy|b$qO$ZMM
zbWS2ER%ufeX}2ZKzK$%c0G9Xd^lj3;PPj=th#GXt9$`Zh;kMiU?AoVcUc21?il{E?
z6OJ0rpteehFV#uy*SFDiy5)6OqPJ+&vVLzP59;L-2jB>)BtwFQ%1XQCf<1EZ(F}yt
zZg1p`J7w5HjdeI&MlIl9TFzrVA$R(`Nui@}`>24r>*t&u&k3kUtA81H?sq6qi3hkr
zH{K)vEr*wWOVd6zWiH><#RqX-nR+j}?t)D0&t<9QQ3PQ9pbfV=v73e3HOY!?a(Oo=
zHn<0$P-p^n416aIFeyId&GWo=zdl;a^!V)$6U66I@r@Ya0LnWrTPVNuRg{G+oE+Fd
zmQLniHZKPVlz1>OBH~^Uki{FY8^9cFZR;osJZbF&0&FcsfqJ|u94ZiLu#K&Pw+mRy
zTUFb_`;CR5B~V-pRm4jOYQO>P1_F3F*gLukd5Hr5*cF1le{N<60{)1&y%7cKtEdB{
zom{{G9yT5}4pvz&TMsUv7%D)-#nMVhQ%3G@6VTs8fi`Y#5FvJUPft%aPi{6R7i)G-
zK|w)w4lZ^sE>@@ntLs}wH;@;rqbv2ZiN9>ffL$$IY$0y8PL6<Qn;>&1cQ;WW5c(YO
z5C0q>Dk}dp@96qB3Q#=Qy+9ClPBsp92M6|l)o^u_^?(}r+oAta!&MtPP1!ZUu1@YQ
z7GPNqu%jFGznZYL_@_R^-NpV-IF=UdV0*9wRMZvPE9bv;DX*xa{!fi(2&`=#Ab+%=
zVE>z>o2}J<f%R{`JwN#q&c8YWRsW~mf0O=4?0<xzQYtD!GENrm&+aM8hytJc7qWD+
zu(cHW^Oj3M(2|SWf}52`(29?h2V^P8YR+S6$;xjf$ji$C5`aGB_!m=(j;?MXM+@+?
zDX4KaTc{m=Fqf4TCx;a)n4iarm4^>x$!cy1=4BP+<`m$u666vP;Nklh6KXEDP*#HM
z|JAE!Q<hLuoZNyI9Gsk-td;`YP*djI=1_0A_*g-_e4KndAP|owx8)yGmKH*CPA(20
z=y2LPfULpn5J&4j51s)Rl2lg|1#+?d<@lc#b$gJT6;weKsBG)#?)6`y+O`g0EjQ3J
znw<QCTwJ{TeB8X;JiJ^Sg8wC?3wCjZGV$3aCkGq%U(q}dix4yzD6pVso<a@$(SXJx
zB<%tQxjDILJ2}~l0-qfKJZt{*u?loLS%Ta^G9WiF)F=lRpAaX95GTJjr=SoQhY&X}
zGY6Lt$G^xsS=w5?{r{7Go;(1NzlL1F))m_S+doZz%_uFf^IyOH^{c(@pQ!`@{FxL&
zAdA03a0PjQ|3VmQ>#s)^HXui9Ff@DoP1k?4+x`z!ump2*fH}><tX5oH=Bzv%{2Z(x
z5T_ukl>k48!<>)Pg42@c4+{UZ?&@Ua<_U5EOIky5gklAy=O3&941WfS@!zFAZNSf?
z00oSdlY{lY1IGS$!0gXC;~x==u>UtqME(f;OOk=={nZ9dUeH{~{?BCiH)c?O|8M^J
zdo2EMb^!qVr<4B`zW;&iKXCo85cppS|A$@wf$M*T!2e44KkWKH1{dmo9jCyK&|Q!x
z^swYo*tG;bXd#&^$;-gp!Q8^!{HpK%1#Ni&Q7~|YfkDH2{s#+_nN19BM0QhDkwxA|
z#lgX+R^XlufPn$PD9T7`do3Ncd%79v<?h_JpHSh#P^Tv=L~6&SS}J|EFVD72b7d%D
z(%a2FUd+unf?Qo3=dP?CS7sa^WoG0a@8wo~syZ&KvP`odVM9(~9ZsrP2QX{m6EGy<
z!b{-Npuo{^t@?QWhGC2bDu^TiBIKXMc7}G+ePK>o_k4QUImQK%Yu6KdIEOaUtwz{)
z-6xIEXA%$+Wp_(a36WLu8a7t04S9{8mRgK`@7Gq)-X*rMNG1eglYnREgxb!=35;FC
zc@3V>9wqHpreZHW=d>(vWg4>4)d^TIU0lYzHnzS@?gtfh1vZ+r22R?fzf1-wNJJ>t
zdAO1vn`q@P{xUtp`mxZh1hcY)gYW_+(IAFS)Wp}BS{ZKoQ260TJD=BG`%F55B%G9G
z=03Q{%S|uEis&q;CI+68=N)rB1{De}Hn5OGqpQ%=^c`-NN!`h5Rv~8n7lBgF7r_W2
zLp=RDp<Y{`<i=9PfzEA@S<wkRhx1a{G=LDRMUNBInbb^ZaLKH_He!A`FO&ZGX7QDG
z!_&kVZEUrKd);)+raNL#Emje#B2#Qo_l4rxspd_?!|N&zvHOn%__5*7I_T8<vLd$+
zNMk}oTu5!VS$yb1BLDFEYm0f?-4O0r=B0N5*XrBy7f}`J7P!x`PGJI2y-p+DOUGs%
zKYo8#V!YdQIO8Tf$w>wc*Ct7%6=OoARjN+j;B!yy^%puBX$^-|)6}WeRZPXCQf^#m
z3|CF($4JYyGsTO)@>;}#lLzZbs{A1kY-vaSyZif3)PH1#YBNrI&<;Q|rLU{u%qChZ
ziAlbt8aUD5N>+3GKg_Mohbz!X<s<@Nsp{o7m+Y4P<ZG=)PKcw{Z-SIEBa{0D<xQQ~
z3#M+SvS<_`0t_-}&)(H??;?oYAA0M@7SN4M5TB0tkwc6rCuQEg>joep(WSZ%9SsZ(
zp}5OI2Vs(ez`fsV?_g={jwn??%<DJsXKD6jYy9}QD#KTqa|>CG$>|l*y`AS#wlO1^
zfUHTEYrHRCv1z~WgnT$MSJO?K+C1wL7s@>K^zWpUmX@9&d4Y>9<)e?ra`TurCoxqM
zey3*gMrtT8XU~aNF}SeA`qdiNxS)5AYM(j2Lpn4x9)5Uu(nj{)xRl#WztA^vFsgYr
zBVR8XA0Ho4LZzm~@K8h7fpsR&-U5;8VAaGMF+YcK|8DQNMh!#uHP9)B2*f;fbkx7V
zcxJ!B@Mj%@n}PO}%-G~v{+GSTCniIguZM1?-W$fdDke>Gk7*G7k&7<HI~$rl&@i8}
zy&}KLgA}xi3daRM6c$2SR~Y>UxOqaR7}>u6VX9qJIqF%T<5A`%QUU5}K;4Vlp@)GC
zO?*UAQBiKL3EID$V`-%@3?+D}8sJlEi$b(5_*gl(nNj<0eRr1u2^p#MuMw{y&_Dea
z{f3ImVPN<Ny4S&x5=z|oMCe7+;;}s>$$<SC=M-L}eaPT1k+Ia@pQ$6*<BfCD(Dphy
z#6o)O&J`o&3U?2VisBTYu`WqlPi}0b@kv!r*|fvK`#)^!H2JiXJhpyNSNO8%$Ysn%
z1Q!JJ_dtJ%1$!NLzl6><Vy&8hwf>mm&ZFbwFqRT}wltOzh!C0OoD$UL%R`oeKx7I7
z_$-4N=rrHPLvE?M0{?WnZ8Py|-&;9D$HMB}xzx0#QIJ460<ll@o`^KUeGZ#mdpbDS
z0fg>cNg1Ys1;{W@d9v1A#-}zRA070hpJ(W{8M^06Biuo%KJPs$>k+lU@2%y`%NAth
zol#hh_3K_y0R_K5Ob=hQ>Ty-84%W5E9wNKBTqTV0+NOJS;CUJ9%A#^)yx}I~WW_}T
zO)gSe6>G-v;rxrxJb|f49FAqIdVdY=b8St0C)tPRrL3tbrMt`@mKR9&;jJx1kiGM0
zokYH`w&>bWJn*#QLiY(UrOdc|o{M~+3=M+^Ps-=)Z&#>DC_7dV7*li6Y@tl`_U7{F
z9uv&t<0SY)oUuZ+D(P62tUV`^z_sjM+3&RSh8+_-=iS00*;AgU-tDLAcSe8MdfVUZ
zwO2Izk^&apXU#^=E!C?1GfQDftMFzk?6_dID*fMGFV;Jd%+1)%S6nL(qKuPw@-dfx
z4hjl-+ZvC8^o|(P{5N+v3}SA!l@6%vZpi&_?qp-o$3`poaU(~4@_ScTR}GNupFuG<
z(eG$@8GpzyZ-472NfIvJf-<^}@^ud~+NvhULMRPQ7_Uq5paCNZCz<q7$5#jSm#+8?
zt-i~FczjH48a}x$$u9P&A|@lF`HR+cI?owmO320?=P;gOp|0`8EA5rg`T_=s0GUCu
zqpk-2tAIbm3FSQW_QEKOj)l(RiE*qAJJ-fC>u}NBis+bw^IML?Gj-FyNW)scUR0td
zRk-Lx<r-(&xfruPbg}2;B=>!+=P0#zBalY%?<BI^T!$l^YRmt46iVvv>u>H|XOcD&
zs?P8}WoyDxfB=dy;9Jz{$H6*wrw}=QDl_zjdk<#c<GziB-VMmy4!xQ@g-0+n!)%Ar
zGJic=SXtsdIJz9H`Q488VtP%89J9~7wt}q_nmUDY{y~2If<XG*#X!y2%u6m9C*S4J
z<Eu!DRcdN#;%^FvjMwV`IXSt%6FkEwmOj@Bw)qN!>d_$2RhwXz{xNR?*&y!dQIF(q
z!Flbs&`cPdUK6wCVM_h->)10aY*?E=h{$1J;s@dLCQ3g2ijRp=um6+U=o);{O#J=7
zSZ!J=q7I6mG^4ELV_}9%C!b8NtmIsJ@<Ep+NgB(?RPTz?M%#u5QFsv9V;ji^3-5Oo
zIVjh~|Kbwio~QTZH0g}}t*a}-&&+y<v6;2`v@ib5f7E3nhrND362^pl$vBOGZL(Hk
z8*TPhY3%jtVSdJmN7^VFo-*LW%4Tv4kX*NN%oN*!Q$z&aDYgF?2%YahDyjhD&Kq~U
zdOMk~Fw5<A*h0NM#B|xN0^Z&XkF3z#WqEIpn0?zuP9*#Y4VU+l?)|(zp>`bt9BdOZ
z@}~gkM3cGt;Tmr~kvozZ8xEf0JY3L4k+eiBdo8d79fk8;$>$Uh!ASpUt-})*vy;yc
zOCYe7&rn0%-Z0?^FIH}9eqP@B^YhN)9^!_+zM|&MWAr3d9x;3H3$_9By|l9$tJ^F=
zi22zUEEna0dnZ0B+-b*$qWgyJo&x8(*SxJV@@iN|QqLxQnohUe$sApvn+EqHZ=R}A
zBYX#0tM=y&0B?v~@51>wt<9{0Hg@2VCxHY9OD<??c2V*9`H=Sa3+=p}Y$?-;iqApQ
zgNDw{^!bZ=`le1&m$(N7b`1~#^t2J#$20(JGr4RkKq-ldN&}zdGkz8y79S_?yY}9j
zVI#eKopQaLp&APxoCV-=^7Z8v5I0hto=!o+G4#a`6;Q%fpHz=vI8FaR2+~=|LIgdQ
zCjQb=Ii4LNvbcQ^|HqZPrRFJAqYus+4W=xF)Aps_!3dVe2qAv7xKU(8xU#7n9b@X2
zB$_O!VyU$%*u*dtL}ZLesXZ>*27Nn2aePFpVjou|{E7%+N%;s^Z0c4l(VJI@$;pdI
zpkr|RN&<mnfbNjb(jW{!S~9BNlQ!9t`r8<OzMTgko7oxX)z)G3IiiIaNwmVvA~f^A
zxp2qFTyCv{p^J8OJ^>OS#^qA{Nes(uz~r5izO=1u*X7Kv`z!LVM-yK^BQO$@-e)fb
zF-a#8s(LhSYt1`%=(HB+V-R@HuzZ<PhUwZl2St2agEFQOC4ytx^@Ybs6%F48m;Zyw
z)|>^iY~+dk4L-BL_+b3NM^4c6(_6(Z(!T1oCKTDiR;)rOIV-Wf;SK8IH{AsOP}AiA
z(~>Uv3jihA19Q`pTFb!0xvH;!yP=R%Hts}dARc)Ej`Q-?D*$Z?xhIqLcNl>nL-p_n
zgLT554GyHC3g}4Q+G(m?b_8+qDM}1@;zW)|EFPJ2dtC7P8`F+_3n{D(t+^+Lc%803
zk!F7JZXiaqUpB4*ECG*Nu}knaAn8oO`pa;@_}idSn;l?H^=Oke%J>nU#>3F7S6(0c
z5ghbdfs6~kv#ih&X;o75U>7>NgM)$8V=$3Ro`+I7KP+*gbtNnnGiz;+Zho?t;$ur<
z&qhnZ)lR*fH}pPTbuO{0G>LYVwO`PeC=7TR78b_A#U(``$-)Lp(s_|viD$N)sGg%(
z$f8sxD>->{O#Lznbg~NFa#sWiH*QH=&rR*BamBT?wm?JG7lGq)-0S0B-fJ!>T|I)x
z_KE?>Y{V9Wk}Ji=t`fsg;Zyk%7OP%D_ZCQukF2#eP)0~&BcK!zi|c+}*GM$fST~N0
z&PI~8?AsiS_n$>)wSK$ur4G9wchqC{2Xs7C2@`YRdI)GkBh#cce%dz9C}RU6gdz$s
zW2oNH@15l&rJ6f9kDm<(DG`&+R>gOv&I&THa8H-21=;XKJw5rCp_m^d(#%qSY@+wn
z?w1jw7_nO}i=-!@Gf0IU07MDxULZmLMwnk^`^1~htQ~VFRW=E&ESzt+k9k}eQ}^Z=
zp;~X~w|J32nz2z3N`VnGh%%`~jMR&C*}Ey#*?YxzqbeUr?%P>Z$UR<b;49Qt>mF=U
ztbNtqkfqrxSEsVrki$1XBK`iM2A`$8FRL}9Im^uv)q;@HmN6-2epMviOgoFHEF1pX
zek`=IOM==TY3MV0c(0^YyUacukYl4<p<((Ee}KLx^0)XcccTwDfEFJw?>E!M;LrPD
znNCvAB_-{Fvo+^&oviOnQDj&N>3nBq&akapd4MQvcW)GPkGx^i_Q`k2FIBaSbO8m<
z?qac52G1+(osl{2@PwQG@&`v>_iB`{Av$j#H1(gD1V9hJKs|ARXkW*c$)?GjRvt)|
zBh^+LUm%k*4_3C~$wmgfVClXdkgi)}6Vf`ObNqemTq~W4TOVcq;4k+k<N?%nsmopP
z5~H!)qRa0)su@o-&yuyGnkT=Dt1DHMc3Q|+auf^uU}<tnVa=D~OHuNLI&{k48|ih`
z@o6_!6htf|(j^q$EB=5ri+Yhxk54O!U3_!ghX*RKo{rSrH1+eZAlMPA&!RU6f5A~2
zvgc<-cqfUDj;=0?y^r{FyXr@SqEX^jNC#GMdho41s>$N!hSUN}Pqgy+#h67=vs7wP
z%zeoyVYLtbNt=&KU1aJ7uy^h#6kDc6K#fQ>9A1O#fL0R+n<{jc8(zy{4|k2Wbhd^Q
zR^#3mHMk3bu+uWHH;UpqVLmE?;d3xGrLjyrd)eZ6J6H!ZYS^B?QXvVUWLl9x@?!(M
zMqOs7;Ba|%l;BQ+&Ye_WeD_TC53R`1{y~;OE}RC*R9cmrfD2>Ft^>-|N&B{P-{inb
zBQ(iwkLii^bwK|xP!k*bOS!!-_^RA7g}DU(R9)ledyx*Uj8bd!f}w>O9G^ka4MfR^
zEcgSr$-PVG@^Y3=tVCLp&bJ3}<}Y)61p~=Fx4Z49r&02vS3VVV?LpMDS%A%f%WW`v
z+})~)>=qwfd{CE-LS<+604P8N4NoN-0+8X<Fkw~hao-f$67Tm)wr`-@uf}7mD>krs
z6X6>hpfVKP1fED_PS7>%M;rA7+7LOZn+^5}=@FHuFRf4j@GjguweE~?6Bzp}MsX6-
zo9fa}PpsAlB4<mtLNxOHTnI25Ju2;WXGt_PEQ-c6VWBBEak5S&_W%v-anCCZZ=sOQ
zmdc4z5D~e9b5{5{<cYFCV0b6k6_d8RUAf>SE{*!^yg)S%B9DW0K}`PL4<%EDc*_IR
zVglJA^JtWgyf;o5t=rAbBZcwq?oQpZvDcDI1Dp_OX0MssW1MOcJiXpGte?&?SjVZ6
zfM=W(UBFg*>j<}ji@^CInbHDX6K+sO0~>FZ6C!2+891S%i%jVHz+m6=IN-LiF~~kb
zKzr<5E!$MFzH*(($$>k4INN>YPPi}v4Lun;_RtMODld;Zw8Or5(>~icGfUggBusb+
zyKa%JCir4gS`Qu*SKs^1g9DW}uQ~mx{0<(`@j`4X3x0n8%9-Nn)fNMX&!+ZpyvL^#
zjKY^1FB9$d`e3jdZ%IWf%feE>G4k8YI5PC?%)rJdX<|a5GXSLCT4b9-5X>>yKkCeK
zOzIRhtV-znEz`tGH{rIS;3#g`VvAGsLv+xScz9oS(k3R~h9Rom>9vGR;aL@NApJ4x
zRQ+OAYJ4DcS9NibV8H$&BC4AS1yA>QxUH8yQYwi$*C-(GaM4IsLZ$S|Xe5IL?znQT
zgikd!e`>S*yu@j}Pd464_^jBFnIgcS6kV>6Zp4WvW3tJ&xmdRE<hu80u4<1zkqS1W
zO(@U*M~99XLP~PmQVlI$hf%2O>J5VU%GvBsa?I&^9UZRVLaMgg1H!R8WeBFo^)Dp-
zbC%MIikY9n+S=LxdV1tpUfxXJuJ!ERJ;)zVmtLb}(a=q+Ei2C=p5Oee@}Fg2Hdje`
zXf28QmUY^ik#Aeh#QW}PL7vry67|g$IYo0Fe(akv7#NRMa^3O<WiM7jw5aH4SeVez
z(4pB=Q7LFS1$xXIE29B0(cRV-vhbFl-ypCnzkQplj<1bupnP;p<v2@Q>ZcJQv=Z##
zs~3;l>800d)q3j<EjDz*3i-7?%4*EaFy(TFWiBmcJtlI7?eE*Eu<Jv)2qpT9h!#b$
z6lL#%QZ4eHcSTM6YFo#k7Nv)N1U-SPc2`(Q#Vn$oY<M-lb_y`BES`UER#tRR0Z^q)
z8l-^(O`r4+qjp~kKGtj3J-*Vw7syeKGLeKUFyCTVZ$hd3=JA1)GH)Mxn0pf)+jP>c
zlS~L7!>O&SZRs~BB8jc8qmu&pplx9AqTQsG5Zp_F<ts*s!38}AQsH9Aoz;mFVW-x=
zX}GW4(JRasa4zm9i$(-*Z5cdb5~QSXWZ?;mzC=gTwwVC{I)s1j?(e_al~H~!0_+?T
z9W{BqZnd?WXB+DuXiZhUhvFp|V_-M;hATro^JjWlQxh@tj!33MA$CzGEi4rwMMt;B
z!`;ycHjg*PM?4af+X127v9P_o={@z=TFEIV>IOO~7ZG-C51Ae6Cr7e8FN-AQ;iOm)
zntGg1yJ+1o?f93D@r1ulHB}kT)<K6ZneEd~*7CA3J|SV5H=npT<?ZclrbD?64{AxT
zBz!zVh&~GX1^UJjmXpmKiV8iK$lZ+h>|8)Fz;c#N1{*<JN3XnN-8!b|!j}(vy#b|j
zP3;|2X_8A*d0>@)f||yb+XM&sbcH^x+a%GjtIwV*TE(&<3q88O;BB2rRI)6z5R=VJ
z)Z)Aw<H63Who4pR=K5s~KD!gKMQLeix@Vn!yGeXmSs95RAL&<d(l!%z5eh5}DQHz9
z8d?o(yS+nXczJo0L=d-Qq7Se1G+L3QOgG(@b(xxyHX)#2U{XC{_zva^bhH(cWZor0
z9ebHa-V#Gt;?b*gXsi=>X|!*3Nlr^k%Q2B`P%&jAV_>jY(b4PJ*lSm3+ki1#kp@)(
zP^4j1w?o&vR;*}-^;@TkaL&lZs!W{+?c6n2m7^rux(*Z~1lZZx+05f;=qd=^g(A_u
zK>6@OVDQ6QgPECjD^&w!TPvA+`M1p!QA(@!J)Zutv9VA;7ME(mL@<eJ_`4sLiGkRL
z`Q=}*D9QHc>@%07qA^?Z^s|2T-)eIVJkzhXzIW5AY46VGnU=azB^xMHj*X;GQyMR`
zp{G4QYFV1Y#qTjVv6)9)Fzn(T=v%XUu@!Gd#$=rp73Eex)Ysz^M$=ZV+45y+2#wso
zzg@u}+_aox3xQUM&8zs_H@uQPv|{E`(`(LybX<R}Wa#&kq9eW6(;gkpQG$Z<K8W~>
z1OU4Wy0~I!LeF%hFYcsnwhoB$r)|2JG1s%$D?%AP9qAO`bqAISb|kQ6^_s<bw^Kmr
zzoZ&);HH_)@~nisb4INPDPsS)=;;M1Bqwd0o7h`pU}ICgKl>&iNQm}o`zC!93VuQD
zMSCOei*V?+7kWr^xG|>odR%!k=`!9=pKE}e<LnrpE~Am146QfHJ{nUdat^5bC<z&}
za&d43nsF$+ON9m%wGv*ip3}awj%Lf9h=qK*{5V@`lA5ug2IV)yE7!a4ZEYg6Qy$jQ
zvv#2?j`Q{bDKwGa){+9T7p3mEOb&k=LnmeVIl9+jq<dN6QLzPqsfIyDgH2-rLqTx^
zpT%WAu{2mGrMU1Cvw7wH6ST+l>se!&o>reMoT<{qs-B<{N+$`)w^rw-`YfsS8JDT=
zQ>{dz^Pv>mLVw3&g$Au@{-vg-8sLqQXZkX%=fiLS^T^nO|Jtv&pIW1$q700b_b$EP
zPiS=wBqiahlyqX;JVKHUs_8)4m;fRK>2XkB&r+;MX0o+ZmETh^Vv8}`a+AN`Kwh<J
zi`zJBbul$zG!^cYW3ghpN!}O1!#{NrLRk&Sry|54iG7XeN?m5%D#N0^R+QlM7j7Z4
z*f&g%N6Ojf^|>CY(4szydFs!tts?t5Bg;l=cJ_Ft_~)WQzjB#XEffXKUMg9XKeeHV
zMSD3}+0ZiUonHI2XFXsvBO|LyX6LdEPZ{CM=aNT+Y_LhS+J3g4jt*kGiCT&*H2WcN
zCKePFFtQIi@R3IGkiCog(<K{n7=T7ueuP+BMJ2YlaQ*pn0?AQMzATK;#*E9QBM*HC
zzA~~uHupZ2l?6K<R!Nsk+X~?Uo~wp3NSqnU{FRkonVEQUqO$?tV&lpJ0mUUy`a`G6
z`_xoTFm@lSI)`j90L5Hx5{FO{`?=;0eR+0B5?VlozC8E%Keqgf;NLR;((?bT>c0i`
z-yHsL(T7+~(%yXlGTJyChl!IZjZlJwU<)J>;NdMK5;fu<e3@MibvY7)IOSL+S-gRT
zAY(gciEWXhiA9$&{n}zX)e(<PJN9L1SU~6prYJZ*$JeMYSEH3BewKz{nY<aW7A<uB
zCGRSOl&l!C%2M#5D+I$+2V{^#o-*<Z#Idin{}BzR3NrLL_|%5@m9~_l0mbDEi*zCZ
zv?cI6mTNAFT(tAt8VT92O-g?+q}+(?Z##C;F*hT>>q#4c2iY&acRq|T*1I8V-Wf-(
zL{K_a4w@5B8fySX$TkwO^C9}t4$*oN+nM>JIOqxz62T+n-6alUy9i;KaPYZ)c8Giq
zMp4<u=LI;?HZ)-hGChzT?5Ybai>B%5iHVkV)K^|s^0X#5jl$gsh67_+`U<GPDPmv{
zL-rB;F7(pz?2my&B}W7c)Ta}t>cN4P@|{Xw{$(6vvH4J8%IqvIV+ZH_W^Nd&e)yBn
zmh<&rH|eq6e!a1}X;{7U;m$v@(WF5n>}y)FCH}u1aTAn*jAZlSz#De)=D@IP!?RzW
zd}h7HLMSbvo+@~#vK#xveP7~WFIwSk#Q6iy;i)+I-c}B1iHrlj_0|l=cV9`?yR~vI
zAIMKP!@41TRCJ(mHS5SyFza%{@-*wc0^2UWSb4>R--}H7rI>{REmi^$6NJfM1wB%&
zOTg$&VB~`t+I9yk*htZ4w=p-XpT4KvnC6lXRF&{aO-7@Yeam9MTEG8&ixvUbx_E2z
zF7frlp`PiF(=)M%MjmCp#;L_C9An4h?g599Z^DGt0%!e2pxwUy70FJ4#h}i|ydB%o
z)ef)Wx!`{MxZlm!FXMh+0h>P8;OB5kcq+-$e1@2z*av%AKE6^nTet=>7ua(7!on~z
zZFD`AN1KS)jM}M7zyJmWp9V?Ore>GqS!J;m1>9$&$9dvXo=6?Z#KmO@lx(!1GIXwo
zx0ko|RTU`al9*OV*#gT*vYJ+puZ=eZo`!iLhAw!9gxD}Q4^c#MbN+U$!3sT2YRw$$
zr=xd1VRvmeW6sDr44kaC%`&EqKrGpQE5NW0;!YPNo{}}EFhNs5%@Y0Q;U~sSWhDaM
z(A!)<v6QX=rk^ij^~3Q>oy(-C%PwjGt^o|LD+?eBuI=JbsKU^+aQ}A5hWOnvj_<_=
zt*=)Fksbecd9j23^XgX|nHV#62%H%Aal)sQg(mN{2}kX(r%rnB^W3y#aTOIuT*L_K
ztP96N%35%Judh$Kld)z?pR(D@y5_mFR~sqoHq<WShgMrM)Cuj%6+?iiVvir)2lB+-
z3or^L4dBV&-}U&$FTOp8pW2fVIlu8H6Wi!hV0detf*;oa%l_)6lJ(4#rEJiIU`)d*
zD5mA%)R<DvXbt7AAo+JgB4-5~PhmYD<?SV6=}=?7i!I}YT#jA*DKr=pYx8c><Et`L
z3{0ermZg%r6V%|qA7S6#7sx}8`hoO;SL2d5Ved}seI~cax-TW%zNO<6PulPnv<P7#
zj!>6|#=*c)96a9zK-JJpc(+tk#9<hV{mr+nbO=?d16!yH%gn37cm<PkY49s8OexpC
zdWusR<3vPo3*0U%QUnrg5gj!uYDLZa1;9%glo*vVY13+c3hy6$#1<&tJ!N`kD{&z0
z*GI^Dg6}e1#)is=@}|$+Z)C72mfBzH`q)wNO05FK#O8R_%%LY%GSnRuA2<{*xLryN
z;70~^%Q)zic=8u7cwz|dCccBmxfrw@vY5@K=BQx%8q`ildFy`5FfkSxF3)wKL%tK*
zCK+>akNY%!K&J7?<W~h_taqm!FR8)a(@{^eRlDJNKeft>l1Cr1aYf~J6}K+O!S{(M
z3SHlk`@?5Ctk4lujm*4vnNS4uW3a7k%fzbVLgvg#byL!vKaW&9YGMv(9={Jt1dRKy
z2KiAod>Fx#6evEPtXLsIU>i^&zJ!ymQtaxz*4<paf2pCVg&>*j|JmNjbA#Rg)Sw4~
z>4M4}+?ysU@I)D3=HJ1w7Wn(jQ%%xZd9^-K9iP=&*!e<&RMj&MfUA=~uvLskl|PF{
zwjVqMldRD<?(QK{?}M1i!X7T5G&rHJ-ScIef=m>Gk!M0KC%~j;P<5ltPgr+kGclHT
zK=Q6M`gi&G)JEK8(NOh-Jh+O4xp59!z$AO9z;J4xPHjSG@{1>i_xCSFtESWl_<6qD
zfZBG4d_8LW9x<Fg3e8%m*5Z2Uy_n~jFVWKLjnPo54YIs|sW4C)rL;q@&Hib=I8ZuK
z06&A8&h?|Y*4#b{9MLlWVC5psdPeoE`CvN+Lls-52bD*2Zz$!%JbSTzR~dV6x01BL
z-J_bexTz_)JK*lAa5CdkF%JV7*aW#lQYEt=%sAEvDU2!uE741J&4Sj==-px@o$ycB
zQ#B7;oJj0a)1<A_Gw?^t138c?^g(*80P69n8$KP`om3!awum!^k4bAtZr7o5patrn
zy86HYrMvmWld6bM00u>Xi|DUct|cTyWT1?RB_kbJY(+`u0;b%p&%sJWEwwvoDowlS
zqh-Ea$Z#N%d$s1%DMliS1+zi!2`331>Ajea>a~sT1Mx@PK|?ERMf^>&T4H4LuGxf`
za`~1Z>XoLtrKl~>8A)syM3JJFoX@ddb`CVwJ)EhqCzShL<ian_K4;9ZPQu~%Lh@M)
zIV*ma#(1u^2hXVnEOiPOL;8Zb{2NY$R>dYGojRJ}uEpyK?-&X7vP(+DPw@vUJ{E{G
zB*hfh<t&_+quIEJTIq;Ix+;K3PV#p9@9DkICdvD~wr^t@s@dn#0|UF?SBu%0FW|u;
z%X8gV28zezJ>F=MiR``d$soXNb1x+&Vn<(JdzkWIdBZS2L-Gkf+4(fb_2$-T30w7C
zW&j5IanYvn2+qSQrF~DsQ7j{3P@Df3tbkkoyq=@z@x^<m1p|y6M^NZMMwC*HKM%h<
z=wN)SEVpxc`JL+#^(1%_-jrv*rn$pR72&6@9CSrK+ezElr|4E%`;PQ3EXLV9kyy<C
zoaG5@iu_Yh--k>@I6{jx{Iv7wzH*_yNUVrcxRb9IeKKSAjXukJUwRx=xl^p)UiPYe
zo4Qq)VP{0Y*PPuN-VBP%CKC8IU8DP7=)PI%-_#AGMf`n9Iq_p!ZPxUs_g(u<d1sE%
znYuuY2l%!?kqCf_PI=rJroizwN3NICx2co2@CT=A?{-<t1Gyy36@~ly=@a2th<uU-
z*Hya*s<?lEW1j_?lT0_((-Z!9PDid`&bTLH5fC7vh~W~tIVr4i^CL!>8ccbqbhC%0
z23$w8E8uR(-s`JgJsMK5@iN%Hna|_-aBb)kltPQ><Np@vUGJ12tJdo(3RxXQeH0dE
zo}L0VG2e-XyUDk_Z@rRp-#p&@(sW@SMAf?Ubh=EDWvH>-=8!S#I&f+<Z<;8N^bmVA
zAoX|8=cdMi1#%*a-%XJ;3C&LAowEV<+|UnCu76mcG+MibF8)MW-wjeS=qz{<8+LX#
zF+rUqDZKn4A!h!HPclkjT5NuCDO}nbdAm)-=%gxS(Y{a0?5#T+#fo9E`Ro|vP=WO4
z!c1yh)W`LO#D<S(Xh`deJ9-~Qhb$d!+3Zlc=h>(=5KB7R5-+Vf{hhFVOgbZ!?_4nv
zXxgq#&g&m(%MoZ^Lqa#ZI-(P-ek~e36|n@uh%L+qK>$g!m#%xhL{%-l+~r22z7^!c
z2XbmV>-DDoPula@rYs|<gWEb=X!M*!@W(6dxO4=q32V77-Lu^8>V2@`$dtZ`zG<3C
zPF>p$O4A(@7I3{Q!f&_@{RYMNLJAlRR{C~2cDvk9Mm@K<$u;i9j^2%Y8sAY3M+^?2
ziBOBbF7r3p=!*JEhOcL&0h;M9Bcfs?8;775Qfu(Mz5*7zd|9PTo%%Kt%PLGt&y!2T
zh>e?Gj{?+k$mxIkAfRw5ld*0fyK!^cSjp&K`qfy}j`SSFzo%|F83ezJHMkzF&@{t^
zZYrb88;=6)%}C}~pHIIzmQ1zuy(r?|x=OVadmB>I1g5k|K4=^Q6u23jeQZf7)?bZ;
z_7MA#;Y>(Zv}U><jm6Y_5Z*Hdv=;gE@o7DX+3WH;ntt)ob^PqCo4IVX(bU^cP+506
zJ7%rO-D4MluN$bi5!fS`->26yD=74Hi^S~fw6yg%No(A0gs=$qsN8Xli*WF)!`xPE
z&-{U`r29snKd)?n0(g{(OkI<>?p1IHS@bJ`JLhn_%55@zP3RH%v+?_w+w!eFnTyau
z;uj+}wpV7_MXX#FU3*&mr<M*H-|Cal<RrYmBdtdbmAzc7u(%npxLkN#xC{B@no=5~
z#ESXwKyN+8m+m_|4qKnS-@Q$a!LQe(L^^W1`TI$sXGeS`fWQaylk414`zPY~_Igf4
zc`3eOEb4WN{xAOS*F5N5@SdsbS=FnNzCOo46-_sGk6bomO>?{HS#v*<XTu6y%TiMK
z@S(c~4_hy6NcL6xuQ70}55Lw~sBNd%29C&ZMk%16-*9qqMCry;PNm1-gi|^kiSanr
zP>TorILBJ)#1%d+QxkxHxUep9KK@lxHvD5v^b30V$?G!jVQap9s*hBIVE~Rpe@lWZ
zzoo1TrvS)uq&&rWetnBg&jfN#@6EdYul&d@UC{=6Q$B0D4jqi5nq6XDodtFEG_*p+
zKGar>+pV`X@Aau7;8=uk=-yEX6=DXPgyiGFA`NX2`>q1w+U8?S$&Yns(YqsJswCGC
zU=3>9;Kc7*S6(3BBtE8{jc-usocy{-)fBn;fi!!<76m6W-S=tX<Z3hf6`l`l*YWEV
zuiMbE8Uh2n-0=(d=CgCt?CxQu{n1Tv;cubxc}pmMxW5w+sR8qM?PYo>!gEBMdqfSv
zDjVnw#BTbnwl6veQqG71d^BhG5BpN6+P(_*)iUx9+DVP$m-G4rc~5Tz8&j9PIjj@%
z-h-f1Ve5JpH}k9o2An&cWC-z=b*XFU#W?v{Gqe5fr$R4Hf5<|XMnNikf!Mc))<vn)
z%msH!zh)HQN~zBa{{BJic*<w~CW;GRngJJ)C{!_zk>&G;nxRxk*P^|*4)_PmtEh_7
zss`(}30IgD=v^E)BSEo;Huk-^qrOC4k?Z}d7tz6ZdG)}gzUEYTukAB%&Gr@mHz%te
z6{(IQ;5U|9m-(c$(_G2>V>O;V4gJ*c>dw!IPGp{dvK|BdZcA&8@-c)rz&w(14gG}V
zU+Fm*^VL|Tn3A6>W<pN<osiM#9^cD{K(7hjtmrka|H`B6iHK^>Um=zC;z9R=lWck2
z#)FkcaFbnFme=`aC+QP?z7g~W5-L)A3saN~K}Z;!fq}SW0KT1?{_(Qmhp%$0CR!ms
zUPZS=nwp)u)0^D(nMdsx^5(>WM#klI96Zmttwil_34bn)>PMgy1g>CJtMe|Bi5v&6
zJ<bY{kdyTf4klNZF^>vCF9(5CW3`AahS+N)oH$1X^eVbP4vOmNUdqc)9mZbsl4%B9
z*IHQIzW?FOEc->4!(jG^L}2GsDCwk&C?t>pbx@(v8+K}|)aZ2-QqI04wGwJ@?;<0h
z5cAU6chsY9pJUxFo*Mz_q8YDIt*_+C{C6B2o|_QrPJnRAC9N04;uk^n8=f%k6369-
z-_Vat@+XLtTJF7mb{qaASp3{UK};MYcNxwUm7QaypY3{cKP#+jcqmvlSk4&glkI5w
z>((B0D1na|PcKppP5^gNepOYffS@K{7+d;T!7SJI$-mare|(geOnj>=$VSKnog=0`
z`I0G&x2?$EabCWl;(0l6Pw7eHC$<JyANP65v+3ImfZnF-S-s6unjywvjS$Ah#0+5i
zt`YifWOzbxR>bw3xf^F#v#v{9GyB(B3uri$Zu-MYEFb)fA$%62*O8YaE>pgKcR612
zPAEGQ9#Z(kRaXc}cW%qAm1JO@&~yI8ID`!}S*j7#o>h*I>gc{v&c#Eh*~gQ?Hfpq~
zJ;ntdVp@T2Mk5D=n`S<nW6=UGrLSdMAu@%pm>yrBlRbRIn_pT{{{YxMyt1yhk5R2I
zCe(|@i5L48Q5+x;z31zSh}3rfq_ZnS^~o#!67Dzvf|#JVMl#Mhv(x{@ieA;!9hBc2
zZe@-A?dBM$s38*ss%7Q$_xXvGS&czgNrs7;#@{|gL0A-M+$<KwJTGrMrzp|L9O9@K
z!6fz0ez_h2V^(i+BYV}db@tQv$NS?;j~O=RG5uR)ati3;%&nU1(M^!xxKB9Ex%=sD
z$xpce6#ly%>(OtSaR5RTx~vxyBHz+;$zz93hvxObeXe=TWGeDiKh%Eb#h-O^(j&dY
zMG*Qlg8;3z)dnv3>WSJ#SyAfQeUE~hsje7`@bbOY;C{Nxo9Nz5D}_~*fEG3zUn^9R
zOdOgBmHWU1!N!YbWUR>hykUQOx*S0nem|LwU|IFSfmM=bE!5sL%y)A%{A!z)kHx@1
zaAyns7J7k5O_drutN9Wrzg%v-A))+(q!Hct&}JW3lmP4JUMcThf|EkEN0d-l8(j3Z
zu*?Tli4=o06CZC(?bNMrHY3=&tpxGn+To_YlZoD1&g&b4y2=?>ygBu}!jRhOYN5y!
z*sgZcXi)V8vc*~3HJ?VHEPD?CwRA~6Ry5!@iCFWok@iszJr_&u$F)&_e7~>o30#4~
z{v$v7_J#I0{@?4E6{dPQ+haKIs0Q<I$8Y+yMoxF<=ZpLrON#Id48u9Yd^#G)I+y1Y
ze?_&`iXfNs&5gb#Y3^}uDAG&ug21%S6Kvd`tVBw+vQkh1H;fAag8;UcEB}oQIg!)d
zrTTb-9I<AR(ds}5K%i7CEAP|fdqOqac12{1xJ0W=8Fvffa#A6-8J?@pA|lu7tgAwk
zMR(k&$hp21&R+rfdo;K)>)zA(W!BLyZeCZyMjFN%5*S%F&Q>!j<PUCf8S}!}<AN>K
z=w<$^x}d^H2OMg7f-;0Jt=Jk}kJr_KVxe_IVYqmFs|IO_zd~tAcC_!<w6%@YU;Ri-
zfu6u_!X9qgl>G9=H{VNQXOulm;$8I_Qel7zG@FEz3UIxUm=zSL1b&nX^MHxb#`wRH
zsq4Ous9q}^$Jg8FvWV}KZm`ZH=Cb+9NkeX-Tk_<$^)`k{#0d@;L$>y0td1C?%;&9!
zSt+YB8IHCYx@_ov<BIgWsO?*1S~}|87iMfK;=rff3ho6G*I6g0)~Y70uT}gj094G|
z4>ZG-*{>GIo8j=d=D__wkpS3HKvGaa;60^2W?j_lp(G%6gS}DNV~!r-uCfgemoN?}
zkkRzfcW#>ReJ*cI56)T9_EheaaDqNZSYkJh+ZE>K`jc*U%MYDL0}V@tsyemW9;+Ii
z#XwB=Iih<tw~cXR-LBLhc1oy&>&NE>0YmX`tbHKEf~a+-J(T{xH$sM!zD<p&eZkly
zFv##A>L$Q6?Zm>tVPGB0yYMke@kT4P&<j7ih?SiANZccph<{@&c7Yk&<6MhX;^f8g
z1LX(S?+G7u10xZ4WaVxSbDHAyU)DzpH(yf9;<zk65Z{qW6Yo-X?`f@gJ<V3u5bcza
zbgKL4GI6Xg<x>h1h#fH*L=F?Xd6}^`bSDJ~hdGz+E7e%|;b8JMm-snei}JpxTLi<`
zCLjm`C9?;(SPs!PmSSOzcQXpHWf@VXNp?_7-ly1l&Kqx>UU`2=cVqbc-7$-TxMFJ#
zf1m={w39O;>h8yTqOMhcN^jA^UEAZ{Jyk3@<er;paUYm|+WqYq1GESLOu)68DR9t*
z?N*l=NWC5nVxTE$)Aafo_l<FynM*^$<jbAn=Suzv%7=B1Tpx3S{Wno&qZ6?3fI&-z
z4dQ|z6yHLsCTdQE@ZjCn{Q-j#tc}uO95sa12$#Bt&pl@@X~?|gvpz>J?e|%e?jAUO
zFOJ_Xd#X{#@Ns`s$A?y*$#OLiq&P23+%}@)sJuiq4vj4a%LD4)BrWLM%b`SkAE9@k
z&e&xCy^YZExXe_cZ-^Sbf=Y*~PD7%pFU5i_IY}vJ$`Df{j_O%XYVGL7fvbakD#!UV
zEx+c*Ym=<WrOMh6c6j>044b%s$%8N({`Xdiir0D>+ChVEA#f0(a1li|X#*o<J#tvx
zoNHNcMc}Oic1L~)l_vr$qd!BVb36PMvhF8ML{3ER6ZpaGg_;I(W<70*$;gP%0u--z
zkT?YF)37P$Dx#hHM`8-}P2n~D$oss7gxX=f$>^rv8(RWPKL@n^S3?Db?Axsk=8l=F
z-0z(CqxtOHeFPDx{FmwEY0%x8r?x2iizZqi9d8i)q!XJ3l`YZb%I`S8@1brM`l&Qo
zf9KkDjY;UKy-6phkOdHjZc2%(x?}bV<M)e_MxE_b9%tf%TL6gV{Zk1sln;%YUboG&
zHWkcrs#6Q;<arap8VGXIyIAtr6p>~%v$1tKy~MF!Pkk(iQ5DuLEOa-zQe0m%thV#H
z3MT}8VBo-4DH7Eb#@Og8KKe3U)uX5TlX@5kfg}1Z54m+x>#@Y{Fl2;a%EC5{QVsil
zRXm#e6%E(>X`4d3nn{n`Zuz~`E2B_&@f9BoAF<uQe2aCiaG+}lEm+fLJANEv{Wg(<
zrLkzOqMAi2PBFw3Z20}@1Ip96cuu$hyTl9{|7;-h8I8y<{gqQjUAx0nZy~>_(AV**
z?cOZxBjL32GTLC`XbI(RpTTUe-|2XAiIUjF0`ZM{F={Jo#DPi<@0wiG3cltkr1fO@
z$Y`GG{eI+8rh|=vjlxyqAWWp2p9)oCTW&PU{D$w&W@D@sdeYGbXDzOj?FTv9$HmvP
z;<Ie+BK~y=_rMfqO@R3@CY~cdMw&L6?$oo`4UpoJ=V75vqQdgX(P)2LQvrE6udZJI
z;#nn${R1=uj-&=MCKEc-vo)Xf*bo;lN4iQqe#7M`esXJb1;lhdZ5X7ZTUZb#587Ln
z$u6;4=$dtfZu=kJEHOneDHrf=C^Ug037F^AP8u~<^}}$JQ9NZHLz6~>BxGQLb*<@-
zhYI`@0d~|eOnMkagm~ycX>IV%4h$R)i9(VE9j+GSC<>3Xkze_y`Ac8en0vE;H(38t
z*cqlf9j?zxkKZ~ooP%Rm`mK&e&stVAODXifb6ChTwDH0Ou$+5Qm;D@>@IL#&jHB<8
zjCQjvBz#4Aq|**a6bKi8-*!SS&K;o_4qubD4Yq&SjS&*Lnj!Z({3QI@O4&#m$=*OK
zLX8dclkh;2pimfampC&|Mo9_P;mlndHF`BL3Ng!?ChY3UzhaSR>Tb-?vOo3CID22+
z$?_u%iX4Gi>Rc4EYV&Cnf1nh>puPd+*FGRe+s%)=kI8kjc0JTs>={Hp>7>*e7w+h#
z{v9s1FHl+c<{dHf_o9y#(~g6?AQQb9=imG}2PR#LeKJ=VdV5<*xy*A`C^gpY_2yN#
zm|uZ1;YTQC&6<2WNTbQ8N_)$AX)|AlYBtm($PQcxGkztrdGh^S9k-hQtja;jM-4Sv
ztN5C7%nnvV;IzjTL%&%v)ViVzvi8WVo}G3(3Y!g2l$l*tS>z^1PSN7z*ya~+;zIp1
z$6m44aT<5IUFf{wA_jJ6{F;g|SLpg`pwhjRnZxQM3+udb+0v)aW!PBa>b&&eCP<a1
zi3)pNXsqY##ITed8;4Ph*VdMfE6}T?3X>|k>(2IQTWEPUJ?)kgZGAZnbBL)R#IiDw
z7%^<^QI49z=MHn0v*vK?_GZ(`DMTghc77?KjZ{-cQ!tX_(A$i*%=MeNmmD0f;rDy`
zY8z#5--GW)8aY|F3BWwlUtPjHmpCbc^D$2TP8M=sT^=ArAN79)QN46q_~O8*Y<}lS
zHJG_fe2G}Qz{oZ-$PE3yK_6Sl3-qjG{a_bY=u_yo-CA1cjfP2B<)DVMG|a~y3T|#_
zu^yyhk6xg_*Ni&$nLapuKf9^RqADhqaK4NK-z1+@%I7lHaXPp8zYt|4vmi*_+VFgO
zB;5TbBFRW5aK9JZ_x+UC<6)1|X)vi^G)xp*CM-2NZcnc;>)=#=%_NIwY~Oy5Bo@?U
zltZchScWQc?&Y^Mf(;KT>aX2JL_mjLRGRg&($iUb;3tNOmP}8ko_a_!ZoBg#oj#ss
z;LhK(wC-7(<$1sH`v%MN1B-Yan)rZVX7v@FxXN&tf1jYb4epe_MSoTGtVQpfce(?2
zU5a%KX!?=)>@icS?e?5oU~yZz1q<y)KO<Th_$xYg;mZfIaz5>XmJXVtlf{}(n7`*K
zT_1My#tQ;?_{vo$2A{NaEJJ`CkWl*39rd~v+<>bctRL_A$A3(wvE9&uRhOoVEf|>i
zKqH^wD%NzP!@@q(K$qeU`MHA9z9`XZ{>{(a2@Urw<FLs?>Lyk_sV%+=bnYv;FVH92
zYY24PBTU=pDLV7B!GbYx(z2gkOhw>3)yq<3$~!@C)|@y>t3JJLyZ(M~Ix%U}+ed6y
z=6d?G7sICX%VxN^SY)wdz|u&opFH)GC+5S2Y1X7T)7YyU0hoaxyH*@d!p0}dMs^00
z8aE4!r#11$jds(#{;4{66zDe#?R}4H_7L$2NNX+L;^;b6c7NX5;wHkbf+%R-U8nLT
zeh|^aQVPNm^uV)oRnc$$fUA>o%TUFntTyB^Q1h`CJ>bC_tFW>^sBlmia{HCT(F<q>
z_pWOu)+lsv)7=@dbad*&$5C{p+7}03&(-Uy$chjN@l$pt7HE>83~XTQH=SR2zNIbj
z@Ck1v7X`ujE+G*W89!8dFfe6Hutw*nnKYPU|F~4n!9a{fk*wzs{Pt!%U?CKl!hK^Q
z@lBH#7)8$;PF?>2j&-($aT2YRjkj0RuIC#NP1ms^WW`Zd(N+vy*W%S>t)r6Y%e1sj
zO)Y**e-C)kc38K|FhI<gtR*fT1GiFRJ82aS%(;s4z;-SyofKI{K{hz(0pIIlaZJAv
z`~s7*J*<$@vzI(Ed2ZT^lwcomM%N%g&u(Bl%zUPbN!lGubrBi7cGg50m+3sX!&rcZ
z3{Z5goBYW9CIv5N)xL}0WGSk(Vdh6yhtkc(C`?%KCyO|*mHqCTvbo>^Fyg}7HLjVN
zG%0>7who6kh^nuha;_r4bW}dX7ENz<Tv%Qk25YITEL?jqx3p_SFb!5Hn%Ptg1yzb5
zla~Eb50K}zQ#uE+Ws4EW7=U5@Pt=YFj~o2S#FnE*^hBEGNVCt<zmOtmr)Gi}c?-K8
zyML+Z)DY>bYvyA4p=$J#s6h&cz=&*VSQ>(lM1I}_X571=A<kl+=Fx`v`{hDniWl9k
zE3vxa$kd<VWPc<`X&T=SW)I2~5@XSJ5vLOE6yz6UZv(k2gvcv&xzQV%nd>|u`0v;#
zm)Nfggt6n0v9tw#mcr#IhL~Xk;A~iG3fgKBwtcw|b-9&q1?vol!+fcl+WozJ+IE{Z
z!kBTR*`W*cd;MiwO^yg>BQL6sef`X|cS)I2`XjC&e8isyqa0iRUjVTIPX3zG8?#8^
z@cM!n>i1!=eGr!iMiAp1N=$(ilEFEL!Kw!v8@%<oIjF3+!%|{})u2Oup$$SB!+Ud?
z!#&`ItJ8za*IXEmN|3@b<cJJGWYC#)U^)h~z_6k;5B7!<SS?26=jEvC>ryy|{=pF_
zDke6wUI%+=o@(Etv^9ys;dFXbO}>I4pej}W5`|;X<-<VN5L&MG!yA(k3rbL83Phs_
zok>KlPQa?VVieUEp}4>bV}jF)pg#=v@bo*7f;<asx#ro8*?|!Z^!ae@QZJmr2$YC|
zSV#gB*v&Dk1H<wnD@q$mkdtqM-I@bq{_Os4&>Mu?7l5~G7#*EM7>JII*`NeP;$Mwf
zQ+z(tfuSKk2gS98u$0+g76jy4&GEXM#h6VfAd3bb7fa4L7-R7xpKJ=+#(BJq%GlO6
z!;=M<mH6Lg@p@s|Qa9u6hSY*F&Ph=e9<L(+Oh*}_=cXU>_!!NmJ~+*oRphb$APN~j
zqP%s?W@0{D+yX)n1VPLgS~3v?K@cP$1VIo42?#+D1VI8q5ClOiME-wW@q^J4Jopp<
O0000<MNUMnLSTYW>16Z(

literal 0
HcmV?d00001

diff --git a/docs/index.md b/docs/index.md
index 97977898..ad490e77 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,5 +1,7 @@
 # DetectMate Library
 
+![UML](img/logo.png)
+
 Welcome to the documentation for the DetectMate Library. DetectMate is a flexible,
 component-based library for parsing and log anomaly detection. It can be used in research and production,
 and together with the

From 5b33c364e95830d3e62b666e877e0884f7429909 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Sat, 17 Oct 2026 19:23:47 +0200
Subject: [PATCH 36/86] update readme

---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 22f98718..20ae0647 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,8 @@ pip install detectmatelibrary
 
 Main documentations:
 
-- [Project Documentation](https://ait-detectmate.github.io/DetectMateLibrary/latest/)
+- [Library Documentation](https://ait-detectmate.github.io/DetectMateLibrary/latest/) (this repo)
+- [Service Documentation](https://github.com/ait-detectmate/DetectMateService/tree/main)
 
 ## Contribution
 

From 57cf75af8e20ff45e009cecd420616ea645572fb Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 07:46:22 +0200
Subject: [PATCH 37/86] solve unittests issues after merge

---
 tests/test_alert_aggregators/test_basic_concat.py | 2 +-
 tests/test_alert_aggregators/test_logid_count.py  | 6 +++---
 tests/test_common/test_core_alert_aggregator.py   | 8 ++++----
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/tests/test_alert_aggregators/test_basic_concat.py b/tests/test_alert_aggregators/test_basic_concat.py
index 707afd08..46a7c52f 100644
--- a/tests/test_alert_aggregators/test_basic_concat.py
+++ b/tests/test_alert_aggregators/test_basic_concat.py
@@ -26,7 +26,7 @@
     "detectorID": "1",
     "detectorType": "dummy",
     "alertID": "2",
-    "detectionTimestamp": 0,
+    "detectedTimestamp": 0,
     "logIDs": ["logID1"],
     "score": 0.2,
     "logTimestamps": [-1],
diff --git a/tests/test_alert_aggregators/test_logid_count.py b/tests/test_alert_aggregators/test_logid_count.py
index 4bd259ff..7fbd6b93 100644
--- a/tests/test_alert_aggregators/test_logid_count.py
+++ b/tests/test_alert_aggregators/test_logid_count.py
@@ -39,13 +39,13 @@ def generate_schema(log_id: str | list[str]) -> schemas.DetectorSchema:
         "detectorID": "1",
         "detectorType": "dummy",
         "alertID": "2",
-        "detectionTimestamp": 0,
+        "detectedTimestamp": 0,
         "logIDs": log_id,
         "score": 0.2,
-        "extractedTimestamps": [-1],
+        "logTimestamps": [-1],
         "description": "hello there",
         "receivedTimestamp": 1,
-        "alertsObtain": {"99 problems": "but logs aint one"}
+        "alertDetails": {"99 problems": "but logs aint one"}
     })
 
 
diff --git a/tests/test_common/test_core_alert_aggregator.py b/tests/test_common/test_core_alert_aggregator.py
index befb73de..a9756273 100644
--- a/tests/test_common/test_core_alert_aggregator.py
+++ b/tests/test_common/test_core_alert_aggregator.py
@@ -99,11 +99,11 @@ def test_get_logID_timestamp_single(self) -> None:
 
         dummy_schema2 = dummy_schema.copy()
         dummy_schema2["logIDs"] = ["logID1", "logID2", "logID3", "logID1"]
-        dummy_schema2["extractedTimestamps"] = [-1, 0, 1, 3]
+        dummy_schema2["logTimestamps"] = [-1, 0, 1, 3]
         input_ = schemas.DetectorSchema(dummy_schema2)
 
         logids, times = _extract_list_fields(
-            input_, field1="logIDs", field2="extractedTimestamps"
+            input_, field1="logIDs", field2="logTimestamps"
         )
 
         assert expected_logID == logids
@@ -115,12 +115,12 @@ def test_get_logID_timestamp_multiple(self) -> None:
 
         dummy_schema2 = dummy_schema.copy()
         dummy_schema2["logIDs"] = ["logID2", "logID3", "logID1"]
-        dummy_schema2["extractedTimestamps"] = [0, 1, 3]
+        dummy_schema2["logTimestamps"] = [0, 1, 3]
         input_ = [dummy_schema, dummy_schema2]
         input_ = [schemas.DetectorSchema(in_) for in_ in input_]
 
         logids, times = _extract_list_fields(
-            input_, field1="logIDs", field2="extractedTimestamps"
+            input_, field1="logIDs", field2="logTimestamps"
         )
 
         assert expected_logID == logids

From 8662d24cb8513162902c57c242ae30870e345fae Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 08:24:37 +0200
Subject: [PATCH 38/86] add pipeline first draft and compress schema name

---
 .../alert_aggregators/basic_concat.py         |  4 +-
 .../detectors/random_detector.py              |  8 +-
 src/detectmatelibrary/pipeline.py             | 95 +++++++++++++++++++
 .../utils/data_normalizer.py                  |  6 +-
 .../test_basic_concat.py                      |  6 +-
 .../test_variable_detector.py                 |  4 +-
 tests/test_common/test_core.py                | 28 +++---
 .../test_common/test_core_alert_aggregator.py | 22 ++---
 tests/test_common/test_core_detector.py       | 22 ++---
 tests/test_common/test_core_parser.py         | 16 ++--
 tests/test_common/test_extract_timestamp.py   | 18 ++--
 tests/test_common/test_train_buffer.py        | 18 ++--
 .../test_bigram_frequency_detector.py         | 38 ++++----
 tests/test_detectors/test_charset_detector.py | 38 ++++----
 tests/test_detectors/test_deeplog_detector.py |  8 +-
 .../test_event_sequence_detector.py           | 34 +++----
 tests/test_detectors/test_logbert_detector.py |  8 +-
 .../test_detectors/test_mismatch_warnings.py  |  6 +-
 .../test_detectors/test_new_event_detector.py | 24 ++---
 .../test_new_value_combo_detector.py          | 72 +++++++-------
 .../test_detectors/test_new_value_detector.py | 30 +++---
 tests/test_detectors/test_random_detector.py  |  8 +-
 tests/test_detectors/test_rule_detector.py    | 40 ++++----
 .../test_value_range_detector.py              | 48 +++++-----
 tests/test_helper/test_from_to.py             | 18 ++--
 tests/test_parsers/test_json_parser.py        | 26 ++---
 tests/test_parsers/test_logbatcher_parser.py  | 12 +--
 .../test_time_dependent_stability.py          |  4 +-
 tests/test_pipelines/test_dummy_methods.py    | 12 +--
 29 files changed, 384 insertions(+), 289 deletions(-)
 create mode 100644 src/detectmatelibrary/pipeline.py

diff --git a/docs/examples/alert_aggregators/basic_concat.py b/docs/examples/alert_aggregators/basic_concat.py
index 27cb326e..b816e99b 100644
--- a/docs/examples/alert_aggregators/basic_concat.py
+++ b/docs/examples/alert_aggregators/basic_concat.py
@@ -2,7 +2,7 @@
 # --8<-- [start:example_1]
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 
 aggregations_config = {
@@ -17,7 +17,7 @@
 }
 
 
-input_ = schemas.DetectorSchema({
+input_ = sc.DetectorSchema({
     "detectorID": "1",
     "detectorType": "dummy",
     "alertID": "2",
diff --git a/src/detectmatelibrary/detectors/random_detector.py b/src/detectmatelibrary/detectors/random_detector.py
index 3ad33ad4..44c05056 100644
--- a/src/detectmatelibrary/detectors/random_detector.py
+++ b/src/detectmatelibrary/detectors/random_detector.py
@@ -4,7 +4,7 @@
 
 from detectmatelibrary.utils.data_buffer import BufferMode
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 from typing_extensions import override
 from typing import List
@@ -34,15 +34,15 @@ def __init__(
         self.config: RandomDetectorConfig
 
     @override
-    def train(self, input_: List[schemas.ParserSchema] | schemas.ParserSchema) -> None:
+    def train(self, input_: List[sc.ParserSchema] | sc.ParserSchema) -> None:
         """Training is not applicable for RandomDetector."""
         return
 
     @override
     def detect(
         self,
-        input_: schemas.ParserSchema,  # type: ignore
-        output_: schemas.DetectorSchema,
+        input_: sc.ParserSchema,  # type: ignore
+        output_: sc.DetectorSchema,
     ) -> bool:
         """Detect anomalies randomly in the input data."""
         overall_score = 0.0
diff --git a/src/detectmatelibrary/pipeline.py b/src/detectmatelibrary/pipeline.py
new file mode 100644
index 00000000..c230f102
--- /dev/null
+++ b/src/detectmatelibrary/pipeline.py
@@ -0,0 +1,95 @@
+
+from detectmatelibrary.common.core import CoreComponent, CoreConfig
+from detectmatelibrary.common.detector import CoreDetectorConfig
+from detectmatelibrary.common.parser import CoreParserConfig
+
+from detectmatelibrary.utils.data_buffer import ArgsBuffer, BufferMode
+
+import detectmatelibrary.schemas as sc
+
+from typing import Any, Optional, overload, override
+from pydantic import Field
+
+
+class PipelineConfig(CoreConfig):
+    component_type: str = Field(default="main_pipeline", description="<$IGNORE$>")
+    method_type: str = Field(default="pipeline", description="<$IGNORE$>")
+
+    do_parsing: bool = Field(default=True, description="Run parser in the pipeline.")
+    do_aggregation: bool = Field(default=True, description="Run aggregator in the pipeline.")
+
+    parser: CoreParserConfig | dict[str, Any] | None = Field(
+        default=None, description="Parser configuration use, if do_parsing=False keep empty."
+    )
+    detectors: list[CoreDetectorConfig | dict[str, Any]] | None = Field(
+        default=None, description="Detectors configuration use."
+    )
+    aggregators: CoreParserConfig | dict[str, Any] | None = Field(
+        default=None, description="Aggregator configuration use, if do_aggregation=False keep empty."
+    )
+
+
+def _select_input(config: PipelineConfig) -> type[sc.BaseSchema]:
+    return sc.LogSchema if config.do_parsing else sc.ParserSchema
+
+
+def _select_output(config: PipelineConfig) -> type[sc.BaseSchema]:
+    return sc.DetectorSchema if config.do_aggregation else sc.AggregateSchema
+
+
+class Pipeline(CoreComponent):
+    def __init__(
+        self,
+        name: str = "MainPipeline",
+        buffer_mode: BufferMode = BufferMode.WINDOW,
+        buffer_size: Optional[int] = 1,
+        config: PipelineConfig | dict[str, Any] = PipelineConfig(),
+    ) -> None:
+        if isinstance(config, dict):
+            config = PipelineConfig.from_dict(config, name)
+
+        super().__init__(
+            name=name,
+            type_=config.method_type,
+            config=config,
+            args_buffer=ArgsBuffer(mode=buffer_mode, size=buffer_size),
+            input_schema=_select_input(config),
+            output_schema=_select_output(config),
+        )
+        self.config: PipelineConfig
+
+    @overload    # type: ignore
+    @override
+    def run(
+        self,
+        input_: list[sc.LogSchema] | sc.LogSchema,
+        output_: list[sc.DetectorSchema] | sc.DetectorSchema
+    ) -> bool:
+        pass
+
+    @overload
+    @override
+    def run(self, input_: list[sc.LogSchema] | sc.LogSchema,  output_: sc.AggregateSchema) -> bool:
+        pass
+
+    @overload
+    @override
+    def run(
+        self,
+        input_: list[sc.ParserSchema] | sc.ParserSchema,
+        output_: list[sc.DetectorSchema] | sc.DetectorSchema
+    ) -> bool:
+        pass
+
+    @overload
+    @override
+    def run(self, input_: list[sc.ParserSchema] | sc.ParserSchema,  output_: sc.AggregateSchema) -> bool:
+        pass
+
+    @override
+    def run(
+        self,
+        input_: list[sc.LogSchema] | sc.LogSchema | list[sc.ParserSchema] | sc.ParserSchema,
+        output_: list[sc.DetectorSchema] | sc.DetectorSchema | sc.AggregateSchema
+    ) -> bool:
+        return True
diff --git a/src/detectmatelibrary/utils/data_normalizer.py b/src/detectmatelibrary/utils/data_normalizer.py
index 167ec481..a79a225d 100644
--- a/src/detectmatelibrary/utils/data_normalizer.py
+++ b/src/detectmatelibrary/utils/data_normalizer.py
@@ -1,4 +1,4 @@
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 from typing import Any
 import pandas as pd
@@ -13,8 +13,8 @@ class DataNormalizer:
     def __init__(
         self,
         data: pd.DataFrame | dict[str, Any] | list[Any],
-        input_schema: schemas.BaseSchema,
-        output_schema: schemas.BaseSchema
+        input_schema: sc.BaseSchema,
+        output_schema: sc.BaseSchema
     ) -> None:
         self.data = data
         self.input_schema = input_schema
diff --git a/tests/test_alert_aggregators/test_basic_concat.py b/tests/test_alert_aggregators/test_basic_concat.py
index 08d60c60..17a26087 100644
--- a/tests/test_alert_aggregators/test_basic_concat.py
+++ b/tests/test_alert_aggregators/test_basic_concat.py
@@ -1,7 +1,7 @@
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation
 from detectmatelibrary.schemas import AggregateSchema
 from detectmatelibrary.utils.aux import time_test_mode
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from datetime import datetime
 
 
@@ -27,7 +27,7 @@
 }
 
 
-data_global = [schemas.DetectorSchema({
+data_global = [sc.DetectorSchema({
     "detectorID": str(i),
     "detectorType": "dummy",
     "alertID": str(i),
@@ -40,7 +40,7 @@
     "alertDetails": {"99 problems": "but logs aint one"}
 }) for i in range(1, 4)]
 
-data_global += [schemas.DetectorSchema({
+data_global += [sc.DetectorSchema({
     "detectorID": "1",
     "detectorType": "dummy",
     "alertID": "1",
diff --git a/tests/test_base_detectors/test_variable_detector.py b/tests/test_base_detectors/test_variable_detector.py
index af0f7d86..52eca4d0 100644
--- a/tests/test_base_detectors/test_variable_detector.py
+++ b/tests/test_base_detectors/test_variable_detector.py
@@ -1,6 +1,6 @@
 
 from detectmatelibrary.base_detectors import VariableDetector
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import os
 
@@ -28,7 +28,7 @@
 
 def train(detector: VariableDetector, *users) -> None:
     for u in users:
-        detector.train(schemas.ParserSchema({
+        detector.train(sc.ParserSchema({
             "parserType": "t", "eventID": 1, "template": "t", "variables": [u],
             "logID": "1", "parsedLogID": "1", "parserID": "p", "log": "l",
             "headerVariables": {},
diff --git a/tests/test_common/test_core.py b/tests/test_common/test_core.py
index e4142e6f..914ee2ab 100644
--- a/tests/test_common/test_core.py
+++ b/tests/test_common/test_core.py
@@ -6,7 +6,7 @@
 from detectmatelibrary.utils.data_buffer import ArgsBuffer, BufferMode
 
 import detectmatelibrary.schemas._op as op_schemas
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import logging
 import os
@@ -41,8 +41,8 @@ class MockConfigWithTraining(CoreConfig):
 }
 
 
-def _make_log(i: int) -> schemas.LogSchema:
-    return schemas.LogSchema({
+def _make_log(i: int) -> sc.LogSchema:
+    return sc.LogSchema({
         "__version__": "2.0.0",
         "logID": str(i),
         "logSource": "test",
@@ -60,7 +60,7 @@ def __init__(
         self, name: str, config: MockConfigWithTraining = MockConfigWithTraining()
     ) -> None:
         super().__init__(
-            name=name, type_="Dummy", config=config, input_schema=schemas.LogSchema
+            name=name, type_="Dummy", config=config, input_schema=sc.LogSchema
         )
         self.train_data = []
 
@@ -83,7 +83,7 @@ def __init__(
         self, name: str, config: MockConfigWithConfigure = MockConfigWithConfigure()
     ) -> None:
         super().__init__(
-            name=name, type_="Dummy", config=config, input_schema=schemas.LogSchema
+            name=name, type_="Dummy", config=config, input_schema=sc.LogSchema
         )
         self.configure_data: list = []
         self.set_configuration_called: int = 0
@@ -101,7 +101,7 @@ def run(self, input_, output_) -> bool:
 class MockComponentWithConfigureAndTraining(CoreComponent):
     def __init__(self, name: str, config: CoreConfig = CoreConfig()) -> None:
         super().__init__(
-            name=name, type_="Dummy", config=config, input_schema=schemas.LogSchema
+            name=name, type_="Dummy", config=config, input_schema=sc.LogSchema
         )
         self.configure_data: list = []
         self.train_data: list = []
@@ -240,7 +240,7 @@ def test_training(self) -> None:
 
         for i in range(10):
             component.process(
-                schemas.LogSchema({
+                sc.LogSchema({
                     "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
@@ -250,7 +250,7 @@ def test_training(self) -> None:
 
         assert len(component.train_data) == component.fitlogic.train_state.data_used
         for i, log in enumerate(component.train_data):
-            expected = schemas.LogSchema({
+            expected = sc.LogSchema({
                 "__version__": "2.0.0",
                 "logID": str(i),
                 "logSource": "test",
@@ -266,7 +266,7 @@ def test_training_use_config_data(self) -> None:
 
         for i in range(10):
             component.process(
-                schemas.LogSchema({
+                sc.LogSchema({
                     "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
@@ -277,7 +277,7 @@ def test_training_use_config_data(self) -> None:
         total += component.fitlogic.config_state.total_need_data
         assert len(component.train_data) == total
         for i, log in enumerate(component.train_data):
-            expected = schemas.LogSchema({
+            expected = sc.LogSchema({
                 "__version__": "2.0.0",
                 "logID": str(i),
                 "logSource": "test",
@@ -292,7 +292,7 @@ def test_training_force_stop(self) -> None:
             if i == 2:
                 component.update_state("stop_training")
             component.process(
-                schemas.LogSchema({
+                sc.LogSchema({
                     "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
@@ -308,7 +308,7 @@ def test_training_keep_training(self) -> None:
 
         for i in range(10):
             component.process(
-                schemas.LogSchema({
+                sc.LogSchema({
                     "__version__": "2.0.0",
                     "logID": str(i),
                     "logSource": "test",
@@ -477,7 +477,7 @@ class MockConfigWithPostTrain(CoreConfig):
 class MockComponentWithPostTrain(CoreComponent):
     def __init__(self, name: str, config: CoreConfig = MockConfigWithPostTrain()) -> None:
         super().__init__(
-            name=name, type_="Dummy", config=config, input_schema=schemas.LogSchema
+            name=name, type_="Dummy", config=config, input_schema=sc.LogSchema
         )
         self.post_train_called: int = 0
 
@@ -612,7 +612,7 @@ def test_has_no_saver(self):
 class MockWindowComponent(CoreComponent):
     def __init__(self, name: str, config: CoreConfig) -> None:
         super().__init__(
-            name=name, type_="Dummy", config=config, input_schema=schemas.LogSchema,
+            name=name, type_="Dummy", config=config, input_schema=sc.LogSchema,
             args_buffer=ArgsBuffer(mode=BufferMode.WINDOW, size=2),
         )
         self.train_data: list = []
diff --git a/tests/test_common/test_core_alert_aggregator.py b/tests/test_common/test_core_alert_aggregator.py
index 88d09fdf..99cef585 100644
--- a/tests/test_common/test_core_alert_aggregator.py
+++ b/tests/test_common/test_core_alert_aggregator.py
@@ -3,7 +3,7 @@
 )
 
 from detectmatelibrary.utils.aux import time_test_mode
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pydantic
 import pytest
@@ -81,8 +81,8 @@ def test_initialize_default(self) -> None:
         assert isinstance(detector, CoreAlertAggregator)
         assert detector.name == "TestAAG"
         assert isinstance(detector.config, CoreAlertAggregatorConfig)
-        assert detector.input_schema == schemas.DetectorSchema
-        assert detector.output_schema == schemas.AggregateSchema
+        assert detector.input_schema == sc.DetectorSchema
+        assert detector.output_schema == sc.AggregateSchema
 
     def test_incorrect_config_type(self) -> None:
         dummy_config2 = {
@@ -100,13 +100,13 @@ def test_incorrect_config_type(self) -> None:
 
     def test_process_correct_input_schema(self) -> None:
         detector = MockupAlertAggregator(name="TestAAG", config=dummy_config)
-        data = schemas.DetectorSchema(dummy_schema).serialize()
+        data = sc.DetectorSchema(dummy_schema).serialize()
         result = detector.process(data)  # no error should be produced
         assert isinstance(result, bytes)  # and result should be bytes
 
     def test_process_input_schema_not_serialized(self) -> None:
         alert_aggregator = MockupAlertAggregator(name="TestAAG", config=MockupConfig())
-        expected_result = schemas.AggregateSchema({
+        expected_result = sc.AggregateSchema({
             "__version__": "2.0.0",
             "detectorIDs": ["1"],
             "detectorTypes": ["dummy"],
@@ -117,13 +117,13 @@ def test_process_input_schema_not_serialized(self) -> None:
             "logTimestamps": [-1],
             "alertDetails": {}
         })
-        data = schemas.DetectorSchema(dummy_schema)
+        data = sc.DetectorSchema(dummy_schema)
         result = alert_aggregator.process(data)
         assert result == expected_result, f"result -> {result}"
 
     def test_process_input_schema_not_serialized_window_3(self) -> None:
         alert_aggregator = MockupAlertAggregator(name="TestDetector", config=MockupConfig(), buffer_size=3)
-        expected_result = schemas.AggregateSchema({
+        expected_result = sc.AggregateSchema({
             "__version__": "2.0.0",
             "detectorIDs": ["1", "1", "1"],
             "detectorTypes": ["dummy", "dummy", "dummy"],
@@ -134,7 +134,7 @@ def test_process_input_schema_not_serialized_window_3(self) -> None:
             "logTimestamps": [-1, -1, -1],
             "alertDetails": {}
         })
-        data = schemas.DetectorSchema(dummy_schema)
+        data = sc.DetectorSchema(dummy_schema)
 
         assert alert_aggregator.process(data) is None
         assert alert_aggregator.process(data) is None
@@ -146,7 +146,7 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
         alert_aggregator = MockupAlertAggregatorBuffer(
             name="TestDetector", config=MockupConfig(), buffer_size=3
         )
-        expected_result = schemas.AggregateSchema({
+        expected_result = sc.AggregateSchema({
             "__version__": "2.0.0",
             "detectorIDs": ["1", "1", "1"],
             "detectorTypes": ["dummy", "dummy", "dummy"],
@@ -157,7 +157,7 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
             "logTimestamps": [-1, -1, -1],
             "alertDetails": {}
         })
-        data = schemas.DetectorSchema(dummy_schema)
+        data = sc.DetectorSchema(dummy_schema)
 
         assert alert_aggregator.process(data) is None
         assert alert_aggregator.process(data) is None
@@ -167,7 +167,7 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
 
     def test_none_detector(self) -> None:
         alert_aggregator = NoneMockupAlertAggregator(name="TestDetector", config=MockupConfig())
-        data = schemas.DetectorSchema(dummy_schema)
+        data = sc.DetectorSchema(dummy_schema)
 
         assert alert_aggregator.process(data) is None
         assert alert_aggregator.process(data) is not None
diff --git a/tests/test_common/test_core_detector.py b/tests/test_common/test_core_detector.py
index 20dfe73b..3ca12189 100644
--- a/tests/test_common/test_core_detector.py
+++ b/tests/test_common/test_core_detector.py
@@ -1,7 +1,7 @@
 from detectmatelibrary.common.detector import CoreDetectorConfig, BufferMode
 from detectmatelibrary.common.detector import CoreDetector
 from detectmatelibrary.utils.aux import time_test_mode
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pydantic
 import pytest
@@ -103,8 +103,8 @@ def test_initialize_default(self) -> None:
         assert isinstance(detector, CoreDetector)
         assert detector.name == "TestDetector"
         assert isinstance(detector.config, CoreDetectorConfig)
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
 
     def test_incorrect_config_type(self) -> None:
         dummy_config2 = {
@@ -122,13 +122,13 @@ def test_incorrect_config_type(self) -> None:
 
     def test_process_correct_input_schema(self) -> None:
         detector = MockupDetector(name="TestDetector", config=dummy_config)
-        data = schemas.ParserSchema(dummy_schema).serialize()
+        data = sc.ParserSchema(dummy_schema).serialize()
         result = detector.process(data)  # no error should be produced
         assert isinstance(result, bytes)  # and result should be bytes
 
     def test_process_input_schema_not_serialized(self) -> None:
         detector = MockupDetector(name="TestDetector", config=MockupConfig())
-        expected_result = schemas.DetectorSchema({
+        expected_result = sc.DetectorSchema({
             "__version__": "2.0.0",
             "detectorID": "TestDetector",
             "detectorType": "core_detector",
@@ -140,13 +140,13 @@ def test_process_input_schema_not_serialized(self) -> None:
             "logTimestamps": [12121],
             "receivedTimestamp": 0,
         })
-        data = schemas.ParserSchema(dummy_schema)
+        data = sc.ParserSchema(dummy_schema)
         result = detector.process(data)
         assert result == expected_result, f"result -> {result}"
 
     def test_process_input_schema_not_serialized_window_3(self) -> None:
         detector = MockupDetector_window(name="TestDetector", config=MockupConfig())
-        expected_result = schemas.DetectorSchema({
+        expected_result = sc.DetectorSchema({
             "__version__": "2.0.0",
             "detectorID": "TestDetector",
             "detectorType": "core_detector",
@@ -158,7 +158,7 @@ def test_process_input_schema_not_serialized_window_3(self) -> None:
             "logTimestamps": [12121, 12121, 12121],
             "receivedTimestamp": 0
         })
-        data = schemas.ParserSchema(dummy_schema)
+        data = sc.ParserSchema(dummy_schema)
 
         assert detector.process(data) is None
         assert detector.process(data) is None
@@ -168,7 +168,7 @@ def test_process_input_schema_not_serialized_window_3(self) -> None:
 
     def test_process_input_schema_not_serialized_buffer_3(self) -> None:
         detector = MockupDetector_window(name="TestDetector01", config=MockupConfig())
-        expected_result = schemas.DetectorSchema({
+        expected_result = sc.DetectorSchema({
             "__version__": "2.0.0",
             "detectorID": "TestDetector01",
             "detectorType": "core_detector",
@@ -180,7 +180,7 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
             "logTimestamps": [12121, 12121, 12121],
             "receivedTimestamp": 0,
         })
-        data = schemas.ParserSchema(dummy_schema)
+        data = sc.ParserSchema(dummy_schema)
 
         assert detector.process(data) is None
         assert detector.process(data) is None
@@ -190,7 +190,7 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
 
     def test_none_detector(self) -> None:
         detector = NoneMockupDetector(name="TestDetector", config=MockupConfig())
-        data = schemas.ParserSchema(dummy_schema)
+        data = sc.ParserSchema(dummy_schema)
 
         assert detector.process(data) is None
         assert detector.process(data) is not None
diff --git a/tests/test_common/test_core_parser.py b/tests/test_common/test_core_parser.py
index c28117dd..3d4cc05b 100644
--- a/tests/test_common/test_core_parser.py
+++ b/tests/test_common/test_core_parser.py
@@ -1,6 +1,6 @@
 from detectmatelibrary.common.parser import CoreParser, CoreParserConfig, get_format_variables
 from detectmatelibrary.utils.aux import time_test_mode
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pydantic
 import pytest
@@ -64,8 +64,8 @@ def test_initialize_default(self) -> None:
         assert isinstance(parser, CoreParser)
         assert parser.name == "TestParser"
         assert isinstance(parser.config, CoreParserConfig)
-        assert parser.input_schema == schemas.LogSchema
-        assert parser.output_schema == schemas.ParserSchema
+        assert parser.input_schema == sc.LogSchema
+        assert parser.output_schema == sc.ParserSchema
 
     def test_incorrect_config_type(self) -> None:
         invalid_args = {
@@ -82,13 +82,13 @@ def test_incorrect_config_type(self) -> None:
 
     def test_process_correct_input_schema(self) -> None:
         parser = MockupParser(name="TestParser", config=default_args)
-        data = schemas.LogSchema({"logID": "1", "log": "This is a log."}).serialize()
+        data = sc.LogSchema({"logID": "1", "log": "This is a log."}).serialize()
         result = parser.process(data)  # no error should be produced
         assert isinstance(result, bytes)  # and result should be bytes
 
     def test_process_correct_input_schema_not_serialize(self) -> None:
         parser = MockupParser(name="TestParser", config=MockupConfig())
-        expected_result = schemas.ParserSchema({
+        expected_result = sc.ParserSchema({
             "__version__": "2.0.0",
             "parserType": "core_parser",
             "parserID": "TestParser",
@@ -103,14 +103,14 @@ def test_process_correct_input_schema_not_serialize(self) -> None:
         expected_result.variables = ["a", "b"]
         expected_result.headerVariables["Time"] = "0"
 
-        data = schemas.LogSchema({"logID": "1", "log": "This is a log."})
+        data = sc.LogSchema({"logID": "1", "log": "This is a log."})
         result = parser.process(data)
 
         assert result == expected_result, f"results {result} and expected {expected_result}"
 
     def test_process_ids(self) -> None:
         parser = MockupParser(name="TestParser", config=MockupConfig())
-        data = schemas.LogSchema({
+        data = sc.LogSchema({
             "logID": "1", "log": "This is a log.", "logSource": "", "hostname": ""
         })
 
@@ -122,7 +122,7 @@ def test_process_ids(self) -> None:
 
     def test_none_parser(self) -> None:
         parser = NoneMockupParser(name="TestParser", config=MockupConfig())
-        data = schemas.LogSchema({
+        data = sc.LogSchema({
             "logID": "1", "log": "This is a log.", "logSource": "", "hostname": ""
         })
 
diff --git a/tests/test_common/test_extract_timestamp.py b/tests/test_common/test_extract_timestamp.py
index a775a621..f441851e 100644
--- a/tests/test_common/test_extract_timestamp.py
+++ b/tests/test_common/test_extract_timestamp.py
@@ -1,5 +1,5 @@
 from detectmatelibrary.common.detector import _extract_timestamp
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 
 class TestCoreDetector:
@@ -50,7 +50,7 @@ def test_various_time_formats(self) -> None:
             ("Wednesday, March 4, 2026 14:18:00", EXPECTED_UTC),
         ]
         for time_str, expected in test_cases:
-            schema = schemas.ParserSchema({**dummy_schema, "headerVariables": {"Time": time_str}})
+            schema = sc.ParserSchema({**dummy_schema, "headerVariables": {"Time": time_str}})
             result = _extract_timestamp(schema)
             assert result == [expected], (
                 f"Format '{time_str}': expected [{expected}], got {result}"
@@ -59,9 +59,9 @@ def test_various_time_formats(self) -> None:
     def test_microsecond_epoch_fits_the_schema(self) -> None:
         """Issue #271: a microsecond epoch folded only once landed in
         milliseconds and overflowed the int32 timestamp fields."""
-        schema = schemas.DetectorSchema({
+        schema = sc.DetectorSchema({
             "logTimestamps": _extract_timestamp(
-                schemas.ParserSchema({"headerVariables": {"Time": "1643114452000000"}})
+                sc.ParserSchema({"headerVariables": {"Time": "1643114452000000"}})
             ),
         })
         assert str(schema)  # rebuilds the protobuf -- used to raise ValueError
@@ -71,11 +71,11 @@ def test_timestamp_fields_hold_more_than_int32(self) -> None:
         """Timestamps are int64, so they survive 2038 (and a stray ms
         value)."""
         for schema, field, value in [
-            (schemas.ParserSchema(), "receivedTimestamp", 2**31),
-            (schemas.ParserSchema(), "parsedTimestamp", 2**31),
-            (schemas.DetectorSchema(), "detectedTimestamp", 2**31),
-            (schemas.DetectorSchema(), "receivedTimestamp", 1643114452000),
-            (schemas.AggregateSchema(), "aggregatedTimestamp", 2**31),
+            (sc.ParserSchema(), "receivedTimestamp", 2**31),
+            (sc.ParserSchema(), "parsedTimestamp", 2**31),
+            (sc.DetectorSchema(), "detectedTimestamp", 2**31),
+            (sc.DetectorSchema(), "receivedTimestamp", 1643114452000),
+            (sc.AggregateSchema(), "aggregatedTimestamp", 2**31),
         ]:
             schema[field] = value
             assert getattr(schema.get_schema(), field) == value
diff --git a/tests/test_common/test_train_buffer.py b/tests/test_common/test_train_buffer.py
index 4f1fa4c2..665e49ae 100644
--- a/tests/test_common/test_train_buffer.py
+++ b/tests/test_common/test_train_buffer.py
@@ -5,19 +5,19 @@
 
 import pytest
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.common._core_op._train_buffer import TrainBuffer
 from detectmatelibrary.utils.data_buffer import ArgsBuffer, BufferMode, DataBuffer
 
 _MOD = "detectmatelibrary.common._core_op._train_buffer"
 
 
-def _log(i: int) -> schemas.BaseSchema:
+def _log(i: int) -> sc.BaseSchema:
     # .copy() gives the BaseSchema that CoreComponent actually buffers
-    return schemas.LogSchema({"logID": str(i), "logSource": "test", "hostname": "h"}).copy()
+    return sc.LogSchema({"logID": str(i), "logSource": "test", "hostname": "h"}).copy()
 
 
-def _windows(n: int, size: int, start: int = 0) -> list[list[schemas.BaseSchema]]:
+def _windows(n: int, size: int, start: int = 0) -> list[list[sc.BaseSchema]]:
     """Sliding windows over logs start..start+n-1, as a WINDOW-mode
     CoreComponent buffers them."""
     data_buffer = DataBuffer(ArgsBuffer(BufferMode.WINDOW, size=size))
@@ -26,13 +26,13 @@ def _windows(n: int, size: int, start: int = 0) -> list[list[schemas.BaseSchema]
 
 def _count_serialize(monkeypatch) -> dict[str, int]:
     calls = {"n": 0}
-    real = schemas.BaseSchema.serialize
+    real = sc.BaseSchema.serialize
 
     def counting(self):
         calls["n"] += 1
         return real(self)
 
-    monkeypatch.setattr(schemas.BaseSchema, "serialize", counting)
+    monkeypatch.setattr(sc.BaseSchema, "serialize", counting)
     return calls
 
 
@@ -46,7 +46,7 @@ def _ids(records) -> list[str]:
 
 def _buffer(tmp_path: Path, max_records: int, window: int | None = None, name: str = "c") -> TrainBuffer:
     return TrainBuffer(
-        schemas.LogSchema, max_records=max_records, spill_dir=str(tmp_path), window=window, name=name
+        sc.LogSchema, max_records=max_records, spill_dir=str(tmp_path), window=window, name=name
     )
 
 
@@ -73,7 +73,7 @@ def test_spill_replays_all_records_in_order(self, tmp_path):
         assert len(list(run.glob("*.parquet"))) == 3
         out = list(buf)
         assert _ids(out) == [str(i) for i in range(10)]
-        assert all(r.schema_class is schemas.LogSchema().schema_class for r in out)
+        assert all(r.schema_class is sc.LogSchema().schema_class for r in out)
         assert _run_dirs(tmp_path) == []
 
     def test_spilled_batches_replay_in_order(self, tmp_path):
@@ -126,7 +126,7 @@ def records(start):
 
     def test_default_dir_is_the_system_temp_dir(self, tmp_path, monkeypatch):
         monkeypatch.setattr(tempfile, "tempdir", str(tmp_path))
-        buf = TrainBuffer(schemas.LogSchema, max_records=1, name="c")
+        buf = TrainBuffer(sc.LogSchema, max_records=1, name="c")
         buf.add(_log(0))
         assert len(_run_dirs(tmp_path)) == 1
         assert _ids(buf) == ["0"]
diff --git a/tests/test_detectors/test_bigram_frequency_detector.py b/tests/test_detectors/test_bigram_frequency_detector.py
index 25690a27..e52a6b78 100644
--- a/tests/test_detectors/test_bigram_frequency_detector.py
+++ b/tests/test_detectors/test_bigram_frequency_detector.py
@@ -17,7 +17,7 @@
 from detectmatelibrary.constants import GLOBAL_EVENT_ID
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 # Set time test mode for consistent timestamps
@@ -107,8 +107,8 @@ def test_default_initialization(self):
         assert detector.name == "BigramFrequencyDetector"
         assert hasattr(detector, 'config')
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, 'persistency')
 
     def test_custom_config_initialization(self):
@@ -129,7 +129,7 @@ def test_train_multiple_values(self):
         # Train with multiple values (only event 1 should be tracked per config)
         for event in range(3):
             for level in ["INFO", "WARNING", "ERROR"]:
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
                     "eventID": event,
                     "template": "test template",
@@ -161,7 +161,7 @@ def test_detect_known_value_no_alert(self):
         detector = BigramFrequencyDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -175,7 +175,7 @@ def test_detect_known_value_no_alert(self):
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 12,
             "template": "test template",
@@ -186,7 +186,7 @@ def test_detect_known_value_no_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -197,7 +197,7 @@ def test_detect_known_value_alert(self):
         detector = BigramFrequencyDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -211,7 +211,7 @@ def test_detect_known_value_alert(self):
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -222,7 +222,7 @@ def test_detect_known_value_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -271,7 +271,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -314,7 +314,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -389,7 +389,7 @@ def test_global_instance_detects_new_type(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
@@ -417,7 +417,7 @@ def test_set_configuration_preserves_persist(self):
 
 
 def _parser_data(event_id, level, var_value):
-    return schemas.ParserSchema({
+    return sc.ParserSchema({
         "parserType": "test",
         "eventID": event_id,
         "template": "test template",
@@ -478,7 +478,7 @@ def test_detect_helper_survives_missing_variable(self):
         detector.train(_parser_data(1, "INFO", "abc"))
 
         # Detect with a parser line that lacks the 'test' variable
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -489,7 +489,7 @@ def test_detect_helper_survives_missing_variable(self):
             "log": "test log message",
             "headerVariables": {"level": "INFO"},
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         # Must not raise TypeError
         result = detector.detect(test_data, output)
         assert isinstance(result, bool)
@@ -504,7 +504,7 @@ def test_default_freqs_false_does_not_consult_fallback(self):
         # Detect a typical English-looking value. Without fallback, sparse
         # per-var table → low prob → alert expected.
         test_data = _parser_data(1, "INFO", "the")
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(test_data, output)
         assert result is True
 
@@ -535,7 +535,7 @@ def test_default_freqs_true_consults_fallback(self):
 
         # Detect a common English word — fallback should produce non-zero probs
         test_data = _parser_data(1, "INFO", "the")
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(test_data, output)
         assert result is False
 
@@ -625,7 +625,7 @@ def test_two_variables_have_independent_freq_tables(self):
             }
         }
         detector = BigramFrequencyDetector(config=cfg, name="TwoVarDetector")
-        parser_data = schemas.ParserSchema({
+        parser_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
diff --git a/tests/test_detectors/test_charset_detector.py b/tests/test_detectors/test_charset_detector.py
index e4c3fcba..0a49b03c 100644
--- a/tests/test_detectors/test_charset_detector.py
+++ b/tests/test_detectors/test_charset_detector.py
@@ -15,7 +15,7 @@
 from detectmatelibrary.constants import GLOBAL_EVENT_ID
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 
@@ -74,8 +74,8 @@ def test_default_initialization(self):
         assert detector.name == "CharsetDetector"
         assert hasattr(detector, 'config')
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, 'persistency')
 
     def test_custom_config_initialization(self):
@@ -120,7 +120,7 @@ def test_train_multiple_values(self):
         # Train with multiple values (only event 1 should be tracked per config)
         for event in range(3):
             for level in ["INFO", "WARNING", "ERROR"]:
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
                     "eventID": event,
                     "template": "test template",
@@ -151,7 +151,7 @@ def test_detect_known_value_no_alert(self):
         detector = CharsetDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -165,7 +165,7 @@ def test_detect_known_value_no_alert(self):
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 12,
             "template": "test template",
@@ -176,7 +176,7 @@ def test_detect_known_value_no_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -187,7 +187,7 @@ def test_detect_known_value_alert(self):
         detector = CharsetDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -201,7 +201,7 @@ def test_detect_known_value_alert(self):
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -212,7 +212,7 @@ def test_detect_known_value_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -241,7 +241,7 @@ def test_detect_unknown_chars_reported_per_variable(self):
         }
         detector = CharsetDetector(config=cfg, name="Single")
 
-        train = schemas.ParserSchema({
+        train = sc.ParserSchema({
             "parserType": "test", "eventID": 1, "template": "t",
             "variables": ["abc"], "logID": "1", "parsedLogID": "1",
             "parserID": "p", "log": "l", "headerVariables": {},
@@ -249,22 +249,22 @@ def test_detect_unknown_chars_reported_per_variable(self):
         detector.train(train)
 
         # All known chars
-        ok = schemas.ParserSchema({
+        ok = sc.ParserSchema({
             "parserType": "test", "eventID": 1, "template": "t",
             "variables": ["cba"], "logID": "2", "parsedLogID": "2",
             "parserID": "p", "log": "l", "headerVariables": {},
         })
-        out = schemas.DetectorSchema()
+        out = sc.DetectorSchema()
         assert not detector.detect(ok, out)
         assert out.score == 0.0
 
         # Unknown chars 'x' and 'y'
-        bad = schemas.ParserSchema({
+        bad = sc.ParserSchema({
             "parserType": "test", "eventID": 1, "template": "t",
             "variables": ["axy"], "logID": "3", "parsedLogID": "3",
             "parserID": "p", "log": "l", "headerVariables": {},
         })
-        out = schemas.DetectorSchema()
+        out = sc.DetectorSchema()
         assert detector.detect(bad, out)
         assert out.score == 1.0
         assert any("'x'" in msg and "'y'" in msg for msg in out["alertDetails"].values())
@@ -307,7 +307,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -335,7 +335,7 @@ def test_audit_log_anomalies_to_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector2.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -443,7 +443,7 @@ def test_global_instance_detects_new_type(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
@@ -459,7 +459,7 @@ def test_persist_flag_survives_set_configuration(self):
 
         # Feed configure() with a couple of stable-variable samples
         for _ in range(5):
-            sample = schemas.ParserSchema({
+            sample = sc.ParserSchema({
                 "parserType": "test", "eventID": 1, "template": "t",
                 "variables": ["abc"], "logID": "x", "parsedLogID": "x",
                 "parserID": "p", "log": "l",
diff --git a/tests/test_detectors/test_deeplog_detector.py b/tests/test_detectors/test_deeplog_detector.py
index ae64cc2b..5d8ebc08 100644
--- a/tests/test_detectors/test_deeplog_detector.py
+++ b/tests/test_detectors/test_deeplog_detector.py
@@ -10,7 +10,7 @@
 
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pytest
 
@@ -35,7 +35,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                deeplog.process(schemas.ParserSchema({"eventID": i}))
+                deeplog.process(sc.ParserSchema({"eventID": i}))
 
             if j == 0:
                 assert deeplog.get_state() == "Configuring"
@@ -44,7 +44,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for _ in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                deeplog.process(schemas.ParserSchema({"eventID": i}))
+                deeplog.process(sc.ParserSchema({"eventID": i}))
         assert deeplog.get_state() == "Default"
 
     @pytest.mark.ignored
@@ -79,7 +79,7 @@ def test_end2end_no_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                deeplog.process(schemas.ParserSchema({"eventID": i}))
+                deeplog.process(sc.ParserSchema({"eventID": i}))
             if j == 0:
                 assert deeplog.get_state() == "Training"
 
diff --git a/tests/test_detectors/test_event_sequence_detector.py b/tests/test_detectors/test_event_sequence_detector.py
index aab1629b..6c2c6a8a 100644
--- a/tests/test_detectors/test_event_sequence_detector.py
+++ b/tests/test_detectors/test_event_sequence_detector.py
@@ -17,7 +17,7 @@
 )
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.base_detectors import PersistConfig
 from detectmatelibrary.common._core_op._fit_logic import EnumState
 from detectmatelibrary.utils.aux import time_test_mode
@@ -48,7 +48,7 @@
 
 
 def _make_schema(event_id, template="test template", log_id="1", log_format_variables=None):
-    return schemas.ParserSchema({
+    return sc.ParserSchema({
         "parserType": "test",
         "eventID": event_id,
         "template": template,
@@ -70,8 +70,8 @@ def test_default_initialization(self):
         assert detector.name == "EventSequenceDetector"
         assert hasattr(detector, "config")
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, "persistency")
         # unconfigured until auto-config picks a length
         assert detector.config.fixed_window_size is None
@@ -121,8 +121,8 @@ def test_detect_known_sequence_no_alert(self):
             detector.train(_make_schema(event_id))
         # The detection window is independent of the training one, so prime it
         # with a 3 before appending the 1 that completes the known (3, 1)
-        detector.detect(_make_schema(3, log_id="6"), schemas.DetectorSchema())
-        output = schemas.DetectorSchema()
+        detector.detect(_make_schema(3, log_id="6"), sc.DetectorSchema())
+        output = sc.DetectorSchema()
         result = detector.detect(_make_schema(1, log_id="7"), output)
 
         assert not result
@@ -135,8 +135,8 @@ def test_detect_unknown_sequence_alert(self):
             detector.train(_make_schema(event_id))
 
         # (3, 9) was never seen during training
-        detector.detect(_make_schema(3, log_id="6"), schemas.DetectorSchema())
-        output = schemas.DetectorSchema()
+        detector.detect(_make_schema(3, log_id="6"), sc.DetectorSchema())
+        output = sc.DetectorSchema()
         result = detector.detect(_make_schema(9, log_id="7"), output)
 
         assert result
@@ -147,7 +147,7 @@ def test_detect_below_window_length_no_alert(self):
         detector = EventSequenceDetector(config=config, name="MultipleDetector")
 
         # First event with an empty detector: window not yet full, can't be an anomaly
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(_make_schema(1), output)
 
         assert not result
@@ -161,7 +161,7 @@ def test_reset_window_clears_state(self):
         detector = EventSequenceDetector(config=config, name="MultipleDetector")
 
         detector.train(_make_schema(1))
-        detector.detect(_make_schema(1), schemas.DetectorSchema())
+        detector.detect(_make_schema(1), sc.DetectorSchema())
         assert len(detector._train_window) == 1
         assert len(detector._detect_window) == 1
 
@@ -223,7 +223,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -266,7 +266,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -305,7 +305,7 @@ def test_audit_log_anomalie_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -458,7 +458,7 @@ def test_no_stable_window_size_generates_no_instance(self):
         for event_id in [4, 5, 6, 7]:
             detector.train(_make_schema(event_id))
         assert detector.get_known_sequences() == set()
-        assert not detector.detect(_make_schema(9), schemas.DetectorSchema())
+        assert not detector.detect(_make_schema(9), sc.DetectorSchema())
 
     def test_unstable_stream_generates_no_instance(self):
         """The other route to 'no stable candidate': every window fills and
@@ -488,7 +488,7 @@ def test_unstable_stream_generates_no_instance(self):
         for event_id in [1, 2, 3, 1, 2, 3]:
             detector.train(_make_schema(event_id))
         assert detector.get_known_sequences() == set()
-        assert not detector.detect(_make_schema(9), schemas.DetectorSchema())
+        assert not detector.detect(_make_schema(9), sc.DetectorSchema())
 
     def test_auto_config_off_without_fixed_window_size_is_inert(self):
         detector = EventSequenceDetector(
@@ -500,7 +500,7 @@ def test_auto_config_off_without_fixed_window_size_is_inert(self):
             detector.train(_make_schema(event_id))
 
         assert detector.get_known_sequences() == set()
-        assert not detector.detect(_make_schema(9), schemas.DetectorSchema())
+        assert not detector.detect(_make_schema(9), sc.DetectorSchema())
 
     def test_auto_config_off_stays_inert_through_a_configure_phase(self):
         """A configure window alone must not pick a length: auto_config=False
@@ -598,7 +598,7 @@ def test_reload_adopts_persisted_sequence_length(self):
 
         # the known cycle must not alert under the restored model
         alerted = [
-            det2.detect(_make_schema(event_id), schemas.DetectorSchema())
+            det2.detect(_make_schema(event_id), sc.DetectorSchema())
             for event_id in [1, 2, 3, 1, 2, 3]
         ]
         assert not any(alerted)
diff --git a/tests/test_detectors/test_logbert_detector.py b/tests/test_detectors/test_logbert_detector.py
index c5c5cc68..1b2859cc 100644
--- a/tests/test_detectors/test_logbert_detector.py
+++ b/tests/test_detectors/test_logbert_detector.py
@@ -10,7 +10,7 @@
 
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pytest
 
@@ -35,7 +35,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                logbert.process(schemas.ParserSchema({"eventID": i}))
+                logbert.process(sc.ParserSchema({"eventID": i}))
 
             if j == 0:
                 assert logbert.get_state() == "Configuring"
@@ -44,7 +44,7 @@ def test_end2end_autoconfig(self) -> None:
 
         for _ in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                logbert.process(schemas.ParserSchema({"eventID": i}))
+                logbert.process(sc.ParserSchema({"eventID": i}))
         assert logbert.get_state() == "Default"
         
     @pytest.mark.ignored
@@ -84,7 +84,7 @@ def test_end2end_no_autoconfig(self) -> None:
 
         for j in range(2):
             for i in [1, 2, 3, 4, 5, 1, 2]:
-                logbert.process(schemas.ParserSchema({"eventID": i}))
+                logbert.process(sc.ParserSchema({"eventID": i}))
             if j == 0:
                 assert logbert.get_state() == "Training"
 
diff --git a/tests/test_detectors/test_mismatch_warnings.py b/tests/test_detectors/test_mismatch_warnings.py
index 438efc43..a2aec88e 100644
--- a/tests/test_detectors/test_mismatch_warnings.py
+++ b/tests/test_detectors/test_mismatch_warnings.py
@@ -9,7 +9,7 @@
 
 import logging
 import pytest
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.detectors.new_value_detector import NewValueDetector
 from detectmatelibrary.detectors.new_value_combo_detector import NewValueComboDetector
 
@@ -18,8 +18,8 @@ def _make_parser_schema(
     event_id: int,
     variables: list,
     log_format_variables: dict,
-) -> schemas.ParserSchema:
-    return schemas.ParserSchema({
+) -> sc.ParserSchema:
+    return sc.ParserSchema({
         "parserType": "test",
         "eventID": event_id,
         "template": "test template",
diff --git a/tests/test_detectors/test_new_event_detector.py b/tests/test_detectors/test_new_event_detector.py
index 342cd1de..ca02ccbe 100644
--- a/tests/test_detectors/test_new_event_detector.py
+++ b/tests/test_detectors/test_new_event_detector.py
@@ -12,7 +12,7 @@
     BufferMode
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from detectmatelibrary.common._core_op._fit_logic import EnumState
 from detectmatelibrary.constants import GLOBAL_EVENT_ID
@@ -55,8 +55,8 @@ def test_default_initialization(self):
         assert detector.name == "NewEventDetector"
         assert hasattr(detector, 'config')
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, 'persistency')
 
     def test_custom_config_initialization(self):
@@ -76,7 +76,7 @@ def test_train_multiple_event_ids(self):
         detector = NewEventDetector(config=config, name="MultipleDetector")
         event_ids = {0, 3, 8, 9}
         for event in event_ids:
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
                 "eventID": event,
                 "template": "test template",
@@ -101,7 +101,7 @@ def test_detect_known_event_id_no_alert(self):
         detector = NewEventDetector(config=config, name="MultipleDetector")
 
         # Train with an event_id
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -115,7 +115,7 @@ def test_detect_known_event_id_no_alert(self):
         detector.train(train_data)
 
         # Detect with the same event_id
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -126,7 +126,7 @@ def test_detect_known_event_id_no_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -171,7 +171,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for i, log in enumerate(logs[TRAIN_UNTIL:]):
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -204,7 +204,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -229,7 +229,7 @@ def test_audit_log_anomalie_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector2.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -303,7 +303,7 @@ def test_global_instance_detects_new_type(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
@@ -315,7 +315,7 @@ class TestNewEventDetectorFederationCleanup:
     def test_finalize_federation_removes_the_slow_table(self, tmp_path, monkeypatch):
         monkeypatch.chdir(tmp_path)  # the slow store writes .temp/ CSVs here
         detector = NewEventDetector(config=NewEventDetectorConfig(allow_fed=True))
-        detector.train(schemas.ParserSchema({"eventID": 1, "template": "test template"}))
+        detector.train(sc.ParserSchema({"eventID": 1, "template": "test template"}))
         assert (tmp_path / ".temp").exists()
 
         detector.finalize_federation()
diff --git a/tests/test_detectors/test_new_value_combo_detector.py b/tests/test_detectors/test_new_value_combo_detector.py
index 64eba628..c7729a96 100644
--- a/tests/test_detectors/test_new_value_combo_detector.py
+++ b/tests/test_detectors/test_new_value_combo_detector.py
@@ -11,7 +11,7 @@
 from detectmatelibrary.common._config import generate_detector_config
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 
@@ -71,8 +71,8 @@ def test_default_initialization(self):
 
         assert detector.name == "NewValueComboDetector"
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
 
     def test_custom_config_initialization(self):
         detector = NewValueComboDetector(name="CustomInit", config=config)
@@ -89,7 +89,7 @@ def test_train_multiple_values(self):
         # Train with multiple values
         for event in range(3):
             for level in ["INFO", "WARNING", "ERROR"]:
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
                     "eventID": event,
                     "template": "test template",
@@ -113,7 +113,7 @@ def test_detect_known_value_no_alert(self):
         detector = NewValueComboDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -126,7 +126,7 @@ def test_detect_known_value_no_alert(self):
         })
         detector.train(train_data)
 
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -140,7 +140,7 @@ def test_detect_known_value_no_alert(self):
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 12,
             "template": "test template",
@@ -151,7 +151,7 @@ def test_detect_known_value_no_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -162,7 +162,7 @@ def test_detect_known_value_alert(self):
         detector = NewValueComboDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -175,7 +175,7 @@ def test_detect_known_value_alert(self):
         })
         detector.train(train_data)
 
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -189,7 +189,7 @@ def test_detect_known_value_alert(self):
         detector.train(train_data)
 
         # Detect with an unknown combination (pos 1 has a new value)
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -200,7 +200,7 @@ def test_detect_known_value_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -253,7 +253,7 @@ def test_configure_method_ingests_events(self):
 
         # Configure with sample events
         for event_id in [1, 2, 3]:
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
                 "eventID": event_id,
                 "template": f"Template {event_id}",
@@ -279,7 +279,7 @@ def test_set_configuration_updates_config(self):
 
         # Configure with events that have varying stability
         for i in range(10):
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
                 "eventID": 1,
                 "template": "Template 1",
@@ -307,7 +307,7 @@ def test_configuration_workflow(self):
         training_data = []
         for i in range(20):
             for event_id in [1, 2]:
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
                     "eventID": event_id,
                     "template": f"Template {event_id}",
@@ -329,7 +329,7 @@ def test_configuration_workflow(self):
             detector.train(data)
 
         # Step 4: Verify detector can detect anomalies
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "Template 1",
@@ -340,7 +340,7 @@ def test_configuration_workflow(self):
             "log": "test log",
             "headerVariables": {"level": "INFO"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         # Should detect anomaly due to new combination
         result = detector.detect(test_data, output)
@@ -352,7 +352,7 @@ def test_set_configuration_with_combo_size(self):
 
         # Configure with multiple variable events
         for i in range(15):
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
                 "eventID": 1,
                 "template": "Multi-var template",
@@ -377,7 +377,7 @@ def test_configuration_with_no_stable_variables(self):
 
         # Configure with highly variable data
         for i in range(10):
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
                 "eventID": 1,
                 "template": "Variable template",
@@ -404,7 +404,7 @@ class TestNewValueComboDetectorEndToEnd:
 
     @staticmethod
     def _make_schema(event_id, template, variables, log_format_variables, log_id="1"):
-        return schemas.ParserSchema({
+        return sc.ParserSchema({
             "parserType": "test",
             "eventID": event_id,
             "template": template,
@@ -457,7 +457,7 @@ def test_configure_train_detect_anomalous_combo(self):
             ["MALICIOUS_USER", "MALICIOUS_IP"],
             {"username": "MALICIOUS_USER", "src_ip": "MALICIOUS_IP"},
         )
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(anomalous, output)
 
         assert result is True
@@ -501,7 +501,7 @@ def test_configure_train_detect_benign_combo(self):
             ["user1", "192.168.1.100"],
             {"username": "user1", "src_ip": "192.168.1.100"},
         )
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(benign, output)
 
         assert result is False
@@ -547,7 +547,7 @@ def test_configure_only_selects_stable_event_types(self):
             ["hacker", "/etc/shadow"],
             {"username": "hacker", "filepath": "/etc/shadow"},
         )
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         result = detector.detect(file_event, output)
         assert result is False
 
@@ -583,7 +583,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -610,7 +610,7 @@ def test_audit_log_anomalies_to_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector2.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -644,7 +644,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -670,7 +670,7 @@ def test_classification_fields_survive_set_configuration(self):
         assert detector.config.auto_config is True  # the default (set_configuration-first) path
 
         for i in range(10):
-            parser_data = schemas.ParserSchema({
+            parser_data = sc.ParserSchema({
                 "parserType": "test",
                 "eventID": 1,
                 "template": "Template 1",
@@ -696,7 +696,7 @@ def _configured(classification: ClassificationMethods) -> NewValueComboDetector:
         )
         detector = NewValueComboDetector(config=cfg, name="NewValueComboDetector")
         for i in range(10):
-            detector.configure(schemas.ParserSchema({
+            detector.configure(sc.ParserSchema({
                 "parserType": "test",
                 "eventID": 1,
                 "template": "Template 1",
@@ -753,7 +753,7 @@ def _records(classification=None):
         for i in range(12):
             # var_0 and var_1 both cycle over 3 values -> both STABLE in pass 1,
             # so pass 2 gets a ("var_0", "var_1") combo tracker to look at.
-            detector.configure(schemas.ParserSchema({
+            detector.configure(sc.ParserSchema({
                 "parserType": "test",
                 "eventID": 1,
                 "template": "Template 1",
@@ -837,8 +837,8 @@ class TestNewValueComboDetectorConfigureSpill:
     afterwards."""
 
     @staticmethod
-    def _record(i: int) -> schemas.ParserSchema:
-        return schemas.ParserSchema({
+    def _record(i: int) -> sc.ParserSchema:
+        return sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "Template 1",
@@ -913,7 +913,7 @@ class TestNewValueComboDetectorAllCombos:
 
     @staticmethod
     def _record(variables, log_format_variables=None, event_id=1, log_id="1"):
-        return schemas.ParserSchema({
+        return sc.ParserSchema({
             "parserType": "test",
             "eventID": event_id,
             "template": "Template 1",
@@ -959,7 +959,7 @@ def test_unseen_value_pair_in_a_later_combo_alerts(self):
         detector.train(self._record(["b", "y"], {"level": "ERROR"}))
 
         # ("a", "x") is known to the first combo; ("a", "ERROR") is new to the second
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         assert detector.detect(self._record(["a", "x"], {"level": "ERROR"}), output)
         assert output.score == 1.0
         assert list(output.alertDetails) == ["EventID 1 - ('var_0', 'level')"]
@@ -971,7 +971,7 @@ def test_every_combo_is_trained(self):
         trackers = detector.persistency.get_events_data()[1].get_data()
         assert list(trackers) == [("var_0", "var_1"), ("var_0", "level")]
         assert not detector.detect(
-            self._record(["a", "x"], {"level": "INFO"}), schemas.DetectorSchema()
+            self._record(["a", "x"], {"level": "INFO"}), sc.DetectorSchema()
         )
 
     def test_combo_with_a_missing_variable_is_skipped(self):
@@ -984,7 +984,7 @@ def test_combo_with_a_missing_variable_is_skipped(self):
         assert list(trackers) == [("var_0", "var_1"), ("var_0", "level")]
         assert trackers[("var_0", "level")].unique_set == {("a", "INFO")}
 
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         assert not detector.detect(self._record(["b", "y"]), output)
         assert not detector.detect(self._record(["new"]), output)
 
@@ -1000,7 +1000,7 @@ def test_every_combo_survives_federation(self, tmp_path, monkeypatch):
         assert trackers[("var_0", "var_1")].unique_set == {("a", "x"), ("b", "y")}
         assert trackers[("var_0", "level")].unique_set == {("a", "INFO"), ("b", "ERROR")}
         assert received.detect(
-            self._record(["a", "x"], {"level": "ERROR"}), schemas.DetectorSchema()
+            self._record(["a", "x"], {"level": "ERROR"}), sc.DetectorSchema()
         )
 
     @staticmethod
diff --git a/tests/test_detectors/test_new_value_detector.py b/tests/test_detectors/test_new_value_detector.py
index 09a1d78c..acb39231 100644
--- a/tests/test_detectors/test_new_value_detector.py
+++ b/tests/test_detectors/test_new_value_detector.py
@@ -14,7 +14,7 @@
 from detectmatelibrary.constants import GLOBAL_EVENT_ID
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 
@@ -75,8 +75,8 @@ def test_default_initialization(self):
         assert detector.name == "NewValueDetector"
         assert hasattr(detector, 'config')
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, 'persistency')
 
     def test_custom_config_initialization(self):
@@ -97,7 +97,7 @@ def test_train_multiple_values(self):
         # Train with multiple values (only event 1 should be tracked per config)
         for event in range(3):
             for level in ["INFO", "WARNING", "ERROR"]:
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
                     "eventID": event,
                     "template": "test template",
@@ -129,7 +129,7 @@ def test_detect_known_value_no_alert(self):
         detector = NewValueDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -143,7 +143,7 @@ def test_detect_known_value_no_alert(self):
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 12,
             "template": "test template",
@@ -154,7 +154,7 @@ def test_detect_known_value_no_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -165,7 +165,7 @@ def test_detect_known_value_alert(self):
         detector = NewValueDetector(config=config, name="MultipleDetector")
 
         # Train with a value
-        train_data = schemas.ParserSchema({
+        train_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -179,7 +179,7 @@ def test_detect_known_value_alert(self):
         detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -190,7 +190,7 @@ def test_detect_known_value_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -235,7 +235,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -263,7 +263,7 @@ def test_audit_log_anomalies_to_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector2.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -297,7 +297,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -347,7 +347,7 @@ def test_auto_config_off_keeps_explicit_events_through_configure_phase(self):
         explicit_events = detector.config.events.model_dump()
 
         for i in range(20):
-            detector.process(schemas.ParserSchema({
+            detector.process(sc.ParserSchema({
                 "parserType": "test",
                 "eventID": [1, 2, 3][i % 3],
                 "template": "test template",
@@ -398,7 +398,7 @@ def test_global_instance_detects_new_type(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
diff --git a/tests/test_detectors/test_random_detector.py b/tests/test_detectors/test_random_detector.py
index 471dab0d..af12e915 100644
--- a/tests/test_detectors/test_random_detector.py
+++ b/tests/test_detectors/test_random_detector.py
@@ -1,5 +1,5 @@
 from detectmatelibrary.detectors.random_detector import RandomDetector
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 
 from copy import deepcopy
@@ -49,7 +49,7 @@ class TestRandomDetectorEdgeCases:
     def test_random_seed_consistency(self):
 
         detector = RandomDetector(name="TestDetector", config=deepcopy(config))
-        parser_data = schemas.ParserSchema({
+        parser_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -60,13 +60,13 @@ def test_random_seed_consistency(self):
             "log": "test log message",
             "headerVariables": {"timestamp": "123456"}
         })
-        detector_output = schemas.DetectorSchema()
+        detector_output = sc.DetectorSchema()
 
         # Multiple calls should return consistent results when mocked
         result1 = detector.detect(parser_data, detector_output)
 
         # Reset output for second call
-        detector_output = schemas.DetectorSchema()
+        detector_output = sc.DetectorSchema()
         result2 = detector.detect(parser_data, detector_output)
 
         assert result1 == result2
diff --git a/tests/test_detectors/test_rule_detector.py b/tests/test_detectors/test_rule_detector.py
index 122e2664..7c34de29 100644
--- a/tests/test_detectors/test_rule_detector.py
+++ b/tests/test_detectors/test_rule_detector.py
@@ -1,62 +1,62 @@
 import detectmatelibrary.detectors.rule_detector as rd
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 import pytest
 
 
 class TestCaseRules:
     def test_template_not_found(self) -> None:
-        parsed_log = schemas.ParserSchema({"eventID": -1})
+        parsed_log = sc.ParserSchema({"eventID": -1})
         alert, msg = rd.template_not_found(parsed_log)
         assert alert
         assert "No template found by parser" == msg
 
-        parsed_log = schemas.ParserSchema({"eventID": 2})
+        parsed_log = sc.ParserSchema({"eventID": 2})
         alert, _ = rd.template_not_found(parsed_log)
         assert not alert
 
     def test_find_keyword(self) -> None:
         keywords = ["hello", "ciao"]
 
-        parsed_log = schemas.ParserSchema({"log": "hello world"})
+        parsed_log = sc.ParserSchema({"log": "hello world"})
         alert, msg = rd.find_keyword(parsed_log, keywords)
         assert alert
         assert "Found word 'hello' in the logs" == msg
 
-        parsed_log = schemas.ParserSchema({"log": "ciao world"})
+        parsed_log = sc.ParserSchema({"log": "ciao world"})
         alert, msg = rd.find_keyword(parsed_log, keywords)
         assert alert
         assert "Found word 'ciao' in the logs" == msg
 
-        parsed_log = schemas.ParserSchema({"log": "world"})
+        parsed_log = sc.ParserSchema({"log": "world"})
         alert, _ = rd.find_keyword(parsed_log, keywords)
         assert not alert
 
     def test_find_exceptions(self) -> None:
-        parsed_log = schemas.ParserSchema({"log": "hello Exception"})
+        parsed_log = sc.ParserSchema({"log": "hello Exception"})
         alert, msg = rd.exceptions(parsed_log)
         assert alert
         assert "Found word 'exception' in the logs" == msg
 
-        parsed_log = schemas.ParserSchema({"log": "world"})
+        parsed_log = sc.ParserSchema({"log": "world"})
         alert, _ = rd.exceptions(parsed_log)
         assert not alert
 
     def test_error_log(self) -> None:
-        parsed_log = schemas.ParserSchema(
+        parsed_log = sc.ParserSchema(
             {"headerVariables": {"Level": "Error"}}
         )
         alert, msg = rd.error_log(parsed_log)
         assert alert
         assert "Error found" == msg
 
-        parsed_log = schemas.ParserSchema(
+        parsed_log = sc.ParserSchema(
             {"headerVariables": {"Level": "Info"}}
         )
         alert, _ = rd.error_log(parsed_log)
         assert not alert
 
-        parsed_log = schemas.ParserSchema({"log": "hello world"})
+        parsed_log = sc.ParserSchema({"log": "hello world"})
         alert, _ = rd.error_log(parsed_log)
         assert not alert
 
@@ -65,9 +65,9 @@ class TestCaseRuleDetector:
     def test_run_all_rules(self) -> None:
         rule_detector = rd.RuleDetector()
 
-        assert rule_detector.process(schemas.ParserSchema()) is None
+        assert rule_detector.process(sc.ParserSchema()) is None
 
-        alert1 = rule_detector.process(schemas.ParserSchema(
+        alert1 = rule_detector.process(sc.ParserSchema(
             {
                 "eventID": -1,
                 "log": "fail exception",
@@ -85,9 +85,9 @@ def test_run_all_rules(self) -> None:
     def test_all_rules_serialize(self) -> None:
         rule_detector = rd.RuleDetector()
 
-        assert rule_detector.process(schemas.ParserSchema().serialize()) is None
+        assert rule_detector.process(sc.ParserSchema().serialize()) is None
 
-        alert1 = rule_detector.process(schemas.ParserSchema(
+        alert1 = rule_detector.process(sc.ParserSchema(
             {
                 "eventID": -1,
                 "log": "fail exception",
@@ -96,7 +96,7 @@ def test_all_rules_serialize(self) -> None:
         ).serialize())
         assert alert1 is not None
 
-        (alert := schemas.DetectorSchema()).deserialize(alert1)
+        (alert := sc.DetectorSchema()).deserialize(alert1)
         assert alert["alertDetails"] == {
             "R001 - TemplateNotFound": "No template found by parser",
             "R003 - CheckForExceptions": "Found word 'exception' in the logs",
@@ -122,9 +122,9 @@ def test_run_single_rule(self) -> None:
             }
         )
 
-        assert rule_detector.process(schemas.ParserSchema()) is None
+        assert rule_detector.process(sc.ParserSchema()) is None
 
-        alert1 = rule_detector.process(schemas.ParserSchema(
+        alert1 = rule_detector.process(sc.ParserSchema(
             {
                 "eventID": -1,
                 "log": "fail exception",
@@ -155,8 +155,8 @@ def test_run_single_rule_with_args(self) -> None:
             }
         )
 
-        assert rule_detector.process(schemas.ParserSchema({"log": "ciao"})) is None
-        assert rule_detector.process(schemas.ParserSchema({"log": "hi"})) is not None
+        assert rule_detector.process(sc.ParserSchema({"log": "ciao"})) is None
+        assert rule_detector.process(sc.ParserSchema({"log": "hi"})) is not None
 
     def test_rule_not_found(self) -> None:
 
diff --git a/tests/test_detectors/test_value_range_detector.py b/tests/test_detectors/test_value_range_detector.py
index b9b62d4f..74e4586c 100644
--- a/tests/test_detectors/test_value_range_detector.py
+++ b/tests/test_detectors/test_value_range_detector.py
@@ -21,7 +21,7 @@
 from detectmatelibrary.constants import GLOBAL_EVENT_ID
 from detectmatelibrary.parsers.template_matcher import MatcherParser
 from detectmatelibrary.helper.from_to import From
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.utils.aux import time_test_mode
 from detectmatelibrary.tools.logging import logger
 from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
@@ -75,8 +75,8 @@ def test_default_initialization(self):
         assert detector.name == "ValueRangeDetector"
         assert hasattr(detector, 'config')
         assert detector.data_buffer.mode == BufferMode.NO_BUF
-        assert detector.input_schema == schemas.ParserSchema
-        assert detector.output_schema == schemas.DetectorSchema
+        assert detector.input_schema == sc.ParserSchema
+        assert detector.output_schema == sc.DetectorSchema
         assert hasattr(detector, 'persistency')
 
     def test_custom_config_initialization(self):
@@ -130,7 +130,7 @@ def test_train_multiple_values(self):
                 if event == 1:
                     min_val = min(min_val, value)
                     max_val = max(max_val, value)
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
                     "eventID": event,
                     "template": "test template",
@@ -148,7 +148,7 @@ def test_train_multiple_values(self):
                 if event == 1:
                     min_val = min(min_val, value)
                     max_val = max(max_val, value)
-                parser_data = schemas.ParserSchema({
+                parser_data = sc.ParserSchema({
                     "parserType": "test",
                     "eventID": event,
                     "template": "test template",
@@ -175,7 +175,7 @@ def test_train_detect_non_numeric_raises(self):
 
         detector = ValueRangeDetector(config=config, name="CustomInit")
         # Train with multiple values (the minimum and maximum value should be captured)
-        parser_data = schemas.ParserSchema({
+        parser_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -188,7 +188,7 @@ def test_train_detect_non_numeric_raises(self):
         })
         with pytest.raises(ValueError):
             detector.train(parser_data)
-        normal_data = schemas.ParserSchema({
+        normal_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -201,7 +201,7 @@ def test_train_detect_non_numeric_raises(self):
         })
         detector.train(normal_data)
         with pytest.raises(ValueError):
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             detector.detect(parser_data, output)
 
     def test_train_detect_non_numeric_ignore(self):
@@ -209,7 +209,7 @@ def test_train_detect_non_numeric_ignore(self):
 
         detector = ValueRangeDetector(config=config, name="MultipleDetector")
         # Train with multiple values (the minimum and maximum value should be captured)
-        parser_data = schemas.ParserSchema({
+        parser_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -221,7 +221,7 @@ def test_train_detect_non_numeric_ignore(self):
             "headerVariables": {}
         })
         detector.train(parser_data)
-        normal_data = schemas.ParserSchema({
+        normal_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -233,7 +233,7 @@ def test_train_detect_non_numeric_ignore(self):
             "headerVariables": {}
         })
         detector.train(normal_data)
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
         detector.detect(parser_data, output)
 
 
@@ -245,7 +245,7 @@ def test_detect_learned_value_range_no_alert(self):
 
         # Train with values
         for val in ["1", "5000", "2130"]:
-            train_data = schemas.ParserSchema({
+            train_data = sc.ParserSchema({
                 "parserType": "test",
                 "eventID": 1,
                 "template": "test template",
@@ -259,7 +259,7 @@ def test_detect_learned_value_range_no_alert(self):
             detector.train(train_data)
 
         # Detect with the same value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -270,7 +270,7 @@ def test_detect_learned_value_range_no_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -282,7 +282,7 @@ def test_detect_known_value_ranges_alert(self):
 
         # Train with values
         for val in ["1", "5000", "2130"]:
-            train_data = schemas.ParserSchema({
+            train_data = sc.ParserSchema({
                 "parserType": "test",
                 "eventID": 1,
                 "template": "test template",
@@ -296,7 +296,7 @@ def test_detect_known_value_ranges_alert(self):
             detector.train(train_data)
 
         # Detect with the different value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -307,7 +307,7 @@ def test_detect_known_value_ranges_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -315,7 +315,7 @@ def test_detect_known_value_ranges_alert(self):
         assert output.score == 1.0
 
         # Detect with the different value
-        test_data = schemas.ParserSchema({
+        test_data = sc.ParserSchema({
             "parserType": "test",
             "eventID": 1,
             "template": "test template",
@@ -326,7 +326,7 @@ def test_detect_known_value_ranges_alert(self):
             "log": "test log message",
             "headerVariables": {"level": "CRITICAL"}
         })
-        output = schemas.DetectorSchema()
+        output = sc.DetectorSchema()
 
         result = detector.detect(test_data, output)
 
@@ -373,7 +373,7 @@ def test_audit_log_anomalies(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -403,7 +403,7 @@ def test_audit_log_anomalies_to_binary(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector2.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -437,7 +437,7 @@ def test_audit_log_anomalie_fed(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector1.detect(log, output_=output):
                 detected_ids.add(log["logID"])
 
@@ -514,7 +514,7 @@ def test_global_instance_detects_new_type(self):
 
         detected_ids: set[str] = set()
         for log in logs[TRAIN_UNTIL:]:
-            output = schemas.DetectorSchema()
+            output = sc.DetectorSchema()
             if detector.detect(log, output_=output):
                 assert all(key.startswith("Global -") for key in output["alertDetails"])
                 detected_ids.add(log["logID"])
@@ -544,7 +544,7 @@ def test_set_configuration_preserves_persist(self):
 
         # Feed configure() with a couple of stable-variable samples
         for _ in range(5):
-            sample = schemas.ParserSchema({
+            sample = sc.ParserSchema({
                 "parserType": "test", "eventID": 1, "template": "t",
                 "variables": ["123"], "logID": "x", "parsedLogID": "x",
                 "parserID": "p", "log": "l",
diff --git a/tests/test_helper/test_from_to.py b/tests/test_helper/test_from_to.py
index 9a20ce2f..7195c112 100644
--- a/tests/test_helper/test_from_to.py
+++ b/tests/test_helper/test_from_to.py
@@ -3,7 +3,7 @@
 from detectmatelibrary._testutils.dummy_parser import DummyParser
 from tests.test_data import AUDIT_TEMPLATES, DUMMY_TXT_PATH, DUMMY_TXT_PATH2, DUMMY_JSON_PATH, \
     DUMMY_JSON_PATH2, DUMMY_YAML_PATH, DUMMY_YAML_PATH2
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 import detectmateperformance as dmp
 import polars as pl
 import json
@@ -128,7 +128,7 @@ def test_fromlog_no_process(self):
         log = next(From.log(parser, in_path=AUDIT_TEMPLATES, do_process=False))
 
         assert log.log == expected_log
-        assert isinstance(log, schemas.LogSchema)
+        assert isinstance(log, sc.LogSchema)
 
     def test_fromlog(self):
         parser = DummyParser()
@@ -136,7 +136,7 @@ def test_fromlog(self):
         log = next(From.log(parser, in_path=AUDIT_TEMPLATES, do_process=True))
 
         assert log.log == expected_log
-        assert isinstance(log, schemas.ParserSchema)
+        assert isinstance(log, sc.ParserSchema)
 
     @remove_files
     def test_frombinary(self):
@@ -179,7 +179,7 @@ def test_frompolars(self):
         gen = From.polars(DummyDetector(), df=table, do_process=False)
 
         parsed1 = next(gen)
-        schema1 = schemas.ParserSchema({
+        schema1 = sc.ParserSchema({
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
@@ -191,7 +191,7 @@ def test_frompolars(self):
         assert parsed1["logID"] == "0"
 
         parsed2 = next(gen)
-        schema2 = schemas.ParserSchema({
+        schema2 = sc.ParserSchema({
             "log": "general kenobi",
             "variables": ["c", "d"],
             "template": "<*> kenobi",
@@ -213,7 +213,7 @@ def test_frompolars_lazy(self):
         gen = From.polars(DummyDetector(), df=table, do_process=False)
 
         parsed1 = next(gen)
-        schema1 = schemas.ParserSchema({
+        schema1 = sc.ParserSchema({
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
@@ -225,7 +225,7 @@ def test_frompolars_lazy(self):
         assert parsed1["logID"] == "0"
 
         parsed2 = next(gen)
-        schema2 = schemas.ParserSchema({
+        schema2 = sc.ParserSchema({
             "log": "general kenobi",
             "variables": ["c", "d"],
             "template": "<*> kenobi",
@@ -250,7 +250,7 @@ def test_frompolars_rename(self):
         gen = From.polars(DummyDetector(), df=table, do_process=False, renames=renames)
 
         parsed1 = next(gen)
-        schema1 = schemas.ParserSchema({
+        schema1 = sc.ParserSchema({
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
@@ -274,7 +274,7 @@ def test_frompolars_rename_vars(self):
         gen = From.polars(DummyDetector(), df=table, do_process=False, renames=renames)
 
         parsed1 = next(gen)
-        schema1 = schemas.ParserSchema({
+        schema1 = sc.ParserSchema({
             "log": "hello there",
             "variables": ["a", "b"],
             "template": "hello <*>",
diff --git a/tests/test_parsers/test_json_parser.py b/tests/test_parsers/test_json_parser.py
index 73299688..82573cf7 100644
--- a/tests/test_parsers/test_json_parser.py
+++ b/tests/test_parsers/test_json_parser.py
@@ -4,7 +4,7 @@
     JsonParserConfig,
     flatten_dict
 )
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from tests.test_data import TEST_TEMPLATES
 
 
@@ -52,12 +52,12 @@ def test_parse_json_without_message(self):
             "error_code": 404
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
 
-        output = schemas.ParserSchema()
+        output = sc.ParserSchema()
         parser.parse(input_log, output)
 
         # When no message field, template should be empty
@@ -87,12 +87,12 @@ def test_parse_nested_json(self):
             }
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
 
-        output = schemas.ParserSchema()
+        output = sc.ParserSchema()
         parser.parse(input_log, output)
 
         # Check flattened structure
@@ -112,12 +112,12 @@ def test_parse_json_with_array(self):
             "events": ["login", "update", "logout"]
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
 
-        output = schemas.ParserSchema()
+        output = sc.ParserSchema()
         parser.parse(input_log, output)
 
         # Check array is flattened
@@ -151,12 +151,12 @@ def test_parse_with_content_parser(self):
             "level": "INFO"
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
 
-        output = schemas.ParserSchema()
+        output = sc.ParserSchema()
         parser.parse(input_log, output)
 
         # The content parser should have parsed the message
@@ -174,12 +174,12 @@ def test_custom_field_names(self):
             "severity": "high"
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
 
-        output = schemas.ParserSchema()
+        output = sc.ParserSchema()
         parser.parse(input_log, output)
 
         # Timestamp should be extracted and Time should be in headerVariables
@@ -198,7 +198,7 @@ def test_process_method(self):
             "status": "ok"
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
@@ -206,7 +206,7 @@ def test_process_method(self):
         # Test the full process method
         result = parser.process(input_log)
 
-        assert isinstance(result, schemas.ParserSchema)
+        assert isinstance(result, sc.ParserSchema)
         assert "Time" in result.headerVariables
         assert "status" in result.headerVariables
         assert result.headerVariables["status"] == "ok"
diff --git a/tests/test_parsers/test_logbatcher_parser.py b/tests/test_parsers/test_logbatcher_parser.py
index 2f289e73..abac37b0 100644
--- a/tests/test_parsers/test_logbatcher_parser.py
+++ b/tests/test_parsers/test_logbatcher_parser.py
@@ -8,7 +8,7 @@
 
 import pytest
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.common.parser import CoreParser
 from detectmatelibrary.parsers.logbatcher import LogBatcherParser, LogBatcherParserConfig
 from detectmatelibrary.utils.aux import time_test_mode
@@ -45,7 +45,7 @@ def test_config_method_type(self):
 class TestLogBatcherParserParse:
     def test_template_extracted(self):
         parser = _make_parser()
-        log_schema = schemas.LogSchema({"logID": "1", "log": LOG})
+        log_schema = sc.LogSchema({"logID": "1", "log": LOG})
 
         result = parser.process(log_schema)
 
@@ -53,7 +53,7 @@ def test_template_extracted(self):
 
     def test_variables_extracted(self):
         parser = _make_parser()
-        log_schema = schemas.LogSchema({"logID": "1", "log": LOG})
+        log_schema = sc.LogSchema({"logID": "1", "log": LOG})
 
         result = parser.process(log_schema)
 
@@ -62,7 +62,7 @@ def test_variables_extracted(self):
 
     def test_event_id_is_int(self):
         parser = _make_parser()
-        log_schema = schemas.LogSchema({"logID": "1", "log": LOG})
+        log_schema = sc.LogSchema({"logID": "1", "log": LOG})
 
         result = parser.process(log_schema)
 
@@ -72,11 +72,11 @@ def test_second_call_hits_cache(self):
         """Second identical log must not trigger a new LLM call."""
         parser = _make_parser()
 
-        log_schema1 = schemas.LogSchema({"logID": "1", "log": LOG})
+        log_schema1 = sc.LogSchema({"logID": "1", "log": LOG})
         parser.process(log_schema1)
         llm_call_count = parser._llm_parser.chat.call_count
 
-        log_schema2 = schemas.LogSchema({"logID": "2", "log": LOG})
+        log_schema2 = sc.LogSchema({"logID": "2", "log": LOG})
         parser.process(log_schema2)
 
         assert parser._llm_parser.chat.call_count == llm_call_count
diff --git a/tests/test_persistency/test_time_dependent_stability.py b/tests/test_persistency/test_time_dependent_stability.py
index 3c8ad7cf..ab67f1f0 100644
--- a/tests/test_persistency/test_time_dependent_stability.py
+++ b/tests/test_persistency/test_time_dependent_stability.py
@@ -3,7 +3,7 @@
 import logging
 import math
 
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 from detectmatelibrary.detectors.charset_detector import CharsetDetector, CharsetDetectorConfig
 from detectmatelibrary.base_detectors import StabilityAutoConfigParams, VariableAutoConfigParams
 from detectmatelibrary.base_detectors._stability import TimestampReader
@@ -386,7 +386,7 @@ def test_event_tracker_detector_backed_round_trip(self):
 
 
 def _parser_record(ts_value, event_id=1):
-    return schemas.ParserSchema({
+    return sc.ParserSchema({
         "parserType": "test",
         "eventID": event_id,
         "template": "test template",
diff --git a/tests/test_pipelines/test_dummy_methods.py b/tests/test_pipelines/test_dummy_methods.py
index 13db8128..2a6e44ed 100644
--- a/tests/test_pipelines/test_dummy_methods.py
+++ b/tests/test_pipelines/test_dummy_methods.py
@@ -1,7 +1,7 @@
 
 from detectmatelibrary._testutils.dummy_detector import DummyDetector, DummyDetectorConfig
 from detectmatelibrary._testutils.dummy_parser import DummyParser, DummyParserConfig
-import detectmatelibrary.schemas as schemas
+import detectmatelibrary.schemas as sc
 
 
 default_args = {
@@ -32,8 +32,8 @@ def test_initialize_default(self) -> None:
 
     def test_run_detect_method(self) -> None:
         detector = DummyDetector()
-        data = schemas.ParserSchema({"log": "test log"})
-        output = schemas.DetectorSchema()
+        data = sc.ParserSchema({"log": "test log"})
+        output = sc.DetectorSchema()
 
         result = detector.detect(data, output)
 
@@ -54,8 +54,8 @@ def test_parser_initialize_default(self) -> None:
 
     def test_run_parse_method(self) -> None:
         parser = DummyParser()
-        input_data = schemas.LogSchema({"log": "test log"})
-        output_data = schemas.ParserSchema()
+        input_data = sc.LogSchema({"log": "test log"})
+        output_data = sc.ParserSchema()
 
         parser.parse(input_data, output_data)
 
@@ -66,7 +66,7 @@ def test_pipeline(test) -> None:
         parser = DummyParser()
         detector = DummyDetector()
 
-        log_input = schemas.LogSchema({"log": "test log", "logID": "1"})
+        log_input = sc.LogSchema({"log": "test log", "logID": "1"})
         parsed_log = parser.process(log_input)
 
         while (result := detector.process(parsed_log)) is None:

From 7a0511e15b33030d402c99cc09cc5f3083589658 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 08:34:40 +0200
Subject: [PATCH 39/86] add correct typing in the config arguments

---
 .../base_detectors/deeplearning_detector.py               | 2 +-
 src/detectmatelibrary/base_detectors/variable_detector.py | 2 +-
 src/detectmatelibrary/common/alert_aggregator.py          | 6 +++---
 src/detectmatelibrary/common/detector.py                  | 6 +++---
 src/detectmatelibrary/common/parser.py                    | 8 ++++----
 .../detectors/bigram_frequency_detector.py                | 2 +-
 src/detectmatelibrary/detectors/charset_detector.py       | 2 +-
 .../detectors/event_sequence_detector.py                  | 4 ++--
 src/detectmatelibrary/detectors/new_event_detector.py     | 3 ++-
 .../detectors/new_value_combo_detector.py                 | 2 +-
 src/detectmatelibrary/detectors/new_value_detector.py     | 2 +-
 src/detectmatelibrary/detectors/random_detector.py        | 4 ++--
 src/detectmatelibrary/detectors/value_range_detector.py   | 2 +-
 13 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/src/detectmatelibrary/base_detectors/deeplearning_detector.py b/src/detectmatelibrary/base_detectors/deeplearning_detector.py
index f00beeee..798551ba 100644
--- a/src/detectmatelibrary/base_detectors/deeplearning_detector.py
+++ b/src/detectmatelibrary/base_detectors/deeplearning_detector.py
@@ -51,7 +51,7 @@ def __init__(
         self,
         model_cls: DeepModel,
         name: str = "CoreDetector",
-        config: DeepLearningDetectorConfig = DeepLearningDetectorConfig()
+        config: DeepLearningDetectorConfig | dict[str, Any] = DeepLearningDetectorConfig()
     ) -> None:
 
         if isinstance(config, dict):
diff --git a/src/detectmatelibrary/base_detectors/variable_detector.py b/src/detectmatelibrary/base_detectors/variable_detector.py
index 33c63d38..e8bd13cb 100644
--- a/src/detectmatelibrary/base_detectors/variable_detector.py
+++ b/src/detectmatelibrary/base_detectors/variable_detector.py
@@ -125,7 +125,7 @@ class VariableDetector(TrackerDetector, VariableHooks):
     _time_handler: TimeFormatHandler = _core_time_handler
 
     def __init__(
-        self, name: str, config: VariableDetectorConfig = VariableDetectorConfig()
+        self, name: str, config: VariableDetectorConfig | dict[str, Any] = VariableDetectorConfig()
     ) -> None:
         if isinstance(config, dict):
             config = VariableDetectorConfig.from_dict(config, name)
diff --git a/src/detectmatelibrary/common/alert_aggregator.py b/src/detectmatelibrary/common/alert_aggregator.py
index 28045ead..a7a3c326 100644
--- a/src/detectmatelibrary/common/alert_aggregator.py
+++ b/src/detectmatelibrary/common/alert_aggregator.py
@@ -41,15 +41,15 @@ def __init__(
         name: str = "CoreAlertAggregator",
         buffer_mode: BufferMode = BufferMode.WINDOW,
         buffer_size: Optional[int] = 1,
-        config: Optional[CoreAlertAggregatorConfig | dict[str, Any]] = CoreAlertAggregatorConfig(),
+        config: CoreAlertAggregatorConfig | dict[str, Any] = CoreAlertAggregatorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = CoreAlertAggregatorConfig.from_dict(config, name)
 
         super().__init__(
             name=name,
-            type_=config.method_type,  # type: ignore
-            config=config,  # type: ignore
+            type_=config.method_type,
+            config=config,
             args_buffer=ArgsBuffer(mode=buffer_mode, size=buffer_size),
             input_schema=DetectorSchema,
             output_schema=AggregateSchema,
diff --git a/src/detectmatelibrary/common/detector.py b/src/detectmatelibrary/common/detector.py
index ac956f99..621d0875 100644
--- a/src/detectmatelibrary/common/detector.py
+++ b/src/detectmatelibrary/common/detector.py
@@ -60,15 +60,15 @@ def __init__(
         name: str = "CoreDetector",
         buffer_mode: BufferMode = BufferMode.NO_BUF,
         buffer_size: Optional[int] = None,
-        config: Optional[CoreDetectorConfig | dict[str, Any]] = CoreDetectorConfig(),
+        config: CoreDetectorConfig | dict[str, Any] = CoreDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = CoreDetectorConfig.from_dict(config, name)
 
         super().__init__(
             name=name,
-            type_=config.component_type,  # type: ignore
-            config=config,  # type: ignore
+            type_=config.component_type,
+            config=config,
             args_buffer=ArgsBuffer(mode=buffer_mode, size=buffer_size),
             input_schema=ParserSchema,
             output_schema=DetectorSchema,
diff --git a/src/detectmatelibrary/common/parser.py b/src/detectmatelibrary/common/parser.py
index adae332e..e805cc8b 100644
--- a/src/detectmatelibrary/common/parser.py
+++ b/src/detectmatelibrary/common/parser.py
@@ -6,7 +6,7 @@
 from detectmatelibrary.utils.aux import get_timestamp
 from detectmatelibrary import schemas
 
-from typing import Any, Optional, cast
+from typing import Any, cast
 from pydantic import model_validator
 import re
 from pydantic import Field
@@ -44,15 +44,15 @@ class CoreParser(CoreComponent):
     def __init__(
         self,
         name: str = "CoreParser",
-        config: Optional[CoreParserConfig | dict[str, Any]] = CoreParserConfig(),
+        config: CoreParserConfig | dict[str, Any] = CoreParserConfig(),
     ):
         if isinstance(config, dict):
             config = CoreParserConfig.from_dict(config, name)
 
         super().__init__(
             name=name,
-            type_=config.method_type,  # type: ignore
-            config=config,  # type: ignore
+            type_=config.method_type,
+            config=config,
             args_buffer=ArgsBuffer(mode=BufferMode.NO_BUF, size=None),
             input_schema=schemas.LogSchema,
             output_schema=schemas.ParserSchema,
diff --git a/src/detectmatelibrary/detectors/bigram_frequency_detector.py b/src/detectmatelibrary/detectors/bigram_frequency_detector.py
index 4ee0ccaf..f90bb6a3 100644
--- a/src/detectmatelibrary/detectors/bigram_frequency_detector.py
+++ b/src/detectmatelibrary/detectors/bigram_frequency_detector.py
@@ -73,7 +73,7 @@ class BigramFrequencyDetector(VariableDetector):
     def __init__(
         self,
         name: str = "BigramFrequencyDetector",
-        config: BigramFrequencyDetectorConfig = BigramFrequencyDetectorConfig(),
+        config: BigramFrequencyDetectorConfig | dict[str, Any] = BigramFrequencyDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = BigramFrequencyDetectorConfig.from_dict(config, name)
diff --git a/src/detectmatelibrary/detectors/charset_detector.py b/src/detectmatelibrary/detectors/charset_detector.py
index c88e5262..5ceb010c 100644
--- a/src/detectmatelibrary/detectors/charset_detector.py
+++ b/src/detectmatelibrary/detectors/charset_detector.py
@@ -17,7 +17,7 @@ class CharsetDetector(VariableDetector):
     def __init__(
         self,
         name: str = "CharsetDetector",
-        config: CharsetDetectorConfig = CharsetDetectorConfig(),
+        config: CharsetDetectorConfig | dict[str, Any] = CharsetDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = CharsetDetectorConfig.from_dict(config, name)
diff --git a/src/detectmatelibrary/detectors/event_sequence_detector.py b/src/detectmatelibrary/detectors/event_sequence_detector.py
index fde8f390..e6093418 100644
--- a/src/detectmatelibrary/detectors/event_sequence_detector.py
+++ b/src/detectmatelibrary/detectors/event_sequence_detector.py
@@ -9,7 +9,7 @@
 
 from collections import deque
 
-from typing_extensions import override
+from typing_extensions import override, Any
 from pydantic import Field, model_validator
 
 
@@ -71,7 +71,7 @@ class EventSequenceDetector(TrackerDetector):
     def __init__(
         self,
         name: str = "EventSequenceDetector",
-        config: EventSequenceDetectorConfig = EventSequenceDetectorConfig(),
+        config: EventSequenceDetectorConfig | dict[str, Any] = EventSequenceDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = EventSequenceDetectorConfig.from_dict(config, name)
diff --git a/src/detectmatelibrary/detectors/new_event_detector.py b/src/detectmatelibrary/detectors/new_event_detector.py
index 85ee74d1..541317d3 100644
--- a/src/detectmatelibrary/detectors/new_event_detector.py
+++ b/src/detectmatelibrary/detectors/new_event_detector.py
@@ -10,6 +10,7 @@
 from detectmatelibrary.schemas import ParserSchema, DetectorSchema
 
 from pydantic import Field
+from typing import Any
 
 
 class NewEventDetectorConfig(TrackerDetectorConfig):
@@ -24,7 +25,7 @@ class NewEventDetector(TrackerDetector):
     def __init__(
         self,
         name: str = "NewEventDetector",
-        config: NewEventDetectorConfig = NewEventDetectorConfig()
+        config: NewEventDetectorConfig | dict[str, Any] = NewEventDetectorConfig()
     ) -> None:
 
         if isinstance(config, dict):
diff --git a/src/detectmatelibrary/detectors/new_value_combo_detector.py b/src/detectmatelibrary/detectors/new_value_combo_detector.py
index cb492e38..e9024f94 100644
--- a/src/detectmatelibrary/detectors/new_value_combo_detector.py
+++ b/src/detectmatelibrary/detectors/new_value_combo_detector.py
@@ -91,7 +91,7 @@ class NewValueComboDetector(VariableDetector):
     def __init__(
         self,
         name: str = "NewValueComboDetector",
-        config: NewValueComboDetectorConfig = NewValueComboDetectorConfig(),
+        config: NewValueComboDetectorConfig | dict[str, Any] = NewValueComboDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = NewValueComboDetectorConfig.from_dict(config, name)
diff --git a/src/detectmatelibrary/detectors/new_value_detector.py b/src/detectmatelibrary/detectors/new_value_detector.py
index 2eed4f55..0931074b 100644
--- a/src/detectmatelibrary/detectors/new_value_detector.py
+++ b/src/detectmatelibrary/detectors/new_value_detector.py
@@ -17,7 +17,7 @@ class NewValueDetector(VariableDetector):
     def __init__(
         self,
         name: str = "NewValueDetector",
-        config: NewValueDetectorConfig = NewValueDetectorConfig(),
+        config: NewValueDetectorConfig | dict[str, Any] = NewValueDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = NewValueDetectorConfig.from_dict(config, name)
diff --git a/src/detectmatelibrary/detectors/random_detector.py b/src/detectmatelibrary/detectors/random_detector.py
index 44c05056..1dfd5198 100644
--- a/src/detectmatelibrary/detectors/random_detector.py
+++ b/src/detectmatelibrary/detectors/random_detector.py
@@ -7,7 +7,7 @@
 import detectmatelibrary.schemas as sc
 
 from typing_extensions import override
-from typing import List
+from typing import List, Any
 
 from pydantic import Field
 import numpy as np
@@ -26,7 +26,7 @@ class RandomDetector(CoreDetector):
     def __init__(
         self,
         name: str = "RandomDetector",
-        config: RandomDetectorConfig = RandomDetectorConfig(),
+        config: RandomDetectorConfig | dict[str, Any] = RandomDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = RandomDetectorConfig.from_dict(config, name)
diff --git a/src/detectmatelibrary/detectors/value_range_detector.py b/src/detectmatelibrary/detectors/value_range_detector.py
index 5fda5192..09675eea 100644
--- a/src/detectmatelibrary/detectors/value_range_detector.py
+++ b/src/detectmatelibrary/detectors/value_range_detector.py
@@ -26,7 +26,7 @@ class ValueRangeDetector(VariableDetector):
     def __init__(
         self,
         name: str = "ValueRangeDetector",
-        config: ValueRangeDetectorConfig = ValueRangeDetectorConfig(),
+        config: ValueRangeDetectorConfig | dict[str, Any] = ValueRangeDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = ValueRangeDetectorConfig.from_dict(config, name)

From f53061a3069dbc783f2bef52321dce4dd5cc5f85 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 09:34:13 +0200
Subject: [PATCH 40/86] find configs in ipy

---
 src/detectmatelibrary/__init__.py             |  2 ++
 .../alert_aggregation/__init__.py             |  6 +++++
 .../alert_aggregation/basic_concat.py         |  8 +++---
 src/detectmatelibrary/helper/i_pick_you.py    | 26 +++++++++++++++++++
 src/detectmatelibrary/parsers/__init__.py     | 23 ++++++++++++++++
 tests/test_helper/test_ipickyou.py            | 21 +++++++++++++++
 6 files changed, 82 insertions(+), 4 deletions(-)
 create mode 100644 src/detectmatelibrary/alert_aggregation/__init__.py
 create mode 100644 src/detectmatelibrary/helper/i_pick_you.py
 create mode 100644 tests/test_helper/test_ipickyou.py

diff --git a/src/detectmatelibrary/__init__.py b/src/detectmatelibrary/__init__.py
index 3cfe8053..15479df2 100644
--- a/src/detectmatelibrary/__init__.py
+++ b/src/detectmatelibrary/__init__.py
@@ -1,4 +1,5 @@
 from . import common
+from . import alert_aggregation
 from . import detectors
 from . import parsers
 from . import schemas
@@ -10,6 +11,7 @@
     "common",
     "detectors",
     "parsers",
+    "alert_aggregation",
     "schemas",
     "utils",
     "__authors__",
diff --git a/src/detectmatelibrary/alert_aggregation/__init__.py b/src/detectmatelibrary/alert_aggregation/__init__.py
new file mode 100644
index 00000000..aeb32921
--- /dev/null
+++ b/src/detectmatelibrary/alert_aggregation/__init__.py
@@ -0,0 +1,6 @@
+from .basic_concat import BasicConcatAggregation, BasicConcatAggregationConfig
+
+__all__ = [
+    "BasicConcatAggregation",
+    "BasicConcatAggregationConfig",
+]
diff --git a/src/detectmatelibrary/alert_aggregation/basic_concat.py b/src/detectmatelibrary/alert_aggregation/basic_concat.py
index 2ca1ec32..a5701f11 100644
--- a/src/detectmatelibrary/alert_aggregation/basic_concat.py
+++ b/src/detectmatelibrary/alert_aggregation/basic_concat.py
@@ -1,6 +1,6 @@
 from detectmatelibrary.common.alert_aggregator import (CoreAlertAggregatorConfig, CoreAlertAggregator)
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
-from typing import Any, Optional
+from typing import Any
 
 
 class BasicConcatAggregationConfig(CoreAlertAggregatorConfig):
@@ -13,12 +13,12 @@ class BasicConcatAggregation(CoreAlertAggregator):
     def __init__(
         self,
         name: str = "BasicConcatAggregator",
-        config: Optional[BasicConcatAggregationConfig | dict[str, Any]] = BasicConcatAggregationConfig(),
+        config: BasicConcatAggregationConfig | dict[str, Any] = BasicConcatAggregationConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = BasicConcatAggregationConfig.from_dict(config, name)
-        buffer_size: int = config.buffer_size  # type: ignore
-        self.deduplicate_values: bool = config.deduplicate_values  # type: ignore
+        buffer_size: int = config.buffer_size
+        self.deduplicate_values: bool = config.deduplicate_values
         super().__init__(name=name, buffer_size=buffer_size, config=config)
 
     def aggregate_alerts(
diff --git a/src/detectmatelibrary/helper/i_pick_you.py b/src/detectmatelibrary/helper/i_pick_you.py
new file mode 100644
index 00000000..cc94442b
--- /dev/null
+++ b/src/detectmatelibrary/helper/i_pick_you.py
@@ -0,0 +1,26 @@
+from detectmatelibrary.common.core import CoreConfig
+from detectmatelibrary import detectors, parsers, alert_aggregation
+
+from typing import Optional
+
+
+__types = {
+    "parsers": parsers,
+    "detectors": detectors,
+    "alert_aggregators": alert_aggregation
+}
+
+
+def find_config_from_name(
+    method_type: str, component_type: str
+) -> Optional[type[CoreConfig]]:
+
+    for obj in (dir(module := __types[component_type])):
+        try:
+            if isinstance(conf := getattr(module, obj)(), CoreConfig):
+                if conf.method_type == method_type:
+                    return getattr(module, obj)  # type: ignore
+        except TypeError:
+            pass
+
+    return None
diff --git a/src/detectmatelibrary/parsers/__init__.py b/src/detectmatelibrary/parsers/__init__.py
index e69de29b..889c74ca 100644
--- a/src/detectmatelibrary/parsers/__init__.py
+++ b/src/detectmatelibrary/parsers/__init__.py
@@ -0,0 +1,23 @@
+from .drain import DrainParser, DrainConfig
+from .autoparser import AutoParser, AutoParserConfig
+from .json_parser import JsonParser, JsonParserConfig
+from .tree_matcher import TemplateCppTreeMatcher, TemplateCppTreeMatcherConfig
+# from .logbatcher import LogBatcherParser, LogBatcherParserConfig
+# TODO: logbacther does not pass the mypy
+from .template_matcher import MatcherParser, MatcherParserConfig
+
+
+__all__ = [
+    "DrainParser",
+    "DrainConfig",
+    "AutoParser",
+    "AutoParserConfig",
+    "JsonParser",
+    "JsonParserConfig",
+    "TemplateCppTreeMatcher",
+    "TemplateCppTreeMatcherConfig",
+    # "LogBatcherParser",
+    # "LogBatcherParserConfig",
+    "MatcherParser",
+    "MatcherParserConfig",
+]
diff --git a/tests/test_helper/test_ipickyou.py b/tests/test_helper/test_ipickyou.py
new file mode 100644
index 00000000..25baa98c
--- /dev/null
+++ b/tests/test_helper/test_ipickyou.py
@@ -0,0 +1,21 @@
+from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregationConfig
+from detectmatelibrary.detectors.random_detector import RandomDetectorConfig
+from detectmatelibrary.parsers.drain import DrainConfig
+
+import detectmatelibrary.helper.i_pick_you as ipy
+
+
+class TestFindFromName:
+    def test_get_configs(self):
+        assert (config := ipy.find_config_from_name("drain_parser", "parsers")) is not None
+        assert isinstance(config(), DrainConfig)
+
+        assert (config := ipy.find_config_from_name("random_detector", "detectors")) is not None
+        assert isinstance(config(), RandomDetectorConfig)
+
+        assert (config := ipy.find_config_from_name(
+            "basic_concat_aggregator", "alert_aggregators"
+        )) is not None
+        assert isinstance(config(), BasicConcatAggregationConfig)
+
+        assert ipy.find_config_from_name("aux", "alert_aggregators") is None

From aaac6d204acead37855629d7cf97cfc472f1e12d Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 09:54:10 +0200
Subject: [PATCH 41/86] add to find component instead of the other

---
 src/detectmatelibrary/helper/i_pick_you.py | 19 +++++++++++++------
 tests/test_helper/test_ipickyou.py         | 20 ++++++++++----------
 2 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/src/detectmatelibrary/helper/i_pick_you.py b/src/detectmatelibrary/helper/i_pick_you.py
index cc94442b..4ecab212 100644
--- a/src/detectmatelibrary/helper/i_pick_you.py
+++ b/src/detectmatelibrary/helper/i_pick_you.py
@@ -1,5 +1,6 @@
-from detectmatelibrary.common.core import CoreConfig
+from detectmatelibrary.common.core import CoreConfig, CoreComponent
 from detectmatelibrary import detectors, parsers, alert_aggregation
+from detectmatelibrary.schemas import BaseSchema
 
 from typing import Optional
 
@@ -11,15 +12,21 @@
 }
 
 
-def find_config_from_name(
+def find_component_from_type(
     method_type: str, component_type: str
-) -> Optional[type[CoreConfig]]:
+) -> Optional[type[CoreComponent[BaseSchema, BaseSchema]]]:
 
-    for obj in (dir(module := __types[component_type])):
+    for obj in dir(module := __types[component_type]):
         try:
-            if isinstance(conf := getattr(module, obj)(), CoreConfig):
+            if isinstance(conf := getattr(module, obj)(), CoreConfig):  # Look for config
                 if conf.method_type == method_type:
-                    return getattr(module, obj)  # type: ignore
+                    for comp in dir(__types[component_type]):  # Look for Component
+                        try:
+                            if isinstance(comp_ := getattr(module, comp)(), CoreComponent):
+                                if type(comp_.config) == type(conf):  # noqa: E721
+                                    return getattr(module, comp)  # type: ignore
+                        except TypeError:
+                            pass
         except TypeError:
             pass
 
diff --git a/tests/test_helper/test_ipickyou.py b/tests/test_helper/test_ipickyou.py
index 25baa98c..c7b24b1c 100644
--- a/tests/test_helper/test_ipickyou.py
+++ b/tests/test_helper/test_ipickyou.py
@@ -1,21 +1,21 @@
-from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregationConfig
-from detectmatelibrary.detectors.random_detector import RandomDetectorConfig
-from detectmatelibrary.parsers.drain import DrainConfig
+from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation
+from detectmatelibrary.detectors.random_detector import RandomDetector
+from detectmatelibrary.parsers.drain import DrainParser
 
 import detectmatelibrary.helper.i_pick_you as ipy
 
 
 class TestFindFromName:
     def test_get_configs(self):
-        assert (config := ipy.find_config_from_name("drain_parser", "parsers")) is not None
-        assert isinstance(config(), DrainConfig)
+        assert (config := ipy.find_component_from_type("drain_parser", "parsers")) is not None
+        assert isinstance(config(), DrainParser)
 
-        assert (config := ipy.find_config_from_name("random_detector", "detectors")) is not None
-        assert isinstance(config(), RandomDetectorConfig)
+        assert (config := ipy.find_component_from_type("random_detector", "detectors")) is not None
+        assert isinstance(config(), RandomDetector)
 
-        assert (config := ipy.find_config_from_name(
+        assert (config := ipy.find_component_from_type(
             "basic_concat_aggregator", "alert_aggregators"
         )) is not None
-        assert isinstance(config(), BasicConcatAggregationConfig)
+        assert isinstance(config(), BasicConcatAggregation)
 
-        assert ipy.find_config_from_name("aux", "alert_aggregators") is None
+        assert ipy.find_component_from_type("aux", "alert_aggregators") is None

From 9874b21234fe6326573c281928d61e69879da3b0 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 10:07:08 +0200
Subject: [PATCH 42/86] preparing tests

---
 src/detectmatelibrary/common/core.py       |  5 ++++-
 src/detectmatelibrary/helper/i_pick_you.py | 19 +++++++++++++++++--
 tests/test_helper/test_ipickyou.py         | 13 +++++++++----
 3 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/src/detectmatelibrary/common/core.py b/src/detectmatelibrary/common/core.py
index 3aec5409..5b7d59bd 100644
--- a/src/detectmatelibrary/common/core.py
+++ b/src/detectmatelibrary/common/core.py
@@ -69,11 +69,14 @@ def __init__(
         self,
         name: str,
         type_: str = "Core",
-        config: CoreConfig = CoreConfig(),
+        config: CoreConfig | dict[str, Any] = CoreConfig(),
         args_buffer: ArgsBuffer = ArgsBuffer(BufferMode.NO_BUF),
         input_schema: type[BaseSchema] = BaseSchema,
         output_schema: type[BaseSchema] = BaseSchema,
     ) -> None:
+        if isinstance(config, dict):
+            config = CoreConfig.from_dict(config, name)
+
         Component.__init__(self, name=name, type_=type_, config=config)
         FedOperations.__init__(self)
         self.config: CoreConfig
diff --git a/src/detectmatelibrary/helper/i_pick_you.py b/src/detectmatelibrary/helper/i_pick_you.py
index 4ecab212..8c8a43d2 100644
--- a/src/detectmatelibrary/helper/i_pick_you.py
+++ b/src/detectmatelibrary/helper/i_pick_you.py
@@ -2,7 +2,7 @@
 from detectmatelibrary import detectors, parsers, alert_aggregation
 from detectmatelibrary.schemas import BaseSchema
 
-from typing import Optional
+from typing import Optional, Any
 
 
 __types = {
@@ -12,7 +12,7 @@
 }
 
 
-def find_component_from_type(
+def _find_component_from_type(
     method_type: str, component_type: str
 ) -> Optional[type[CoreComponent[BaseSchema, BaseSchema]]]:
 
@@ -31,3 +31,18 @@ def find_component_from_type(
             pass
 
     return None
+
+
+def pickComponent(config: CoreConfig | dict[str, Any], component_type: str) -> CoreComponent:
+    """Component, I pick you!!!"""
+
+    if isinstance(config, CoreConfig):
+        method_type = config.method_type
+    else:
+        method_type = config[method_type]
+
+    component = _find_component_from_type(method_type, component_type=component_type)
+    if component is None:
+        raise ValueError(f"{method_type} form {component_type} not found.")
+
+    return component(name="picked_component", config=config)
diff --git a/tests/test_helper/test_ipickyou.py b/tests/test_helper/test_ipickyou.py
index c7b24b1c..a2c0085f 100644
--- a/tests/test_helper/test_ipickyou.py
+++ b/tests/test_helper/test_ipickyou.py
@@ -7,15 +7,20 @@
 
 class TestFindFromName:
     def test_get_configs(self):
-        assert (config := ipy.find_component_from_type("drain_parser", "parsers")) is not None
+        assert (config := ipy._find_component_from_type("drain_parser", "parsers")) is not None
         assert isinstance(config(), DrainParser)
 
-        assert (config := ipy.find_component_from_type("random_detector", "detectors")) is not None
+        assert (config := ipy._find_component_from_type("random_detector", "detectors")) is not None
         assert isinstance(config(), RandomDetector)
 
-        assert (config := ipy.find_component_from_type(
+        assert (config := ipy._find_component_from_type(
             "basic_concat_aggregator", "alert_aggregators"
         )) is not None
         assert isinstance(config(), BasicConcatAggregation)
 
-        assert ipy.find_component_from_type("aux", "alert_aggregators") is None
+        assert ipy._find_component_from_type("aux", "alert_aggregators") is None
+
+
+class TestPickComponets:
+    def test_pick_component(self):
+        pass

From 8574a6b08df07e399769e87ba02eba3d00840e94 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 10:09:19 +0200
Subject: [PATCH 43/86] correct schema field name

---
 docs/examples/alert_aggregators/logid_count.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/examples/alert_aggregators/logid_count.py b/docs/examples/alert_aggregators/logid_count.py
index f3e2f230..de92cda4 100644
--- a/docs/examples/alert_aggregators/logid_count.py
+++ b/docs/examples/alert_aggregators/logid_count.py
@@ -16,7 +16,7 @@ def generate_schema(log_id: str | list[str]) -> schemas.DetectorSchema:
         "detectorID": "1",
         "detectorType": "dummy",
         "alertID": "2",
-        "detectionTimestamp": 0,
+        "detectedTimestamp": 0,
         "logIDs": log_id,
         "score": 0.2,
         "extractedTimestamps": [-1],

From ff92f40330bdabd2f98708d986c98b3c4c1c543e Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 10:24:49 +0200
Subject: [PATCH 44/86] add optional name in pick component

---
 src/detectmatelibrary/helper/i_pick_you.py | 21 +++++++---
 tests/test_helper/test_ipickyou.py         | 49 ++++++++++++++++++----
 2 files changed, 57 insertions(+), 13 deletions(-)

diff --git a/src/detectmatelibrary/helper/i_pick_you.py b/src/detectmatelibrary/helper/i_pick_you.py
index 8c8a43d2..6cedf188 100644
--- a/src/detectmatelibrary/helper/i_pick_you.py
+++ b/src/detectmatelibrary/helper/i_pick_you.py
@@ -4,7 +4,7 @@
 
 from typing import Optional, Any
 
-
+# --------------------- Auxiliar
 __types = {
     "parsers": parsers,
     "detectors": detectors,
@@ -33,16 +33,27 @@ def _find_component_from_type(
     return None
 
 
-def pickComponent(config: CoreConfig | dict[str, Any], component_type: str) -> CoreComponent:
-    """Component, I pick you!!!"""
+# --------------------------------- Main methods
+def pickComponent(
+    config: CoreConfig | dict[str, Any], component_type: str, name: Optional[str] = None
+) -> CoreComponent:
+    """Component, I pick you!!!
+
+    If name=None, it will check in the config
+    """
 
     if isinstance(config, CoreConfig):
         method_type = config.method_type
+        name = name if name is not None else "pickedComponent"
+
     else:
-        method_type = config[method_type]
+        if name is None:
+            name = list(config[component_type].keys())[0]
+
+        method_type = config[component_type][name]["method_type"]
 
     component = _find_component_from_type(method_type, component_type=component_type)
     if component is None:
         raise ValueError(f"{method_type} form {component_type} not found.")
 
-    return component(name="picked_component", config=config)
+    return component(name=name, config=config)
diff --git a/tests/test_helper/test_ipickyou.py b/tests/test_helper/test_ipickyou.py
index a2c0085f..f6b54910 100644
--- a/tests/test_helper/test_ipickyou.py
+++ b/tests/test_helper/test_ipickyou.py
@@ -1,26 +1,59 @@
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation
 from detectmatelibrary.detectors.random_detector import RandomDetector
-from detectmatelibrary.parsers.drain import DrainParser
+from detectmatelibrary.parsers.drain import DrainParser, DrainConfig
 
 import detectmatelibrary.helper.i_pick_you as ipy
 
 
 class TestFindFromName:
     def test_get_configs(self):
-        assert (config := ipy._find_component_from_type("drain_parser", "parsers")) is not None
-        assert isinstance(config(), DrainParser)
+        assert (comp := ipy._find_component_from_type("drain_parser", "parsers")) is not None
+        assert isinstance(comp(), DrainParser)
 
-        assert (config := ipy._find_component_from_type("random_detector", "detectors")) is not None
-        assert isinstance(config(), RandomDetector)
+        assert (comp := ipy._find_component_from_type("random_detector", "detectors")) is not None
+        assert isinstance(comp(), RandomDetector)
 
-        assert (config := ipy._find_component_from_type(
+        assert (comp := ipy._find_component_from_type(
             "basic_concat_aggregator", "alert_aggregators"
         )) is not None
-        assert isinstance(config(), BasicConcatAggregation)
+        assert isinstance(comp(), BasicConcatAggregation)
 
         assert ipy._find_component_from_type("aux", "alert_aggregators") is None
 
 
 class TestPickComponets:
+    def test_pick_component_dict(self):
+        config = {
+            "detectors": {
+                "TestDetector": {"method_type": "random_detector"}
+            }
+        }
+        comp = ipy.pickComponent(
+            name="TestDetector", config=config, component_type="detectors"
+        )
+
+        assert isinstance(comp, RandomDetector)
+
+    def test_pick_component_dict_no_name(self):
+        config = {
+            "detectors": {
+                "TestDetector": {"method_type": "random_detector"}
+            }
+        }
+        comp = ipy.pickComponent(config=config, component_type="detectors")
+
+        assert isinstance(comp, RandomDetector)
+
     def test_pick_component(self):
-        pass
+        config = DrainConfig()
+        comp = ipy.pickComponent(
+            name="Drain", config=config, component_type="parsers"
+        )
+
+        assert isinstance(comp, DrainParser)
+
+    def test_pick_component_no_name(self):
+        config = DrainConfig()
+        comp = ipy.pickComponent(config=config, component_type="parsers")
+
+        assert isinstance(comp, DrainParser)

From c92dbabe4344b53a94981b0c0bcba18ac561ca71 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 10:35:26 +0200
Subject: [PATCH 45/86] add pickcomponents

---
 src/detectmatelibrary/helper/i_pick_you.py | 15 ++++++++++
 tests/test_helper/test_ipickyou.py         | 32 +++++++++++++++++++++-
 2 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/src/detectmatelibrary/helper/i_pick_you.py b/src/detectmatelibrary/helper/i_pick_you.py
index 6cedf188..42ef1c07 100644
--- a/src/detectmatelibrary/helper/i_pick_you.py
+++ b/src/detectmatelibrary/helper/i_pick_you.py
@@ -57,3 +57,18 @@ def pickComponent(
         raise ValueError(f"{method_type} form {component_type} not found.")
 
     return component(name=name, config=config)
+
+
+def pickComponents(
+    configs: list[CoreConfig | dict[str, Any]],
+    component_type: str,
+    names: Optional[list[str | None]] = None
+) -> list[CoreComponent]:
+
+    if names is None:
+        names = [None for _ in configs]
+
+    return [
+        pickComponent(config=config, component_type=component_type, name=name)
+        for config, name in zip(configs, names)
+    ]
diff --git a/tests/test_helper/test_ipickyou.py b/tests/test_helper/test_ipickyou.py
index f6b54910..be995eb0 100644
--- a/tests/test_helper/test_ipickyou.py
+++ b/tests/test_helper/test_ipickyou.py
@@ -1,5 +1,5 @@
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation
-from detectmatelibrary.detectors.random_detector import RandomDetector
+from detectmatelibrary.detectors.random_detector import RandomDetector, RandomDetectorConfig
 from detectmatelibrary.parsers.drain import DrainParser, DrainConfig
 
 import detectmatelibrary.helper.i_pick_you as ipy
@@ -57,3 +57,33 @@ def test_pick_component_no_name(self):
         comp = ipy.pickComponent(config=config, component_type="parsers")
 
         assert isinstance(comp, DrainParser)
+
+    def test_pick_multiple_components(self):
+        configs = [
+            {
+                "detectors": {
+                    "a": {"method_type": "random_detector"}
+                }
+            },
+            RandomDetectorConfig(),
+        ]
+        names = ["a", "b"]
+
+        for component in ipy.pickComponents(
+            configs=configs, names=names, component_type="detectors"
+        ):
+            assert isinstance(component, RandomDetector)
+
+    def test_pick_multiple_components_no_names(self):
+        configs = [
+            {
+                "detectors": {
+                    "a": {"method_type": "random_detector"}
+                }
+            },
+            RandomDetectorConfig(),
+        ]
+        for component in ipy.pickComponents(
+            configs=configs, component_type="detectors"
+        ):
+            assert isinstance(component, RandomDetector)

From c06659313eb1f7a232fcae3457af78063e71fb9d Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 10:36:58 +0200
Subject: [PATCH 46/86] correct schemas

---
 docs/examples/alert_aggregators/logid_count.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/examples/alert_aggregators/logid_count.py b/docs/examples/alert_aggregators/logid_count.py
index de92cda4..cb9d012a 100644
--- a/docs/examples/alert_aggregators/logid_count.py
+++ b/docs/examples/alert_aggregators/logid_count.py
@@ -19,10 +19,10 @@ def generate_schema(log_id: str | list[str]) -> schemas.DetectorSchema:
         "detectedTimestamp": 0,
         "logIDs": log_id,
         "score": 0.2,
-        "extractedTimestamps": [-1],
+        "logTimestamps": [-1],
         "description": "hello there",
         "receivedTimestamp": 1,
-        "alertsObtain": {"99 problems": "but logs aint one"}
+        "alertDetails": {"99 problems": "but logs aint one"}
     })
 
 

From 65d826da9e616b64bcd43818050ee83ab4ff9257 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 11:24:08 +0200
Subject: [PATCH 47/86] draft pipeline full implemented

---
 src/detectmatelibrary/pipeline.py | 106 ++++++++++++++++++++++--------
 1 file changed, 79 insertions(+), 27 deletions(-)

diff --git a/src/detectmatelibrary/pipeline.py b/src/detectmatelibrary/pipeline.py
index c230f102..c69c41da 100644
--- a/src/detectmatelibrary/pipeline.py
+++ b/src/detectmatelibrary/pipeline.py
@@ -1,13 +1,15 @@
 
 from detectmatelibrary.common.core import CoreComponent, CoreConfig
-from detectmatelibrary.common.detector import CoreDetectorConfig
-from detectmatelibrary.common.parser import CoreParserConfig
+from detectmatelibrary.common.alert_aggregator import CoreAlertAggregator, CoreAlertAggregatorConfig
+from detectmatelibrary.common.detector import CoreDetector, CoreDetectorConfig
+from detectmatelibrary.common.parser import CoreParser, CoreParserConfig
 
 from detectmatelibrary.utils.data_buffer import ArgsBuffer, BufferMode
+import detectmatelibrary.helper.i_pick_you as ipy
 
 import detectmatelibrary.schemas as sc
 
-from typing import Any, Optional, overload, override
+from typing import Any, overload, Optional, override
 from pydantic import Field
 
 
@@ -24,7 +26,7 @@ class PipelineConfig(CoreConfig):
     detectors: list[CoreDetectorConfig | dict[str, Any]] | None = Field(
         default=None, description="Detectors configuration use."
     )
-    aggregators: CoreParserConfig | dict[str, Any] | None = Field(
+    aggregator: CoreAlertAggregatorConfig | dict[str, Any] | None = Field(
         default=None, description="Aggregator configuration use, if do_aggregation=False keep empty."
     )
 
@@ -37,12 +39,43 @@ def _select_output(config: PipelineConfig) -> type[sc.BaseSchema]:
     return sc.DetectorSchema if config.do_aggregation else sc.AggregateSchema
 
 
+def _run_pipeline(
+    config: PipelineConfig,
+    input_: sc.ParserSchema | bytes | sc.LogSchema,
+    parser: Optional[CoreParser],
+    detectors: list[CoreDetector],
+    alert_aggreator: Optional[CoreAlertAggregator],
+) -> list[sc.DetectorSchema] | list[sc.AggregateSchema]:
+
+    input_ = input_ if isinstance(input_, list) else [input_]  # type: ignore
+    if config.do_parsing:
+        aux = []
+        for in_ in input_:  # type: ignore
+            if (out_ := parser.process(in_)) is not None:  # type: ignore
+                aux.append(out_)
+        input_ = aux   # type: ignore
+
+    output_ = []
+    for in_ in input_:  # type: ignore
+        for detector in detectors:
+            if (out_ := detector.process(in_)) is not None:  # type: ignore
+                output_.append(out_)
+
+    if not config.do_aggregation:
+        return output_   # type: ignore
+
+    last_output_ = []
+    for in_ in output_:
+        if (out_ := alert_aggreator.process(in_)) is not None:  # type: ignore
+            last_output_.append(out_)
+
+    return last_output_  # type: ignore
+
+
 class Pipeline(CoreComponent):
     def __init__(
         self,
         name: str = "MainPipeline",
-        buffer_mode: BufferMode = BufferMode.WINDOW,
-        buffer_size: Optional[int] = 1,
         config: PipelineConfig | dict[str, Any] = PipelineConfig(),
     ) -> None:
         if isinstance(config, dict):
@@ -52,44 +85,63 @@ def __init__(
             name=name,
             type_=config.method_type,
             config=config,
-            args_buffer=ArgsBuffer(mode=buffer_mode, size=buffer_size),
+            args_buffer=ArgsBuffer(mode=BufferMode.NO_BUF, size=None),
             input_schema=_select_input(config),
             output_schema=_select_output(config),
         )
         self.config: PipelineConfig
 
-    @overload    # type: ignore
+        self.parser: CoreParser | None = ipy.pickComponent(  # type: ignore
+            self.config.parser, component_type="parsers"
+        ) if self.config.do_parsing else None
+
+        self.detectors: list[CoreDetector] = ipy.pickComponents(  # type: ignore
+            self.config.parser, component_type="detectors"
+        )
+
+        self.alert_aggregator: CoreAlertAggregator | None = ipy.pickComponent(  # type: ignore
+            self.config.aggregator, component_type="alert_aggregation"
+        ) if self.config.do_aggregation else None
+
+    @overload  # type: ignore
     @override
-    def run(
-        self,
-        input_: list[sc.LogSchema] | sc.LogSchema,
-        output_: list[sc.DetectorSchema] | sc.DetectorSchema
-    ) -> bool:
+    def process(self, data: sc.LogSchema | bytes) -> sc.AggregateSchema | bytes | None:  # type: ignore
         pass
 
-    @overload
     @override
-    def run(self, input_: list[sc.LogSchema] | sc.LogSchema,  output_: sc.AggregateSchema) -> bool:
+    @overload
+    def process(  # type: ignore
+        self, data: sc.LogSchema | bytes
+    ) -> sc.DetectorSchema | bytes | None | list[sc.DetectorSchema] | list[bytes]:
         pass
 
     @overload
     @override
-    def run(
-        self,
-        input_: list[sc.ParserSchema] | sc.ParserSchema,
-        output_: list[sc.DetectorSchema] | sc.DetectorSchema
-    ) -> bool:
+    def process(self, data: sc.ParserSchema | bytes) -> sc.AggregateSchema | bytes | None:
         pass
 
     @overload
     @override
-    def run(self, input_: list[sc.ParserSchema] | sc.ParserSchema,  output_: sc.AggregateSchema) -> bool:
+    def process(  # type: ignore
+        self, data: sc.ParserSchema | bytes
+    ) -> sc.DetectorSchema | bytes | None | list[sc.DetectorSchema] | list[bytes]:
         pass
 
     @override
-    def run(
-        self,
-        input_: list[sc.LogSchema] | sc.LogSchema | list[sc.ParserSchema] | sc.ParserSchema,
-        output_: list[sc.DetectorSchema] | sc.DetectorSchema | sc.AggregateSchema
-    ) -> bool:
-        return True
+    def process(
+        self, data: sc.ParserSchema | bytes | sc.LogSchema
+    ) -> sc.DetectorSchema | bytes | None | list[sc.DetectorSchema] | list[bytes] | sc.AggregateSchema:
+
+        out_ = _run_pipeline(
+            self.config,
+            input_=data,
+            parser=self.parser,
+            detectors=self.detectors,
+            alert_aggreator=self.alert_aggregator
+        )
+
+        if len(out_) == 0:
+            return None
+        if len(out_) == 1:
+            return out_[0]
+        return out_  # type: ignore

From 034dbd6e31442477f9fd639740dd62a59ee1a6bc Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 11:53:43 +0200
Subject: [PATCH 48/86] add pipeline first tests

---
 tests/test_pipelines/test_main_pipeline.py | 74 ++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 tests/test_pipelines/test_main_pipeline.py

diff --git a/tests/test_pipelines/test_main_pipeline.py b/tests/test_pipelines/test_main_pipeline.py
new file mode 100644
index 00000000..fc47c2e9
--- /dev/null
+++ b/tests/test_pipelines/test_main_pipeline.py
@@ -0,0 +1,74 @@
+
+from detectmatelibrary.pipeline import PipelineConfig, _run_pipeline
+
+from detectmatelibrary._testutils.dummy_parser import DummyParser
+from detectmatelibrary._testutils.dummy_detector import DummyDetectorConfig
+from detectmatelibrary._testutils.dummy_alert_aggregator import (
+    DummyAlertAggregator, DummyAlertAggregatorConfig
+)
+
+import detectmatelibrary.schemas as sc
+
+from detectmatelibrary.common.detector import CoreDetector
+
+
+class AlwayAlert(CoreDetector):
+    """A dummy detector for testing purposes."""
+
+    def __init__(
+        self,
+        name: str = "DummyDetector",
+        config: DummyDetectorConfig = DummyDetectorConfig()
+    ) -> None:
+
+        super().__init__(name=name, config=config)
+
+    def detect(
+        self,
+        input_: list[sc.ParserSchema] | sc.ParserSchema,
+        output_: sc.DetectorSchema
+    ) -> bool:
+        output_["description"] = "Dummy detection process"
+
+        output_["score"] = 1.0
+        output_["alertDetails"]["type"] = "Anomaly detected by DummyDetector"
+        return True
+
+
+log_schema = {"logID": "1", "log": "hello"}
+
+
+class TestRunPipeline:
+    def test_run_parser2detectors(self) -> None:
+        out_ = _run_pipeline(
+            config=PipelineConfig(do_parsing=True, do_aggregation=False),
+            input_=log_schema,
+            parser=DummyParser(),
+            detectors=[AlwayAlert(), AlwayAlert()],
+            alert_aggreator=None
+        )
+
+        assert isinstance(out_, list)
+        assert isinstance(out_[0], sc.DetectorSchema)
+        assert len(out_) == 2
+
+    def test_run_parser2aggregator(self) -> None:
+        out_ = _run_pipeline(
+            config=PipelineConfig(do_parsing=True, do_aggregation=True),
+            input_=log_schema,
+            parser=DummyParser(),
+            detectors=[AlwayAlert(), AlwayAlert()],
+            alert_aggreator=DummyAlertAggregator(
+                config=DummyAlertAggregatorConfig(buffer_size=2)
+            )
+        )
+
+        assert isinstance(out_, list)
+        assert isinstance(out_[0], sc.AggregateSchema)
+        assert len(out_) == 1
+
+    def test_run_detectors_only(self) -> None:
+        pass
+
+    def test_run_detectors2aggregator(self) -> None:
+        pass

From b33923690cc0cd3ae3422736c504e946de816852 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 11:57:55 +0200
Subject: [PATCH 49/86] solve precommit issues from merge

---
 docs/examples/alert_aggregators/basic_concat.py | 1 -
 docs/examples/config/update.py                  | 2 --
 2 files changed, 3 deletions(-)

diff --git a/docs/examples/alert_aggregators/basic_concat.py b/docs/examples/alert_aggregators/basic_concat.py
index 749a3fe3..101c311e 100644
--- a/docs/examples/alert_aggregators/basic_concat.py
+++ b/docs/examples/alert_aggregators/basic_concat.py
@@ -1,6 +1,5 @@
 
 # --8<-- [start:example_1]
-import yaml
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation
 
 import detectmatelibrary.schemas as schemas
diff --git a/docs/examples/config/update.py b/docs/examples/config/update.py
index ae50ad48..6c104a2f 100644
--- a/docs/examples/config/update.py
+++ b/docs/examples/config/update.py
@@ -25,7 +25,6 @@
 
 from detectmatelibrary.common.core import CoreConfig
 from detectmatelibrary.common.detector import CoreDetectorConfig
-from detectmatelibrary.common.alert_aggregator import CoreAlertAggregatorConfig
 from detectmatelibrary.common.parser import CoreParserConfig
 from detectmatelibrary.common.alert_aggregator import CoreAlertAggregatorConfig
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregationConfig
@@ -33,7 +32,6 @@
 from detectmatelibrary.base_detectors import VariableDetectorConfig
 from detectmatelibrary.base_detectors import DeepLearningDetectorConfig
 
-from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregationConfig
 
 from typing import Any
 

From 06b830efe91d310e4c38bf44af0b1a4e5cf6a6b2 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2026 12:02:52 +0200
Subject: [PATCH 50/86] Automated documentation update

---
 docs/alert_aggregator.md                      | 4 ++--
 docs/alert_aggregators/basic_concatenation.md | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index c0deb337..0c2edd83 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -89,8 +89,8 @@ There are some parameters, that **every** alert aggregator inherits from `CoreAl
     | Field | Type | Default | Description |
     |---|---|---|---|
     | `start_id` | integer | 10 | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
diff --git a/docs/alert_aggregators/basic_concatenation.md b/docs/alert_aggregators/basic_concatenation.md
index 426bd705..bca3916b 100644
--- a/docs/alert_aggregators/basic_concatenation.md
+++ b/docs/alert_aggregators/basic_concatenation.md
@@ -63,8 +63,8 @@ All parameters this alert aggregator accepts, grouped by the YAML block they go
     |---|---|---|---|---|
     | `buffer_size` | integer | 3 | specific | Buffer size use in the aggregation. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-    | `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
     | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
     | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |

From 254c062203f50dd8fb338e3e6040dae61f739564 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 12:08:38 +0200
Subject: [PATCH 51/86] add all pipeline tests

---
 tests/test_pipelines/test_main_pipeline.py | 41 ++++++++++++++++++++--
 1 file changed, 38 insertions(+), 3 deletions(-)

diff --git a/tests/test_pipelines/test_main_pipeline.py b/tests/test_pipelines/test_main_pipeline.py
index fc47c2e9..2249b22f 100644
--- a/tests/test_pipelines/test_main_pipeline.py
+++ b/tests/test_pipelines/test_main_pipeline.py
@@ -35,7 +35,20 @@ def detect(
         return True
 
 
-log_schema = {"logID": "1", "log": "hello"}
+log_schema = sc.LogSchema({"logID": "1", "log": "hello"})
+
+parser_schema = sc.ParserSchema({
+    "parserType": "a",
+    "parserID": "ciao",
+    "logID": "1",
+    "eventID": 1,
+    "template": "a",
+    "parsedLogID": "as2",
+    "log": "hello",
+    "receivedTimestamp": 1,
+    "parsedTimestamp": 2,
+    "headerVariables": {"Time": "-1"}
+})
 
 
 class TestRunPipeline:
@@ -68,7 +81,29 @@ def test_run_parser2aggregator(self) -> None:
         assert len(out_) == 1
 
     def test_run_detectors_only(self) -> None:
-        pass
+        out_ = _run_pipeline(
+            config=PipelineConfig(do_parsing=False, do_aggregation=False),
+            input_=parser_schema,
+            parser=None,
+            detectors=[AlwayAlert(), AlwayAlert()],
+            alert_aggreator=None
+        )
+
+        assert isinstance(out_, list)
+        assert isinstance(out_[0], sc.DetectorSchema)
+        assert len(out_) == 2
 
     def test_run_detectors2aggregator(self) -> None:
-        pass
+        out_ = _run_pipeline(
+            config=PipelineConfig(do_parsing=False, do_aggregation=True),
+            input_=parser_schema,
+            parser=None,
+            detectors=[AlwayAlert(), AlwayAlert()],
+            alert_aggreator=DummyAlertAggregator(
+                config=DummyAlertAggregatorConfig(buffer_size=2)
+            )
+        )
+
+        assert isinstance(out_, list)
+        assert isinstance(out_[0], sc.AggregateSchema)
+        assert len(out_) == 1

From 4f5f52cead0efcde15617d19a544999e7a5044a7 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 13:18:31 +0200
Subject: [PATCH 52/86] add full pipeline test

---
 .../alert_aggregation/__init__.py             |  3 ++
 .../alert_aggregation/basic_concat.py         |  4 +-
 .../alert_aggregation/logid_count.py          |  4 +-
 src/detectmatelibrary/pipeline.py             | 15 ++++--
 .../test_common/test_core_alert_aggregator.py | 12 ++---
 tests/test_pipelines/test_main_pipeline.py    | 50 ++++++++++++++++++-
 6 files changed, 72 insertions(+), 16 deletions(-)

diff --git a/src/detectmatelibrary/alert_aggregation/__init__.py b/src/detectmatelibrary/alert_aggregation/__init__.py
index aeb32921..d1b82f94 100644
--- a/src/detectmatelibrary/alert_aggregation/__init__.py
+++ b/src/detectmatelibrary/alert_aggregation/__init__.py
@@ -1,6 +1,9 @@
 from .basic_concat import BasicConcatAggregation, BasicConcatAggregationConfig
+from .logid_count import LogIDCountAggegation, LogIDCountAggegationConfig
 
 __all__ = [
     "BasicConcatAggregation",
     "BasicConcatAggregationConfig",
+    "LogIDCountAggegation",
+    "LogIDCountAggegationConfig",
 ]
diff --git a/src/detectmatelibrary/alert_aggregation/basic_concat.py b/src/detectmatelibrary/alert_aggregation/basic_concat.py
index 708c7335..b03c3644 100644
--- a/src/detectmatelibrary/alert_aggregation/basic_concat.py
+++ b/src/detectmatelibrary/alert_aggregation/basic_concat.py
@@ -4,7 +4,7 @@
 
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
 
-from typing import Any, Optional
+from typing import Any
 from pydantic import Field
 
 
@@ -26,7 +26,7 @@ def __init__(
         if isinstance(config, dict):
             config = BasicConcatAggregationConfig.from_dict(config, name)
 
-        buffer_size: int = config.buffer_size  # type: ignore
+        buffer_size: int = config.buffer_size
         super().__init__(name=name, buffer_size=buffer_size, config=config)
 
     def aggregate_alerts(
diff --git a/src/detectmatelibrary/alert_aggregation/logid_count.py b/src/detectmatelibrary/alert_aggregation/logid_count.py
index deea9db2..335aeabd 100644
--- a/src/detectmatelibrary/alert_aggregation/logid_count.py
+++ b/src/detectmatelibrary/alert_aggregation/logid_count.py
@@ -5,7 +5,7 @@
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
 from detectmatelibrary.utils.data_buffer import BufferMode
 
-from typing import Any, Optional
+from typing import Any
 from functools import lru_cache
 from pydantic import Field
 import polars as pl
@@ -66,7 +66,7 @@ class LogIDCountAggegation(CoreAlertAggregator):
     def __init__(
         self,
         name: str = "LogIDCountAggregator",
-        config: Optional[LogIDCountAggegationConfig | dict[str, Any]] = LogIDCountAggegationConfig(),
+        config: LogIDCountAggegationConfig | dict[str, Any] = LogIDCountAggegationConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = LogIDCountAggegationConfig.from_dict(config, name)
diff --git a/src/detectmatelibrary/pipeline.py b/src/detectmatelibrary/pipeline.py
index c69c41da..679a12e7 100644
--- a/src/detectmatelibrary/pipeline.py
+++ b/src/detectmatelibrary/pipeline.py
@@ -1,5 +1,6 @@
 
 from detectmatelibrary.common.core import CoreComponent, CoreConfig
+
 from detectmatelibrary.common.alert_aggregator import CoreAlertAggregator, CoreAlertAggregatorConfig
 from detectmatelibrary.common.detector import CoreDetector, CoreDetectorConfig
 from detectmatelibrary.common.parser import CoreParser, CoreParserConfig
@@ -39,6 +40,10 @@ def _select_output(config: PipelineConfig) -> type[sc.BaseSchema]:
     return sc.DetectorSchema if config.do_aggregation else sc.AggregateSchema
 
 
+def _check_output(in_: sc.BaseSchema, method: CoreComponent) -> Optional[bytes | sc.BaseSchema]:
+    return method.process(in_)
+
+
 def _run_pipeline(
     config: PipelineConfig,
     input_: sc.ParserSchema | bytes | sc.LogSchema,
@@ -51,14 +56,14 @@ def _run_pipeline(
     if config.do_parsing:
         aux = []
         for in_ in input_:  # type: ignore
-            if (out_ := parser.process(in_)) is not None:  # type: ignore
+            if (out_ := _check_output(in_, parser)) is not None:  # type: ignore
                 aux.append(out_)
         input_ = aux   # type: ignore
 
     output_ = []
     for in_ in input_:  # type: ignore
         for detector in detectors:
-            if (out_ := detector.process(in_)) is not None:  # type: ignore
+            if (out_ := _check_output(in_, detector)) is not None:  # type: ignore
                 output_.append(out_)
 
     if not config.do_aggregation:
@@ -66,7 +71,7 @@ def _run_pipeline(
 
     last_output_ = []
     for in_ in output_:
-        if (out_ := alert_aggreator.process(in_)) is not None:  # type: ignore
+        if (out_ := _check_output(in_, alert_aggreator)) is not None:  # type: ignore
             last_output_.append(out_)
 
     return last_output_  # type: ignore
@@ -96,11 +101,11 @@ def __init__(
         ) if self.config.do_parsing else None
 
         self.detectors: list[CoreDetector] = ipy.pickComponents(  # type: ignore
-            self.config.parser, component_type="detectors"
+            self.config.detectors, component_type="detectors"
         )
 
         self.alert_aggregator: CoreAlertAggregator | None = ipy.pickComponent(  # type: ignore
-            self.config.aggregator, component_type="alert_aggregation"
+            self.config.aggregator, component_type="alert_aggregators"
         ) if self.config.do_aggregation else None
 
     @overload  # type: ignore
diff --git a/tests/test_common/test_core_alert_aggregator.py b/tests/test_common/test_core_alert_aggregator.py
index 7ac26e1e..0ab17c09 100644
--- a/tests/test_common/test_core_alert_aggregator.py
+++ b/tests/test_common/test_core_alert_aggregator.py
@@ -77,7 +77,7 @@ def aggregate_alerts(self, input_, output_):
 class TestAuxiliar:
     def test_get_field_single(self) -> None:
         expected = {"dummy"}
-        input_ = schemas.DetectorSchema(dummy_schema)
+        input_ = sc.DetectorSchema(dummy_schema)
 
         assert len(field := _extract_field(input_, "detectorType")) == 1
         assert expected == set(field)
@@ -88,7 +88,7 @@ def test_get_field_multiple(self) -> None:
         dummy_schema2 = dummy_schema.copy()
         dummy_schema2["detectorType"] = "dummy2"
         input_ = [dummy_schema, dummy_schema2]
-        input_ = [schemas.DetectorSchema(in_) for in_ in input_]
+        input_ = [sc.DetectorSchema(in_) for in_ in input_]
 
         assert len(field := _extract_field(input_, "detectorType")) == 2
         assert expected == set(field)
@@ -100,7 +100,7 @@ def test_get_logID_timestamp_single(self) -> None:
         dummy_schema2 = dummy_schema.copy()
         dummy_schema2["logIDs"] = ["logID1", "logID2", "logID3", "logID1"]
         dummy_schema2["logTimestamps"] = [-1, 0, 1, 3]
-        input_ = schemas.DetectorSchema(dummy_schema2)
+        input_ = sc.DetectorSchema(dummy_schema2)
 
         logids, times = _extract_list_fields(
             input_, field1="logIDs", field2="logTimestamps"
@@ -117,7 +117,7 @@ def test_get_logID_timestamp_multiple(self) -> None:
         dummy_schema2["logIDs"] = ["logID2", "logID3", "logID1"]
         dummy_schema2["logTimestamps"] = [0, 1, 3]
         input_ = [dummy_schema, dummy_schema2]
-        input_ = [schemas.DetectorSchema(in_) for in_ in input_]
+        input_ = [sc.DetectorSchema(in_) for in_ in input_]
 
         logids, times = _extract_list_fields(
             input_, field1="logIDs", field2="logTimestamps"
@@ -176,7 +176,7 @@ def test_process_input_schema_not_serialized(self) -> None:
 
     def test_process_input_schema_not_serialized_window_3(self) -> None:
         alert_aggregator = MockupAlertAggregator(name="TestDetector", config=MockupConfig(), buffer_size=3)
-        expected_result = schemas.AggregateSchema({
+        expected_result = sc.AggregateSchema({
             "__version__": "1.0.0",
             "detectorIDs": ["1"],
             "detectorTypes": ["dummy"],
@@ -199,7 +199,7 @@ def test_process_input_schema_not_serialized_buffer_3(self) -> None:
         alert_aggregator = MockupAlertAggregatorBuffer(
             name="TestDetector", config=MockupConfig(), buffer_size=3
         )
-        expected_result = schemas.AggregateSchema({
+        expected_result = sc.AggregateSchema({
             "__version__": "1.0.0",
             "detectorIDs": ["1"],
             "detectorTypes": ["dummy"],
diff --git a/tests/test_pipelines/test_main_pipeline.py b/tests/test_pipelines/test_main_pipeline.py
index 2249b22f..c120c233 100644
--- a/tests/test_pipelines/test_main_pipeline.py
+++ b/tests/test_pipelines/test_main_pipeline.py
@@ -1,5 +1,6 @@
+from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL
 
-from detectmatelibrary.pipeline import PipelineConfig, _run_pipeline
+from detectmatelibrary.pipeline import PipelineConfig, _run_pipeline, Pipeline
 
 from detectmatelibrary._testutils.dummy_parser import DummyParser
 from detectmatelibrary._testutils.dummy_detector import DummyDetectorConfig
@@ -7,10 +8,20 @@
     DummyAlertAggregator, DummyAlertAggregatorConfig
 )
 
+from detectmatelibrary.helper.from_to import From
 import detectmatelibrary.schemas as sc
 
 from detectmatelibrary.common.detector import CoreDetector
 
+from detectmatelibrary.detectors.ecvc_detector import ECVCDetectorConfig
+from detectmatelibrary.detectors.charset_detector import CharsetDetectorConfig
+
+from detectmatelibrary.parsers.tree_matcher import TemplateCppTreeMatcherConfig
+
+from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegationConfig
+
+import pytest
+
 
 class AlwayAlert(CoreDetector):
     """A dummy detector for testing purposes."""
@@ -107,3 +118,40 @@ def test_run_detectors2aggregator(self) -> None:
         assert isinstance(out_, list)
         assert isinstance(out_[0], sc.AggregateSchema)
         assert len(out_) == 1
+
+
+class TestPipeline:
+    @pytest.mark.ignored
+    def test_full_pipeline(self) -> None:
+        config = PipelineConfig(
+            do_parsing=True,
+            do_aggregation=True,
+            parser=TemplateCppTreeMatcherConfig(
+                path_templates=AUDIT_TEMPLATES,
+                log_format="type=<Type> msg=audit(<Time>): <Content>"
+            ),
+            detectors=[
+                ECVCDetectorConfig(
+                    data_use_configure=TRAIN_UNTIL,
+                    window_size=10,
+                    seed=0,
+                    validation_per=0.,
+                    threshold_method="mean"
+                ),
+                CharsetDetectorConfig(
+                    data_use_configure=TRAIN_UNTIL,
+                    data_use_training=1,
+                    auto_config=True,
+                )
+            ],
+            aggregator=LogIDCountAggegationConfig(max_count=1)
+        )
+
+        pipeline = Pipeline(config=config)
+        alerts = []
+        for parsed_log in From.log(pipeline.parser, in_path=AUDIT_LOG, do_process=True):
+            if (alert := pipeline.process(parsed_log)) is not None:
+                alerts.extend(alert["logIDs"])
+
+        expected = ['1859', '1860', '1861', '1862', '1864', '1865', '1866', '1867']
+        assert set(alerts) == set(expected)

From 3805932cbcbee72393331b96726bf2fcf04461d4 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 13:19:53 +0200
Subject: [PATCH 53/86] minor change

---
 src/detectmatelibrary/pipeline.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/detectmatelibrary/pipeline.py b/src/detectmatelibrary/pipeline.py
index 679a12e7..cf1cd0eb 100644
--- a/src/detectmatelibrary/pipeline.py
+++ b/src/detectmatelibrary/pipeline.py
@@ -31,6 +31,8 @@ class PipelineConfig(CoreConfig):
         default=None, description="Aggregator configuration use, if do_aggregation=False keep empty."
     )
 
+# ------------- Auxiliar methods
+
 
 def _select_input(config: PipelineConfig) -> type[sc.BaseSchema]:
     return sc.LogSchema if config.do_parsing else sc.ParserSchema
@@ -77,6 +79,8 @@ def _run_pipeline(
     return last_output_  # type: ignore
 
 
+# ------------- Nain pipeline
+
 class Pipeline(CoreComponent):
     def __init__(
         self,

From 7274ee1c2b3d08b01959d61060067831633582c3 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 13:42:43 +0200
Subject: [PATCH 54/86] add documentation for pick_you

---
 docs/examples/others/i_pick_you.py | 22 ++++++++++++++++++++++
 docs/helper/pick_you.md            | 26 ++++++++++++++++++++++++++
 mkdocs.yml                         |  1 +
 3 files changed, 49 insertions(+)
 create mode 100644 docs/examples/others/i_pick_you.py
 create mode 100644 docs/helper/pick_you.md

diff --git a/docs/examples/others/i_pick_you.py b/docs/examples/others/i_pick_you.py
new file mode 100644
index 00000000..8530f9ce
--- /dev/null
+++ b/docs/examples/others/i_pick_you.py
@@ -0,0 +1,22 @@
+
+# --8<-- [start:pickyou]
+from detectmatelibrary.detectors.random_detector import RandomDetectorConfig
+
+import detectmatelibrary.helper.i_pick_you as ipy
+
+configs = [
+    {
+        "detectors": {
+            "a": {"method_type": "random_detector"}
+        }
+    },
+    RandomDetectorConfig(),
+]
+names = ["a", "b"]
+
+components = ipy.pickComponents(
+    configs=configs, names=names, component_type="detectors"
+)
+print(len(components))  # 2
+
+# --8<-- [end:pickyou]
diff --git a/docs/helper/pick_you.md b/docs/helper/pick_you.md
new file mode 100644
index 00000000..4b0d30bb
--- /dev/null
+++ b/docs/helper/pick_you.md
@@ -0,0 +1,26 @@
+# I pick you
+
+Methods that make it easy to choose components solely through configuration settings.
+
+```python
+def pickComponent(
+    config: CoreConfig | dict[str, Any],
+    component_type: str,
+    name: Optional[str] = None
+) -> CoreComponent:
+    """Pick a single component"""
+
+
+def pickComponents(
+    configs: list[CoreConfig | dict[str, Any]],
+    component_type: str,
+    names: Optional[list[str | None]] = None
+) -> list[CoreComponent]:
+    """Pick multiple components"""
+```
+
+## Usage
+
+```python
+--8<-- "docs/examples/others/i_pick_you.py:pickyou"
+```
diff --git a/mkdocs.yml b/mkdocs.yml
index ffe48996..ff91285c 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -69,6 +69,7 @@ nav:
       - 01_LogID Count: alert_aggregators/logid_count.md
     - Helpers:
       - FromTo: helper/from_to.md
+      - IPickYou: helper/pick_you.md
     - Auxiliary:
       - Persistency: auxiliar/persistency.md
       - Data buffer: auxiliar/input_buffer.md

From 50572616aea1e022008dd80a26484c7eb3aa298c Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 13:44:17 +0200
Subject: [PATCH 55/86] minor git correction issue

---
 .../tools/workspace/templates/CustomAlertAggregator.py     | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/detectmatelibrary/tools/workspace/templates/CustomAlertAggregator.py b/src/detectmatelibrary/tools/workspace/templates/CustomAlertAggregator.py
index 99e3b455..f691f5ba 100644
--- a/src/detectmatelibrary/tools/workspace/templates/CustomAlertAggregator.py
+++ b/src/detectmatelibrary/tools/workspace/templates/CustomAlertAggregator.py
@@ -1,8 +1,9 @@
 from detectmatelibrary.common.alert_aggregator import (CoreAlertAggregatorConfig, CoreAlertAggregator)
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
-from typing import Any, Optional
 from detectmatelibrary.helper.from_to import From
 
+from typing import Any
+
 
 class CustomAlertAggregatorConfig(CoreAlertAggregatorConfig):
     method_type: str = "custom_alert_aggregator"
@@ -13,11 +14,11 @@ class CustomAlertAggregator(CoreAlertAggregator):
     def __init__(
         self,
         name: str = "CustomAlertAggregator",
-        config: Optional[CustomAlertAggregatorConfig | dict[str, Any]] = CustomAlertAggregatorConfig(),
+        config: CustomAlertAggregatorConfig | dict[str, Any] = CustomAlertAggregatorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = CustomAlertAggregatorConfig.from_dict(config, name)
-        buffer_size: int = config.buffer_size  # type: ignore
+        buffer_size: int = config.buffer_size
         super().__init__(name=name, buffer_size=buffer_size, config=config)
 
     def aggregate_alerts(

From fa4e4ced64fc59555690694195b90b0998c881db Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 14:15:43 +0200
Subject: [PATCH 56/86] update documentation

---
 docs/examples/others/pipeline.py | 44 ++++++++++++++++++++++++++++++++
 docs/index.md                    |  1 +
 docs/pipeline.md                 | 16 ++++++++++++
 mkdocs.yml                       |  1 +
 4 files changed, 62 insertions(+)
 create mode 100644 docs/examples/others/pipeline.py
 create mode 100644 docs/pipeline.md

diff --git a/docs/examples/others/pipeline.py b/docs/examples/others/pipeline.py
new file mode 100644
index 00000000..f66aa8ba
--- /dev/null
+++ b/docs/examples/others/pipeline.py
@@ -0,0 +1,44 @@
+# --8<-- [start:example_1]
+from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegationConfig
+
+from detectmatelibrary.parsers.tree_matcher import TemplateCppTreeMatcherConfig
+
+from detectmatelibrary.detectors.charset_detector import CharsetDetectorConfig
+
+from detectmatelibrary.pipeline import PipelineConfig, Pipeline
+import detectmatelibrary.schemas as schemas
+
+config = PipelineConfig(
+        do_parsing=True,  # Use the parser
+        do_aggregation=True,  # Use the aggregator
+        parser=TemplateCppTreeMatcherConfig(
+            path_templates=" tests/test_data/test_templates.txt",
+            log_format="type=<Type> msg=audit(<Time>): <Content>"
+        ),
+        detectors=[
+            {
+                "detectors": {
+                    "ECVCDetector": {
+                        "data_use_configure": 100,
+                        "window_size": 10,
+                        "seed": 0,
+                        "validation_per": 0.,
+                        "threshold_method": "mean"
+                    }
+                }
+            },
+            CharsetDetectorConfig(
+                data_use_configure=100,
+                data_use_training=1,
+                auto_config=True,
+            )
+        ],
+        aggregator=LogIDCountAggegationConfig(max_count=1)
+    )
+
+pipeline = Pipeline(config=config)
+pipeline.process(schemas.LogSchema({
+    "logID": "0",
+    "log": "pid=9699 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\"'",
+}))
+# --8<-- [end:example_1]
diff --git a/docs/index.md b/docs/index.md
index ad490e77..9f601a70 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -27,6 +27,7 @@ Here you can get the full scope.
 * [Parsers](parsers.md)
 * [Detectors](detectors.md)
 * [Alert Aggregation](alert_aggregator.md)
+* [Pipelines](pipeline.md)
 * [Federation](federation.md)
 
 ## How to contribute
diff --git a/docs/pipeline.md b/docs/pipeline.md
new file mode 100644
index 00000000..e53d2188
--- /dev/null
+++ b/docs/pipeline.md
@@ -0,0 +1,16 @@
+# Pipelines
+
+Pipelines that enable running the various components within the library, simulating the final behavior delivered by the service.
+
+
+## Main pipeline
+
+The main pipeline functions like a standard inference pipeline. To initialize the entire system, the user only needs to provide either a configuration dictionary or the configuration classes themselves. Since the pipeline inherits from [CoreComponent](advanced/overall_architecture.md), all CoreComponent methods are also available in the pipeline class.
+
+If `do_parsing=False`, the pipeline will take already-parsed logs as input, and the parsing step will be skipped. Likewise, if `do_aggregation=False`, the pipeline will output the detectors’ alerts directly, and the alert aggregation step will be skipped.
+
+### Example
+
+```python
+--8<-- "docs/examples/others/pipeline.py:example_1"
+```
diff --git a/mkdocs.yml b/mkdocs.yml
index ff91285c..f2d4415b 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -43,6 +43,7 @@ nav:
       - Parsers: parsers.md
       - Detectors: detectors.md
       - Alert Aggregation: alert_aggregator.md
+      - Pipelines: pipeline.md
     - Parser types:
       - 00_JSON Parser: parsers/json_parser.md
       - 01_Template Matcher: parsers/template_matcher.md

From 0009143e9e6305d48b7501ee7121dec5d2e764d4 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 14:17:35 +0200
Subject: [PATCH 57/86] minor type correction in the dummy alert aggregator

---
 src/detectmatelibrary/_testutils/dummy_alert_aggregator.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/detectmatelibrary/_testutils/dummy_alert_aggregator.py b/src/detectmatelibrary/_testutils/dummy_alert_aggregator.py
index 27b6dd54..ab84472d 100644
--- a/src/detectmatelibrary/_testutils/dummy_alert_aggregator.py
+++ b/src/detectmatelibrary/_testutils/dummy_alert_aggregator.py
@@ -1,6 +1,6 @@
 from detectmatelibrary.common.alert_aggregator import (CoreAlertAggregatorConfig, CoreAlertAggregator)
 from detectmatelibrary.schemas import DetectorSchema, AggregateSchema
-from typing import Any, Optional
+from typing import Any
 
 
 class DummyAlertAggregatorConfig(CoreAlertAggregatorConfig):
@@ -12,11 +12,11 @@ class DummyAlertAggregator(CoreAlertAggregator):
     def __init__(
         self,
         name: str = "DummyAlertAggregator",
-        config: Optional[DummyAlertAggregatorConfig | dict[str, Any]] = DummyAlertAggregatorConfig(),
+        config: DummyAlertAggregatorConfig | dict[str, Any] = DummyAlertAggregatorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = DummyAlertAggregatorConfig.from_dict(config, name)
-        buffer_size: int = config.buffer_size  # type: ignore
+        buffer_size: int = config.buffer_size
         super().__init__(name=name, buffer_size=buffer_size, config=config)
 
     def aggregate_alerts(

From 000512ac62007be276a4201bb4ef41bd780305dc Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 14:32:10 +0200
Subject: [PATCH 58/86] add parallelization in the main pipeline

---
 src/detectmatelibrary/pipeline.py          | 26 +++++++++--
 tests/test_pipelines/test_main_pipeline.py | 51 ++++++++++++++++++++++
 2 files changed, 73 insertions(+), 4 deletions(-)

diff --git a/src/detectmatelibrary/pipeline.py b/src/detectmatelibrary/pipeline.py
index cf1cd0eb..ce50fe63 100644
--- a/src/detectmatelibrary/pipeline.py
+++ b/src/detectmatelibrary/pipeline.py
@@ -10,6 +10,8 @@
 
 import detectmatelibrary.schemas as sc
 
+from concurrent.futures import ThreadPoolExecutor
+
 from typing import Any, overload, Optional, override
 from pydantic import Field
 
@@ -20,6 +22,7 @@ class PipelineConfig(CoreConfig):
 
     do_parsing: bool = Field(default=True, description="Run parser in the pipeline.")
     do_aggregation: bool = Field(default=True, description="Run aggregator in the pipeline.")
+    n_workers: int = Field(default=1, description="Workers use to run the detectors in parallel.")
 
     parser: CoreParserConfig | dict[str, Any] | None = Field(
         default=None, description="Parser configuration use, if do_parsing=False keep empty."
@@ -46,12 +49,23 @@ def _check_output(in_: sc.BaseSchema, method: CoreComponent) -> Optional[bytes |
     return method.process(in_)
 
 
+def _multiprocess(
+    methods: list[CoreComponent], in_: sc.BaseSchema, n_workers: int = 4
+) -> list[sc.BaseSchema]:
+
+    with ThreadPoolExecutor(max_workers=n_workers) as executor:
+        outputs = list(executor.map(lambda fn: _check_output(in_, fn), methods))
+
+    return list(filter(lambda x: x is not None, outputs))  # type: ignore
+
+
 def _run_pipeline(
     config: PipelineConfig,
     input_: sc.ParserSchema | bytes | sc.LogSchema,
     parser: Optional[CoreParser],
     detectors: list[CoreDetector],
     alert_aggreator: Optional[CoreAlertAggregator],
+    n_workers: int = 1,
 ) -> list[sc.DetectorSchema] | list[sc.AggregateSchema]:
 
     input_ = input_ if isinstance(input_, list) else [input_]  # type: ignore
@@ -64,9 +78,12 @@ def _run_pipeline(
 
     output_ = []
     for in_ in input_:  # type: ignore
-        for detector in detectors:
-            if (out_ := _check_output(in_, detector)) is not None:  # type: ignore
-                output_.append(out_)
+        if n_workers > 1:
+            output_.extend(_multiprocess(detectors, in_=in_, n_workers=n_workers))  # type: ignore
+        else:
+            for detector in detectors:
+                if (out_ := _check_output(in_, detector)) is not None:  # type: ignore
+                    output_.append(out_)  # type: ignore
 
     if not config.do_aggregation:
         return output_   # type: ignore
@@ -146,7 +163,8 @@ def process(
             input_=data,
             parser=self.parser,
             detectors=self.detectors,
-            alert_aggreator=self.alert_aggregator
+            alert_aggreator=self.alert_aggregator,
+            n_workers=self.config.n_workers,
         )
 
         if len(out_) == 0:
diff --git a/tests/test_pipelines/test_main_pipeline.py b/tests/test_pipelines/test_main_pipeline.py
index c120c233..37051bb1 100644
--- a/tests/test_pipelines/test_main_pipeline.py
+++ b/tests/test_pipelines/test_main_pipeline.py
@@ -104,6 +104,20 @@ def test_run_detectors_only(self) -> None:
         assert isinstance(out_[0], sc.DetectorSchema)
         assert len(out_) == 2
 
+    def test_run_detectors_parallel(self) -> None:
+        out_ = _run_pipeline(
+            config=PipelineConfig(do_parsing=False, do_aggregation=False),
+            input_=parser_schema,
+            parser=None,
+            detectors=[AlwayAlert(), AlwayAlert()],
+            alert_aggreator=None,
+            n_workers=2,
+        )
+
+        assert isinstance(out_, list)
+        assert isinstance(out_[0], sc.DetectorSchema)
+        assert len(out_) == 2
+
     def test_run_detectors2aggregator(self) -> None:
         out_ = _run_pipeline(
             config=PipelineConfig(do_parsing=False, do_aggregation=True),
@@ -126,6 +140,43 @@ def test_full_pipeline(self) -> None:
         config = PipelineConfig(
             do_parsing=True,
             do_aggregation=True,
+            n_workers=1,
+            parser=TemplateCppTreeMatcherConfig(
+                path_templates=AUDIT_TEMPLATES,
+                log_format="type=<Type> msg=audit(<Time>): <Content>"
+            ),
+            detectors=[
+                ECVCDetectorConfig(
+                    data_use_configure=TRAIN_UNTIL,
+                    window_size=10,
+                    seed=0,
+                    validation_per=0.,
+                    threshold_method="mean"
+                ),
+                CharsetDetectorConfig(
+                    data_use_configure=TRAIN_UNTIL,
+                    data_use_training=1,
+                    auto_config=True,
+                )
+            ],
+            aggregator=LogIDCountAggegationConfig(max_count=1)
+        )
+
+        pipeline = Pipeline(config=config)
+        alerts = []
+        for parsed_log in From.log(pipeline.parser, in_path=AUDIT_LOG, do_process=True):
+            if (alert := pipeline.process(parsed_log)) is not None:
+                alerts.extend(alert["logIDs"])
+
+        expected = ['1859', '1860', '1861', '1862', '1864', '1865', '1866', '1867']
+        assert set(alerts) == set(expected)
+
+    @pytest.mark.ignored
+    def test_full_pipeline_parallel(self) -> None:
+        config = PipelineConfig(
+            do_parsing=True,
+            do_aggregation=True,
+            n_workers=3,
             parser=TemplateCppTreeMatcherConfig(
                 path_templates=AUDIT_TEMPLATES,
                 log_format="type=<Type> msg=audit(<Time>): <Content>"

From 27946462c316b4ebe6a47f51dbfba10ed59ecd88 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 14:34:50 +0200
Subject: [PATCH 59/86] add parallelization in the main pipeline

---
 docs/examples/others/pipeline.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/examples/others/pipeline.py b/docs/examples/others/pipeline.py
index f66aa8ba..73b43d35 100644
--- a/docs/examples/others/pipeline.py
+++ b/docs/examples/others/pipeline.py
@@ -12,7 +12,7 @@
         do_parsing=True,  # Use the parser
         do_aggregation=True,  # Use the aggregator
         parser=TemplateCppTreeMatcherConfig(
-            path_templates=" tests/test_data/test_templates.txt",
+            path_templates="docs/examples/data/tutorial_templates.txt",
             log_format="type=<Type> msg=audit(<Time>): <Content>"
         ),
         detectors=[

From 795094f63ea49338e8620197496ef2d55a2e2e01 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 14:36:31 +0200
Subject: [PATCH 60/86] minor add on

---
 docs/examples/others/pipeline.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/examples/others/pipeline.py b/docs/examples/others/pipeline.py
index 73b43d35..1515e81b 100644
--- a/docs/examples/others/pipeline.py
+++ b/docs/examples/others/pipeline.py
@@ -15,6 +15,7 @@
             path_templates="docs/examples/data/tutorial_templates.txt",
             log_format="type=<Type> msg=audit(<Time>): <Content>"
         ),
+        n_workers=1,  # You can add parallelization for the detectors
         detectors=[
             {
                 "detectors": {

From 5fba4d018d6206539283991fb3d8ff2386c199f7 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Mon, 19 Oct 2026 14:46:19 +0200
Subject: [PATCH 61/86] correct unittest

---
 docs/examples/others/pipeline.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/examples/others/pipeline.py b/docs/examples/others/pipeline.py
index 1515e81b..045e1648 100644
--- a/docs/examples/others/pipeline.py
+++ b/docs/examples/others/pipeline.py
@@ -20,6 +20,7 @@
             {
                 "detectors": {
                     "ECVCDetector": {
+                        "method_type": "ecvc_detector",
                         "data_use_configure": 100,
                         "window_size": 10,
                         "seed": 0,

From 3b2ba151a803e84fd8ae1187996634a24cd2ca47 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 20 Oct 2026 13:56:17 +0200
Subject: [PATCH 62/86] improve explanation in the documentation

---
 docs/pipeline.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/pipeline.md b/docs/pipeline.md
index e53d2188..610791a7 100644
--- a/docs/pipeline.md
+++ b/docs/pipeline.md
@@ -9,6 +9,8 @@ The main pipeline functions like a standard inference pipeline. To initialize th
 
 If `do_parsing=False`, the pipeline will take already-parsed logs as input, and the parsing step will be skipped. Likewise, if `do_aggregation=False`, the pipeline will output the detectors’ alerts directly, and the alert aggregation step will be skipped.
 
+The pipeline allows you to pass either a Config class instance or the dictionary used to initialize that Config class as arguments to the various components. For the detectors list, both methods can be combined, as shown in the example.
+
 ### Example
 
 ```python

From 3fc2b9d8c8d28e68f13f235e391273525b11e8ed Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Tue, 20 Oct 2026 13:59:02 +0200
Subject: [PATCH 63/86] rename methods

---
 docs/examples/others/i_pick_you.py         |  2 +-
 docs/helper/pick_you.md                    |  8 ++++----
 src/detectmatelibrary/helper/i_pick_you.py |  6 +++---
 src/detectmatelibrary/pipeline.py          |  6 +++---
 tests/test_helper/test_ipickyou.py         | 12 ++++++------
 5 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/docs/examples/others/i_pick_you.py b/docs/examples/others/i_pick_you.py
index 8530f9ce..d2272db6 100644
--- a/docs/examples/others/i_pick_you.py
+++ b/docs/examples/others/i_pick_you.py
@@ -14,7 +14,7 @@
 ]
 names = ["a", "b"]
 
-components = ipy.pickComponents(
+components = ipy.selectComponents(
     configs=configs, names=names, component_type="detectors"
 )
 print(len(components))  # 2
diff --git a/docs/helper/pick_you.md b/docs/helper/pick_you.md
index 4b0d30bb..bc4fee8e 100644
--- a/docs/helper/pick_you.md
+++ b/docs/helper/pick_you.md
@@ -3,20 +3,20 @@
 Methods that make it easy to choose components solely through configuration settings.
 
 ```python
-def pickComponent(
+def selectComponent(
     config: CoreConfig | dict[str, Any],
     component_type: str,
     name: Optional[str] = None
 ) -> CoreComponent:
-    """Pick a single component"""
+    """Select a single component"""
 
 
-def pickComponents(
+def selectComponents(
     configs: list[CoreConfig | dict[str, Any]],
     component_type: str,
     names: Optional[list[str | None]] = None
 ) -> list[CoreComponent]:
-    """Pick multiple components"""
+    """Select multiple components"""
 ```
 
 ## Usage
diff --git a/src/detectmatelibrary/helper/i_pick_you.py b/src/detectmatelibrary/helper/i_pick_you.py
index 42ef1c07..600be139 100644
--- a/src/detectmatelibrary/helper/i_pick_you.py
+++ b/src/detectmatelibrary/helper/i_pick_you.py
@@ -34,7 +34,7 @@ def _find_component_from_type(
 
 
 # --------------------------------- Main methods
-def pickComponent(
+def selectComponent(
     config: CoreConfig | dict[str, Any], component_type: str, name: Optional[str] = None
 ) -> CoreComponent:
     """Component, I pick you!!!
@@ -59,7 +59,7 @@ def pickComponent(
     return component(name=name, config=config)
 
 
-def pickComponents(
+def selectComponents(
     configs: list[CoreConfig | dict[str, Any]],
     component_type: str,
     names: Optional[list[str | None]] = None
@@ -69,6 +69,6 @@ def pickComponents(
         names = [None for _ in configs]
 
     return [
-        pickComponent(config=config, component_type=component_type, name=name)
+        selectComponent(config=config, component_type=component_type, name=name)
         for config, name in zip(configs, names)
     ]
diff --git a/src/detectmatelibrary/pipeline.py b/src/detectmatelibrary/pipeline.py
index ce50fe63..99576573 100644
--- a/src/detectmatelibrary/pipeline.py
+++ b/src/detectmatelibrary/pipeline.py
@@ -117,15 +117,15 @@ def __init__(
         )
         self.config: PipelineConfig
 
-        self.parser: CoreParser | None = ipy.pickComponent(  # type: ignore
+        self.parser: CoreParser | None = ipy.selectComponent(  # type: ignore
             self.config.parser, component_type="parsers"
         ) if self.config.do_parsing else None
 
-        self.detectors: list[CoreDetector] = ipy.pickComponents(  # type: ignore
+        self.detectors: list[CoreDetector] = ipy.selectComponents(  # type: ignore
             self.config.detectors, component_type="detectors"
         )
 
-        self.alert_aggregator: CoreAlertAggregator | None = ipy.pickComponent(  # type: ignore
+        self.alert_aggregator: CoreAlertAggregator | None = ipy.selectComponent(  # type: ignore
             self.config.aggregator, component_type="alert_aggregators"
         ) if self.config.do_aggregation else None
 
diff --git a/tests/test_helper/test_ipickyou.py b/tests/test_helper/test_ipickyou.py
index be995eb0..a09416f9 100644
--- a/tests/test_helper/test_ipickyou.py
+++ b/tests/test_helper/test_ipickyou.py
@@ -28,7 +28,7 @@ def test_pick_component_dict(self):
                 "TestDetector": {"method_type": "random_detector"}
             }
         }
-        comp = ipy.pickComponent(
+        comp = ipy.selectComponent(
             name="TestDetector", config=config, component_type="detectors"
         )
 
@@ -40,13 +40,13 @@ def test_pick_component_dict_no_name(self):
                 "TestDetector": {"method_type": "random_detector"}
             }
         }
-        comp = ipy.pickComponent(config=config, component_type="detectors")
+        comp = ipy.selectComponent(config=config, component_type="detectors")
 
         assert isinstance(comp, RandomDetector)
 
     def test_pick_component(self):
         config = DrainConfig()
-        comp = ipy.pickComponent(
+        comp = ipy.selectComponent(
             name="Drain", config=config, component_type="parsers"
         )
 
@@ -54,7 +54,7 @@ def test_pick_component(self):
 
     def test_pick_component_no_name(self):
         config = DrainConfig()
-        comp = ipy.pickComponent(config=config, component_type="parsers")
+        comp = ipy.selectComponent(config=config, component_type="parsers")
 
         assert isinstance(comp, DrainParser)
 
@@ -69,7 +69,7 @@ def test_pick_multiple_components(self):
         ]
         names = ["a", "b"]
 
-        for component in ipy.pickComponents(
+        for component in ipy.selectComponents(
             configs=configs, names=names, component_type="detectors"
         ):
             assert isinstance(component, RandomDetector)
@@ -83,7 +83,7 @@ def test_pick_multiple_components_no_names(self):
             },
             RandomDetectorConfig(),
         ]
-        for component in ipy.pickComponents(
+        for component in ipy.selectComponents(
             configs=configs, component_type="detectors"
         ):
             assert isinstance(component, RandomDetector)

From 44cc431f9eabb6f97c4a642dfe8e87bc9fdd1114 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Wed, 21 Oct 2026 07:31:03 +0200
Subject: [PATCH 64/86] rename ipy to selc

---
 .../{i_pick_you.py => select_component.py}    |  4 ++--
 .../{pick_you.md => select_component.md}      |  4 ++--
 mkdocs.yml                                    |  2 +-
 .../{i_pick_you.py => select_component.py}    |  0
 src/detectmatelibrary/pipeline.py             |  8 +++----
 ...t_ipickyou.py => test_select_component.py} | 22 +++++++++----------
 6 files changed, 20 insertions(+), 20 deletions(-)
 rename docs/examples/others/{i_pick_you.py => select_component.py} (80%)
 rename docs/helper/{pick_you.md => select_component.md} (86%)
 rename src/detectmatelibrary/helper/{i_pick_you.py => select_component.py} (100%)
 rename tests/test_helper/{test_ipickyou.py => test_select_component.py} (75%)

diff --git a/docs/examples/others/i_pick_you.py b/docs/examples/others/select_component.py
similarity index 80%
rename from docs/examples/others/i_pick_you.py
rename to docs/examples/others/select_component.py
index d2272db6..06e21118 100644
--- a/docs/examples/others/i_pick_you.py
+++ b/docs/examples/others/select_component.py
@@ -2,7 +2,7 @@
 # --8<-- [start:pickyou]
 from detectmatelibrary.detectors.random_detector import RandomDetectorConfig
 
-import detectmatelibrary.helper.i_pick_you as ipy
+import detectmatelibrary.helper.select_component as selc
 
 configs = [
     {
@@ -14,7 +14,7 @@
 ]
 names = ["a", "b"]
 
-components = ipy.selectComponents(
+components = selc.selectComponents(
     configs=configs, names=names, component_type="detectors"
 )
 print(len(components))  # 2
diff --git a/docs/helper/pick_you.md b/docs/helper/select_component.md
similarity index 86%
rename from docs/helper/pick_you.md
rename to docs/helper/select_component.md
index bc4fee8e..4cb05575 100644
--- a/docs/helper/pick_you.md
+++ b/docs/helper/select_component.md
@@ -1,4 +1,4 @@
-# I pick you
+# Select Component
 
 Methods that make it easy to choose components solely through configuration settings.
 
@@ -22,5 +22,5 @@ def selectComponents(
 ## Usage
 
 ```python
---8<-- "docs/examples/others/i_pick_you.py:pickyou"
+--8<-- "docs/examples/others/select_component.py:pickyou"
 ```
diff --git a/mkdocs.yml b/mkdocs.yml
index f2d4415b..8b0464f7 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -70,7 +70,7 @@ nav:
       - 01_LogID Count: alert_aggregators/logid_count.md
     - Helpers:
       - FromTo: helper/from_to.md
-      - IPickYou: helper/pick_you.md
+      - Select Component: helper/select_component.md
     - Auxiliary:
       - Persistency: auxiliar/persistency.md
       - Data buffer: auxiliar/input_buffer.md
diff --git a/src/detectmatelibrary/helper/i_pick_you.py b/src/detectmatelibrary/helper/select_component.py
similarity index 100%
rename from src/detectmatelibrary/helper/i_pick_you.py
rename to src/detectmatelibrary/helper/select_component.py
diff --git a/src/detectmatelibrary/pipeline.py b/src/detectmatelibrary/pipeline.py
index 99576573..c8d46e44 100644
--- a/src/detectmatelibrary/pipeline.py
+++ b/src/detectmatelibrary/pipeline.py
@@ -6,7 +6,7 @@
 from detectmatelibrary.common.parser import CoreParser, CoreParserConfig
 
 from detectmatelibrary.utils.data_buffer import ArgsBuffer, BufferMode
-import detectmatelibrary.helper.i_pick_you as ipy
+import detectmatelibrary.helper.select_component as selc
 
 import detectmatelibrary.schemas as sc
 
@@ -117,15 +117,15 @@ def __init__(
         )
         self.config: PipelineConfig
 
-        self.parser: CoreParser | None = ipy.selectComponent(  # type: ignore
+        self.parser: CoreParser | None = selc.selectComponent(  # type: ignore
             self.config.parser, component_type="parsers"
         ) if self.config.do_parsing else None
 
-        self.detectors: list[CoreDetector] = ipy.selectComponents(  # type: ignore
+        self.detectors: list[CoreDetector] = selc.selectComponents(  # type: ignore
             self.config.detectors, component_type="detectors"
         )
 
-        self.alert_aggregator: CoreAlertAggregator | None = ipy.selectComponent(  # type: ignore
+        self.alert_aggregator: CoreAlertAggregator | None = selc.selectComponent(  # type: ignore
             self.config.aggregator, component_type="alert_aggregators"
         ) if self.config.do_aggregation else None
 
diff --git a/tests/test_helper/test_ipickyou.py b/tests/test_helper/test_select_component.py
similarity index 75%
rename from tests/test_helper/test_ipickyou.py
rename to tests/test_helper/test_select_component.py
index a09416f9..0410b175 100644
--- a/tests/test_helper/test_ipickyou.py
+++ b/tests/test_helper/test_select_component.py
@@ -2,23 +2,23 @@
 from detectmatelibrary.detectors.random_detector import RandomDetector, RandomDetectorConfig
 from detectmatelibrary.parsers.drain import DrainParser, DrainConfig
 
-import detectmatelibrary.helper.i_pick_you as ipy
+import detectmatelibrary.helper.select_component as selc
 
 
 class TestFindFromName:
     def test_get_configs(self):
-        assert (comp := ipy._find_component_from_type("drain_parser", "parsers")) is not None
+        assert (comp := selc._find_component_from_type("drain_parser", "parsers")) is not None
         assert isinstance(comp(), DrainParser)
 
-        assert (comp := ipy._find_component_from_type("random_detector", "detectors")) is not None
+        assert (comp := selc._find_component_from_type("random_detector", "detectors")) is not None
         assert isinstance(comp(), RandomDetector)
 
-        assert (comp := ipy._find_component_from_type(
+        assert (comp := selc._find_component_from_type(
             "basic_concat_aggregator", "alert_aggregators"
         )) is not None
         assert isinstance(comp(), BasicConcatAggregation)
 
-        assert ipy._find_component_from_type("aux", "alert_aggregators") is None
+        assert selc._find_component_from_type("aux", "alert_aggregators") is None
 
 
 class TestPickComponets:
@@ -28,7 +28,7 @@ def test_pick_component_dict(self):
                 "TestDetector": {"method_type": "random_detector"}
             }
         }
-        comp = ipy.selectComponent(
+        comp = selc.selectComponent(
             name="TestDetector", config=config, component_type="detectors"
         )
 
@@ -40,13 +40,13 @@ def test_pick_component_dict_no_name(self):
                 "TestDetector": {"method_type": "random_detector"}
             }
         }
-        comp = ipy.selectComponent(config=config, component_type="detectors")
+        comp = selc.selectComponent(config=config, component_type="detectors")
 
         assert isinstance(comp, RandomDetector)
 
     def test_pick_component(self):
         config = DrainConfig()
-        comp = ipy.selectComponent(
+        comp = selc.selectComponent(
             name="Drain", config=config, component_type="parsers"
         )
 
@@ -54,7 +54,7 @@ def test_pick_component(self):
 
     def test_pick_component_no_name(self):
         config = DrainConfig()
-        comp = ipy.selectComponent(config=config, component_type="parsers")
+        comp = selc.selectComponent(config=config, component_type="parsers")
 
         assert isinstance(comp, DrainParser)
 
@@ -69,7 +69,7 @@ def test_pick_multiple_components(self):
         ]
         names = ["a", "b"]
 
-        for component in ipy.selectComponents(
+        for component in selc.selectComponents(
             configs=configs, names=names, component_type="detectors"
         ):
             assert isinstance(component, RandomDetector)
@@ -83,7 +83,7 @@ def test_pick_multiple_components_no_names(self):
             },
             RandomDetectorConfig(),
         ]
-        for component in ipy.selectComponents(
+        for component in selc.selectComponents(
             configs=configs, component_type="detectors"
         ):
             assert isinstance(component, RandomDetector)

From 3b65887cbdcae96188f3a06921988066ac9d6c4a Mon Sep 17 00:00:00 2001
From: ipmach <andre.gg96@gmail.com>
Date: Wed, 21 Oct 2026 08:30:23 +0200
Subject: [PATCH 65/86] Bump version from 0.6.1 to 0.6.2

---
 src/detectmatelibrary/metadata.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/detectmatelibrary/metadata.py b/src/detectmatelibrary/metadata.py
index 4543d24a..3bc99247 100644
--- a/src/detectmatelibrary/metadata.py
+++ b/src/detectmatelibrary/metadata.py
@@ -7,6 +7,6 @@
 __website__ = "https://aecid.ait.ac.at"
 __license__ = "EUPL-1.2"
 __status__ = "Development"
-__version__ = "0.6.1"
+__version__ = "0.6.2"
 __all__ = ['__authors__', '__contact__', '__copyright__', '__date__', '__deprecated__', '__website__',
            '__license__', '__status__', '__version__']

From 204dfc8f5eeb6a01fcb7815fba9f1a9507777a72 Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Wed, 21 Oct 2026 08:34:29 +0200
Subject: [PATCH 66/86] solve small issues in the merge

---
 tests/test_parsers/test_json_parser.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tests/test_parsers/test_json_parser.py b/tests/test_parsers/test_json_parser.py
index 0cb29ace..b5806b1e 100644
--- a/tests/test_parsers/test_json_parser.py
+++ b/tests/test_parsers/test_json_parser.py
@@ -175,12 +175,12 @@ def test_parse_message_with_config_object(self):
             "message": "hello world"
         }
 
-        input_log = schemas.LogSchema({
+        input_log = sc.LogSchema({
             "logID": "1",
             "log": json.dumps(json_log)
         })
 
-        output = schemas.ParserSchema()
+        output = sc.ParserSchema()
         parser.parse(input_log, output)
 
         assert output.template == "<Not Found>"
@@ -212,8 +212,8 @@ def test_no_message_differs_from_first_template_and_no_match(self):
 
         event_ids = []
         for json_log in json_logs:
-            output = schemas.ParserSchema()
-            parser.parse(schemas.LogSchema({"logID": "1", "log": json.dumps(json_log)}), output)
+            output = sc.ParserSchema()
+            parser.parse(sc.LogSchema({"logID": "1", "log": json.dumps(json_log)}), output)
             event_ids.append(output.eventID)
 
         assert event_ids == [0, -1, -2]
@@ -223,7 +223,7 @@ def test_warns_once_when_message_meets_no_templates(self, caplog):
         parser = JsonParser(name="TestParser", config=JsonParserConfig())
 
         def parse(json_log):
-            parser.parse(schemas.LogSchema({"log": json.dumps(json_log)}), schemas.ParserSchema())
+            parser.parse(sc.LogSchema({"log": json.dumps(json_log)}), sc.ParserSchema())
 
         with caplog.at_level(logging.WARNING):
             parse({"level": "INFO"})
@@ -249,7 +249,7 @@ def test_no_warning_with_templates(self, caplog):
         parser = JsonParser(name="TestParser", config=config_dict)
 
         with caplog.at_level(logging.WARNING):
-            parser.parse(schemas.LogSchema({"log": json.dumps({"message": "hello"})}), schemas.ParserSchema())
+            parser.parse(sc.LogSchema({"log": json.dumps({"message": "hello"})}), sc.ParserSchema())
 
         assert not [r for r in caplog.records if "no templates" in r.message]
 

From aa049d2105f8348cf23ba35db7605b181ebe19b9 Mon Sep 17 00:00:00 2001
From: LukasKarner <lukas.karner@ait.ac.at>
Date: Wed, 21 Oct 2026 10:18:56 +0200
Subject: [PATCH 67/86] add abstract base class for density-clustering-based
 alert aggregation

---
 .../alert_aggregation/__init__.py             |   6 +
 .../alert_aggregation/density_clustering.py   | 280 ++++++++++++++++++
 2 files changed, 286 insertions(+)
 create mode 100644 src/detectmatelibrary/alert_aggregation/density_clustering.py

diff --git a/src/detectmatelibrary/alert_aggregation/__init__.py b/src/detectmatelibrary/alert_aggregation/__init__.py
index d1b82f94..b858e98b 100644
--- a/src/detectmatelibrary/alert_aggregation/__init__.py
+++ b/src/detectmatelibrary/alert_aggregation/__init__.py
@@ -1,9 +1,15 @@
 from .basic_concat import BasicConcatAggregation, BasicConcatAggregationConfig
+from .density_clustering import (
+    DensityClusteringAggregation,
+    DensityClusteringAggregationConfig,
+)
 from .logid_count import LogIDCountAggegation, LogIDCountAggegationConfig
 
 __all__ = [
     "BasicConcatAggregation",
     "BasicConcatAggregationConfig",
+    "DensityClusteringAggregation",
+    "DensityClusteringAggregationConfig",
     "LogIDCountAggegation",
     "LogIDCountAggegationConfig",
 ]
diff --git a/src/detectmatelibrary/alert_aggregation/density_clustering.py b/src/detectmatelibrary/alert_aggregation/density_clustering.py
new file mode 100644
index 00000000..fe4c3b90
--- /dev/null
+++ b/src/detectmatelibrary/alert_aggregation/density_clustering.py
@@ -0,0 +1,280 @@
+from pydantic import NonNegativeFloat
+
+from detectmatelibrary.common.alert_aggregator import (
+    CoreAlertAggregator,
+    CoreAlertAggregatorConfig,
+)
+from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
+from detectmatelibrary.utils.data_buffer import BufferMode
+
+"""This module implements alert aggregation by density clustering.
+It provides the DensityClusteringAggregation class, which is an abstract class that requires the implementation of two methods in subclasses: single_metric or metric, and discard_alert_fn.
+The module also provides the DensityClusteringAggregationConfig class, which defines the configuration for the DensityClusteringAggregation class.
+"""
+
+
+class DensityClusteringAggregationConfig(CoreAlertAggregatorConfig):
+    """Configuration for the DensityClusteringAggregation class.
+
+    Parameters:
+        buffer_size (int): The size of the buffer.
+        buffer_mode (BufferMode): The mode of the buffer.
+        delta (NonNegativeFloat): The threshold for the clustering.
+    """
+
+    method_type: str = "density_clustering_aggregator"
+    buffer_size: int = 3
+    buffer_mode: BufferMode = BufferMode.BATCH
+    delta: NonNegativeFloat
+
+
+class DensityClusteringAggregation(CoreAlertAggregator):
+    """This class implements alert aggregation by density clustering. It is an abstract class that requires the implementation of 2 methods in subclasses:
+
+    1. One has to implement either the single_metric or the metric function. The single_metric function computes the distance between 2 alerts, while the metric function computes the distance matrix between a list of alerts. If both functions are implemented, the metric function will be used.
+
+    2. The discard_alert_fn function must be implemented to determine which alerts should no longer be considered for aggregation. To this end, after each aggregation step, the discard_alert_fn function is called with the list of relevant alerts. It should return a list of booleans indicating which alerts should be discarded (True) and which should be kept (False).
+
+    Args:
+        config (DensityClusteringAggregationConfig): The configuration for the aggregator.
+        name (str): The name of the aggregator.
+
+    Methods:
+        single_metric(alert1: DetectorSchema, alert2: DetectorSchema) -> NonNegativeFloat: Computes the distance between 2 alerts. Must be implemented in a subclass.
+        metric(alerts: list[DetectorSchema], return_last_rows: int = 0) -> list[list[NonNegativeFloat]]: Computes the distance matrix between a list of alerts. Can be implemented in a subclass. If both single_metric and metric are implemented, the metric function will be used. The return_last_rows parameter can be used to compute only the last rows of the distance matrix.
+        discard_alert_fn(alerts: list[DetectorSchema]) -> list[bool]: Determines which alerts should no longer be considered for aggregation. Must be implemented in a subclass.
+        aggregate_alerts(input_: list[DetectorSchema], output_: AggregateSchema): Aggregates the input alerts and writes the results to the output.
+    """
+
+    def __init__(
+        self,
+        config: DensityClusteringAggregationConfig,
+        name: str = "DensityClusteringAggregator",
+    ) -> None:
+        self.buffer_size = config.buffer_size
+        self.buffer_mode = config.buffer_mode
+        super().__init__(
+            name=name,
+            config=config,
+            buffer_size=config.buffer_size,
+            buffer_mode=config.buffer_mode,
+        )
+        self.next_group_id: int = 0
+        self.relevant_alerts: list[DetectorSchema] = []
+        self.alert_id_to_group_id: dict[str, int | None] = {}
+        self.active_groups: dict[int, set[int]] = {}
+        self.message_buffer: list[str] = []
+        self.description = "Alert aggregation by density clustering."
+
+    def single_metric(
+        self, alert1: DetectorSchema, alert2: DetectorSchema
+    ) -> NonNegativeFloat:
+        raise NotImplementedError(
+            "The metric function must be implemented in a subclass of DensityClusteringAggregation."
+        )
+
+    def metric(
+        self, alerts: list[DetectorSchema], return_last_rows: int = 0
+    ) -> list[list[NonNegativeFloat]]:
+        return [
+            [self.single_metric(alert1, alert2) for alert2 in alerts]
+            for alert1 in alerts[-return_last_rows:]
+        ]
+
+    def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
+        raise NotImplementedError(
+            "The discard_alert_fn function must be implemented in a subclass of DensityClusteringAggregation."
+        )
+
+    def aggregate_alerts(
+        self, input_: list[DetectorSchema] | DetectorSchema, output_: AggregateSchema
+    ) -> bool:
+
+        if not isinstance(input_, list):
+            input_ = [input_]
+
+        # identify new alerts and add them to relevant alerts
+        new_alerts = self._add_new_alerts(input_)
+
+        # check distance of new alerts to relevant alerts
+        is_same_group = self._check_threshold(
+            self.metric(
+                self.relevant_alerts,
+                len(new_alerts),
+            )
+        )
+
+        # assign groups to new alerts and merge groups if necessary
+        for new_alert, same_group in zip(new_alerts, is_same_group, strict=True):
+            self._assign_new_alert_to_group(new_alert, same_group)
+
+        # write results to output
+        self._write_output(input_, output_)
+        return True
+
+    def _write_output(
+        self, input_: list[DetectorSchema], output_: AggregateSchema
+    ) -> None:
+        output_["description"] = self.description
+        output_["alertsObtain"].update(
+            {
+                alert["alertID"]: str(self.alert_id_to_group_id[alert["alertID"]])
+                for alert in input_
+            }
+        )
+
+        # discard alerts that are no longer relevant
+        _, affected_group_ids = self._discard_alerts()
+        self._check_and_discard_group_ids(affected_group_ids)
+        output_["alertsObtain"]["messages"] = "\n".join(self.message_buffer)
+        self.message_buffer = []
+
+    def _add_new_alerts(self, input_: list[DetectorSchema]) -> list[DetectorSchema]:
+        new_input = [
+            alert
+            for alert in input_
+            if alert["alertID"] not in self.alert_id_to_group_id
+        ]
+        self.relevant_alerts.extend(new_input)
+        self.alert_id_to_group_id.update(
+            {alert["alertID"]: None for alert in new_input}
+        )
+        return new_input
+
+    def _check_threshold(
+        self, distance_matrix: list[list[NonNegativeFloat]]
+    ) -> list[list[bool]]:
+        return [
+            [distance <= self.config.delta for distance in row]
+            for row in distance_matrix
+        ]
+
+    def _new_group(self, alert_id: int) -> int:
+        group_id = self.next_group_id
+        self.alert_id_to_group_id[alert_id] = group_id
+        self.active_groups[group_id] = {group_id}
+        self.next_group_id += 1
+        return group_id
+
+    def _check_and_merge_groups(self, close_group_ids: set[int]) -> set[int] | None:
+        # check if groups are merged already
+        groups_to_merge = []
+        for group_id in close_group_ids:
+            if (full_group := self.active_groups[group_id]) not in groups_to_merge:
+                groups_to_merge.append(full_group)
+
+        if (num_groups := len(groups_to_merge)) == 0:
+            raise Exception("An error occurred while merging groups!")
+        elif num_groups == 1:
+            # all groups are merged already
+            return
+
+        # merge groups
+        new_group = set.union(*groups_to_merge)
+        for group_id in new_group:
+            self.active_groups[group_id] = new_group
+
+        self.message_buffer.append(
+            f"Groups {groups_to_merge} are merged into {new_group}."
+        )
+        return new_group
+
+    def _assign_new_alert_to_group(
+        self, new_alert: DetectorSchema, close_relevant_alerts: list[bool]
+    ) -> None:
+        close_alerts = [
+            relevant_alert
+            for relevant_alert, is_close in zip(
+                self.relevant_alerts, close_relevant_alerts, strict=True
+            )
+            if is_close
+        ]
+
+        if len(close_alerts) == 0:
+            raise Exception("Alert is not close to itself!")
+
+        elif len(close_alerts) == 1:
+            # only close alert is itself, create new group
+            assert close_alerts[0]["alertID"] == new_alert["alertID"]
+            self._new_group(new_alert["alertID"])
+            return
+
+        # check distinct groups of close alerts
+        close_group_ids = {
+            self.alert_id_to_group_id[alert["alertID"]] for alert in close_alerts
+        }
+
+        if len(close_group_ids) == 0:
+            raise Exception("Could not find group_id's of close alerts!")
+
+        elif len(close_group_ids) == 1:
+            if (group_id := close_group_ids.pop()) is None:
+                # all close alerts are not assigned to a group, create new group
+                self._new_group(new_alert["alertID"])
+                return
+
+            # all close alerts belong to the same group, assign new alert to that group
+            self.alert_id_to_group_id[new_alert["alertID"]] = group_id
+            return
+
+        # unlabelled close alerts can be ignored now, they will be labelled in their own iteration
+        close_group_ids.discard(None)
+        close_group_ids: set[int] = close_group_ids
+
+        # close alerts have multiple group_ids, add alert to some group_id
+        for group_id in close_group_ids:
+            self.alert_id_to_group_id[new_alert["alertID"]] = group_id
+            break
+
+        # merge groups if necessary
+        self._check_and_merge_groups(close_group_ids)
+
+    def _discard_alerts(self, keep_buffer: bool = True) -> tuple[list[int], set[int]]:
+        alerts_to_discard = self.discard_alert_fn(self.relevant_alerts)
+        if keep_buffer and self.buffer_mode == BufferMode.WINDOW:
+            # set the last self.buffer_size elements of alerts_to_discard to False
+            for i in range(1, self.buffer_size + 1):
+                if i > len(alerts_to_discard):
+                    break
+                alerts_to_discard[-i] = False
+        discarded_alert_ids = [
+            alert["alertID"]
+            for alert, discard in zip(
+                self.relevant_alerts, alerts_to_discard, strict=True
+            )
+            if discard
+        ]
+        affected_group_ids = {
+            group_id
+            for group_id in (
+                self.alert_id_to_group_id.pop(alert_id)
+                for alert_id in discarded_alert_ids
+            )
+        }
+        self.relevant_alerts = [
+            alert
+            for alert, discard in zip(
+                self.relevant_alerts, alerts_to_discard, strict=True
+            )
+            if not discard
+        ]
+        return discarded_alert_ids, affected_group_ids
+
+    def _check_and_discard_group_ids(self, group_ids_to_check: set[int]) -> None:
+        # remove groups that are unreachable anymore
+        group_ids_to_discard = {
+            group_id
+            for group_id in group_ids_to_check
+            if group_id not in self.alert_id_to_group_id.values()
+        }
+        for group_id in group_ids_to_discard:
+            self.message_buffer.append(f"Group id {group_id} is finished.")
+
+            # check if group_id has been merged with still active groups
+            full_group_to_check = self.active_groups.pop(group_id)
+            for group_id_to_check in full_group_to_check:
+                if group_id_to_check in self.active_groups:
+                    break
+            else:
+                # full_group_to_check is not reachable anymore
+                self.message_buffer.append(f"Group {full_group_to_check} is finished.")

From 61200ebcf7c1020c2e16f6a1a8f59487d4289f3b Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Thu, 22 Oct 2026 12:03:11 +0200
Subject: [PATCH 68/86] prepare placeholder to add density cluster docs

---
 docs/alert_aggregators/density_cluster.md     | 48 +++++++++++++++++++
 .../alert_aggregators/density_cluster.py      |  8 ++++
 .../alert_aggregators/density_cluster.yaml    |  3 ++
 docs/examples/config/update.py                | 14 +++++-
 mkdocs.yml                                    |  1 +
 5 files changed, 73 insertions(+), 1 deletion(-)
 create mode 100644 docs/alert_aggregators/density_cluster.md
 create mode 100644 docs/examples/alert_aggregators/density_cluster.py
 create mode 100644 docs/examples/alert_aggregators/density_cluster.yaml

diff --git a/docs/alert_aggregators/density_cluster.md b/docs/alert_aggregators/density_cluster.md
new file mode 100644
index 00000000..b9b16771
--- /dev/null
+++ b/docs/alert_aggregators/density_cluster.md
@@ -0,0 +1,48 @@
+# Density Cluster Alert Aggregation
+
+add stuff, dont remove start and end arguments.
+
+## In/out
+
+Input and output schemas in the pipeline
+
+## In/out
+
+|            | Schema                     | Description        |
+|------------|----------------------------|--------------------|
+| **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
+| **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
+
+## Description
+
+
+## At a glance
+
+| Learns from training data | Auto-configuration | Needs `events` | Federation |
+|---|---|---|---|
+| ❌ | ❌ | ❌ | ❌ |
+
+
+## Example
+
+```python
+--8<-- "docs/examples/alert_aggregators/density_cluster.py:example_1"
+```
+
+## Configuration file
+
+The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
+
+```yaml
+--8<-- "docs/examples/alert_aggregators/density_cluster.yaml"
+```
+
+Load it with `yaml.safe_load` and pass the dict as `config=`, as in the example. The key under `alert_aggregators:` must match the aggregator's `name`.
+
+## Configuration arguments
+
+All parameters this alert aggregator accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this aggregator or `shared` with other alert aggregators.
+
+<!-- Start arguments -->
+
+<!-- End arguments -->
diff --git a/docs/examples/alert_aggregators/density_cluster.py b/docs/examples/alert_aggregators/density_cluster.py
new file mode 100644
index 00000000..f47b5d02
--- /dev/null
+++ b/docs/examples/alert_aggregators/density_cluster.py
@@ -0,0 +1,8 @@
+# --8<-- [start:example_1]
+
+print("Hello World")
+
+#  Check BasicConcat of LogID count documentation to add your example here
+#  Use the example config -> density_cluster.yaml from same folder
+
+# --8<-- [end:example_1]
diff --git a/docs/examples/alert_aggregators/density_cluster.yaml b/docs/examples/alert_aggregators/density_cluster.yaml
new file mode 100644
index 00000000..83a639f4
--- /dev/null
+++ b/docs/examples/alert_aggregators/density_cluster.yaml
@@ -0,0 +1,3 @@
+alert_aggregators:
+    NAME:
+        method_type: "method_type"
diff --git a/docs/examples/config/update.py b/docs/examples/config/update.py
index 6c104a2f..85f1f2ae 100644
--- a/docs/examples/config/update.py
+++ b/docs/examples/config/update.py
@@ -28,6 +28,7 @@
 from detectmatelibrary.common.parser import CoreParserConfig
 from detectmatelibrary.common.alert_aggregator import CoreAlertAggregatorConfig
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregationConfig
+from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegationConfig
 from detectmatelibrary.base_detectors import TrackerDetectorConfig
 from detectmatelibrary.base_detectors import VariableDetectorConfig
 from detectmatelibrary.base_detectors import DeepLearningDetectorConfig
@@ -271,7 +272,18 @@ def update_shared_args_aggregation(doc_path: str) -> None:
         BasicConcatAggregationConfig(),
         CoreAlertAggregatorConfig,
         "docs/alert_aggregators/basic_concatenation.md"
-    )
+    ),
+    (
+        LogIDCountAggegationConfig(),
+        CoreAlertAggregatorConfig,
+        "docs/alert_aggregators/logid_count.md"
+    ),
+    # ADD_DENSITY_CLUSTER
+    # (
+    #   DensityClusteringAggregationConfig,
+    #   CoreAlertAggregatorConfig,
+    #   "docs/alert_aggregators/logid_count.md"
+    # ),
 ]
 
 update_shared_args_detectors("docs/detectors.md")
diff --git a/mkdocs.yml b/mkdocs.yml
index 8b0464f7..b0e19095 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -68,6 +68,7 @@ nav:
     - Alert Aggregation methods:
       - 00_Basic Concat: alert_aggregators/basic_concatenation.md
       - 01_LogID Count: alert_aggregators/logid_count.md
+      - 02_Density Cluster: alert_aggregators/density_cluster.md
     - Helpers:
       - FromTo: helper/from_to.md
       - Select Component: helper/select_component.md

From 86edb69a5b647dff8175747da726b886bba6dc9e Mon Sep 17 00:00:00 2001
From: "angre.garcia-gomez@ait.ac.at" <angre.garcia-gomez@ait.ac.at>
Date: Thu, 22 Oct 2026 12:06:46 +0200
Subject: [PATCH 69/86] add identifier

---
 docs/alert_aggregator.md                             | 1 +
 docs/examples/alert_aggregators/density_cluster.py   | 1 +
 docs/examples/alert_aggregators/density_cluster.yaml | 2 +-
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index 0c2edd83..0d1a4738 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -71,6 +71,7 @@ The alert aggregator are numbered from simplest to most complex, and the sidebar
 |---|---|---|
 | 00 | [Basic Concat Aggregator](alert_aggregators/basic_concatenation.md) | Concat a set of alerts. |
 | 01 | [LogID Count Aggregator](alert_aggregators/logid_count.md) | Count the amount of times a logID is in alerts. |
+| 02 | [Density Cluster](alert_aggregators/density_cluster.md) | Add description... ADD_DENSITY_CLUSTER|
 
 
 ### Common parameters (all alert aggregators)
diff --git a/docs/examples/alert_aggregators/density_cluster.py b/docs/examples/alert_aggregators/density_cluster.py
index f47b5d02..3c86f9a3 100644
--- a/docs/examples/alert_aggregators/density_cluster.py
+++ b/docs/examples/alert_aggregators/density_cluster.py
@@ -4,5 +4,6 @@
 
 #  Check BasicConcat of LogID count documentation to add your example here
 #  Use the example config -> density_cluster.yaml from same folder
+#  ADD_DENSITY_CLUSTER
 
 # --8<-- [end:example_1]
diff --git a/docs/examples/alert_aggregators/density_cluster.yaml b/docs/examples/alert_aggregators/density_cluster.yaml
index 83a639f4..b690caf5 100644
--- a/docs/examples/alert_aggregators/density_cluster.yaml
+++ b/docs/examples/alert_aggregators/density_cluster.yaml
@@ -1,3 +1,3 @@
 alert_aggregators:
     NAME:
-        method_type: "method_type"
+        method_type: "ADD_DENSITY_CLUSTER"

From bc63479b184b7b3736cf3214268b94b9a48a6b95 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 22 Oct 2026 12:13:33 +0200
Subject: [PATCH 70/86] Automated documentation update

---
 docs/alert_aggregators/logid_count.md | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/docs/alert_aggregators/logid_count.md b/docs/alert_aggregators/logid_count.md
index 1a868e22..94e178e3 100644
--- a/docs/alert_aggregators/logid_count.md
+++ b/docs/alert_aggregators/logid_count.md
@@ -41,20 +41,21 @@ All parameters this detector accepts, grouped by the YAML block they go in. **Sc
 <!-- Start arguments -->
 ??? note "Top level"
 
-| Field | Type | Default | Scope | Description |
-|---|---|---|---|---|
-| `method_type` | string | basic_concat_aggregator | shared | Indicates what type of method it is. |
-| `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `method_type` | string | logid_count_aggregator | shared | Indicates what type of method it is. |
+    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
 
 ???+ note "params"
 
-| Field | Type | Default | Scope | Description |
-|---|---|---|---|---|
-| `buffer_size` | integer | 3 | specific | Buffer size use in the aggregation. |
-| `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-| `data_use_training` | integer, null | None | shared | Data used for training, if None, training is not done. |
-| `data_use_configure` | integer, null | None | shared | Data used for configuration, if None, configuration is not done. |
-| `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
-| `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
-| `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `max_count` | integer | 4 | specific | Max count of alerts in a specific logID. |
+    | `max_memory` | integer | 5000 | specific | Max number of logIDs store in the count memory. |
+    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
+    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
 <!-- End arguments -->

From b5aabd57e6993f3a72ae2f92c407aad8f896fd88 Mon Sep 17 00:00:00 2001
From: LukasKarner <77165679+LukasKarner@users.noreply.github.com>
Date: Fri, 23 Oct 2026 11:46:36 +0200
Subject: [PATCH 71/86] fix typing issues and improve documentation

---
 .../alert_aggregation/density_clustering.py   | 208 +++++++++++++++---
 1 file changed, 177 insertions(+), 31 deletions(-)

diff --git a/src/detectmatelibrary/alert_aggregation/density_clustering.py b/src/detectmatelibrary/alert_aggregation/density_clustering.py
index fe4c3b90..33a22dd3 100644
--- a/src/detectmatelibrary/alert_aggregation/density_clustering.py
+++ b/src/detectmatelibrary/alert_aggregation/density_clustering.py
@@ -1,3 +1,11 @@
+"""This module implements alert aggregation by density clustering.
+
+It provides the DensityClusteringAggregation class, which is an abstract class that requires the
+implementation of two methods in subclasses: single_metric or metric, and discard_alert_fn.
+The module also provides the DensityClusteringAggregationConfig class,
+which defines the configuration for the DensityClusteringAggregation class.
+"""
+
 from pydantic import NonNegativeFloat
 
 from detectmatelibrary.common.alert_aggregator import (
@@ -7,11 +15,6 @@
 from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
 from detectmatelibrary.utils.data_buffer import BufferMode
 
-"""This module implements alert aggregation by density clustering.
-It provides the DensityClusteringAggregation class, which is an abstract class that requires the implementation of two methods in subclasses: single_metric or metric, and discard_alert_fn.
-The module also provides the DensityClusteringAggregationConfig class, which defines the configuration for the DensityClusteringAggregation class.
-"""
-
 
 class DensityClusteringAggregationConfig(CoreAlertAggregatorConfig):
     """Configuration for the DensityClusteringAggregation class.
@@ -29,21 +32,39 @@ class DensityClusteringAggregationConfig(CoreAlertAggregatorConfig):
 
 
 class DensityClusteringAggregation(CoreAlertAggregator):
-    """This class implements alert aggregation by density clustering. It is an abstract class that requires the implementation of 2 methods in subclasses:
-
-    1. One has to implement either the single_metric or the metric function. The single_metric function computes the distance between 2 alerts, while the metric function computes the distance matrix between a list of alerts. If both functions are implemented, the metric function will be used.
-
-    2. The discard_alert_fn function must be implemented to determine which alerts should no longer be considered for aggregation. To this end, after each aggregation step, the discard_alert_fn function is called with the list of relevant alerts. It should return a list of booleans indicating which alerts should be discarded (True) and which should be kept (False).
+    """This class implements alert aggregation by density clustering.
 
-    Args:
+    Attributes:
         config (DensityClusteringAggregationConfig): The configuration for the aggregator.
-        name (str): The name of the aggregator.
-
-    Methods:
-        single_metric(alert1: DetectorSchema, alert2: DetectorSchema) -> NonNegativeFloat: Computes the distance between 2 alerts. Must be implemented in a subclass.
-        metric(alerts: list[DetectorSchema], return_last_rows: int = 0) -> list[list[NonNegativeFloat]]: Computes the distance matrix between a list of alerts. Can be implemented in a subclass. If both single_metric and metric are implemented, the metric function will be used. The return_last_rows parameter can be used to compute only the last rows of the distance matrix.
-        discard_alert_fn(alerts: list[DetectorSchema]) -> list[bool]: Determines which alerts should no longer be considered for aggregation. Must be implemented in a subclass.
-        aggregate_alerts(input_: list[DetectorSchema], output_: AggregateSchema): Aggregates the input alerts and writes the results to the output.
+        next_group_id (int): The next group ID to be assigned.
+        relevant_alerts (list[DetectorSchema]): The list of alerts currently relevant for aggregation.
+        alert_id_to_group_id (dict[str, int | None]): A mapping from alert IDs to group IDs.
+        active_groups (dict[int, set[int]]): A mapping from group IDs to sets of merged group IDs.
+        message_buffer (list[str]): A buffer for messages to be published in the output schema.
+
+    # Implementation Details
+    This abstract class requires the implementation of 2 methods in subclasses:
+
+    1. One has to implement either the single_metric or the metric function.
+    The single_metric function computes the distance between 2 alerts,
+    while the metric function computes the distance matrix between a list of alerts.
+    If both functions are implemented, the metric function will be used.
+
+    2. The discard_alert_fn function must be implemented to determine which alerts
+    should no longer be considered for aggregation.
+    To this end, after each aggregation step, the discard_alert_fn
+    function is called with the list of relevant alerts.
+    It should return a list of booleans indicating which alerts should be discarded (True)
+    and which should be kept (False).
+
+    # Labelling of Alerts
+    The group labels assigned to alerts are published in the output schema as a
+    dictionary mapping alert IDs to group IDs in the "alertsObtain" field.
+    Every alert is assigned a group ID immediately after it is received,
+    but as the aggregation progresses, groups may be merged.
+    This is published in the output schema as a list of messages in the "alertsObtain" field.
+    Likewise, when a group is finished and no longer reachable from any active alert,
+    this is also published in the output schema as a list of messages in the "alertsObtain" field.
     """
 
     def __init__(
@@ -51,6 +72,12 @@ def __init__(
         config: DensityClusteringAggregationConfig,
         name: str = "DensityClusteringAggregator",
     ) -> None:
+        """Initialize the density clustering aggregator.
+
+        Args:
+            config: The configuration for the aggregator.
+            name: The name of the aggregator.
+        """
         self.buffer_size = config.buffer_size
         self.buffer_mode = config.buffer_mode
         super().__init__(
@@ -59,6 +86,7 @@ def __init__(
             buffer_size=config.buffer_size,
             buffer_mode=config.buffer_mode,
         )
+        self.config: DensityClusteringAggregationConfig  # ty: ignore[invalid-mutable-override]
         self.next_group_id: int = 0
         self.relevant_alerts: list[DetectorSchema] = []
         self.alert_id_to_group_id: dict[str, int | None] = {}
@@ -69,6 +97,18 @@ def __init__(
     def single_metric(
         self, alert1: DetectorSchema, alert2: DetectorSchema
     ) -> NonNegativeFloat:
+        """Compute the distance between two alerts.
+
+        Args:
+            alert1: The first alert.
+            alert2: The second alert.
+
+        Returns:
+            The distance between the two alerts.
+
+        Raises:
+            NotImplementedError: If the method is not implemented by a subclass.
+        """
         raise NotImplementedError(
             "The metric function must be implemented in a subclass of DensityClusteringAggregation."
         )
@@ -76,12 +116,40 @@ def single_metric(
     def metric(
         self, alerts: list[DetectorSchema], return_last_rows: int = 0
     ) -> list[list[NonNegativeFloat]]:
+        """Compute the distance matrix between a list of alerts.
+
+        Subclasses can override this method to provide a more efficient
+        implementation. If both this method and ``single_metric`` are
+        implemented, this method is used.
+
+        Args:
+            alerts: The alerts for which to compute distances.
+            return_last_rows: The number of final rows to compute. If zero,
+                compute all rows.
+
+        Returns:
+            The distance matrix between the alerts.
+        """
         return [
             [self.single_metric(alert1, alert2) for alert2 in alerts]
             for alert1 in alerts[-return_last_rows:]
         ]
 
     def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
+        """Determine which alerts should no longer be considered for
+        aggregation.
+
+        Args:
+            alerts: The alerts currently relevant for aggregation.
+
+        Returns:
+            A list of booleans indicating which alerts should be discarded.
+            ``True`` values indicate alerts to discard, and ``False`` values
+            indicate alerts to keep.
+
+        Raises:
+            NotImplementedError: If the method is not implemented by a subclass.
+        """
         raise NotImplementedError(
             "The discard_alert_fn function must be implemented in a subclass of DensityClusteringAggregation."
         )
@@ -89,6 +157,15 @@ def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
     def aggregate_alerts(
         self, input_: list[DetectorSchema] | DetectorSchema, output_: AggregateSchema
     ) -> bool:
+        """Aggregate input alerts and write the results to the output.
+
+        Args:
+            input_: The alert or alerts to aggregate.
+            output_: The schema to which aggregation results are written.
+
+        Returns:
+            ``True`` after the aggregation results have been written.
+        """
 
         if not isinstance(input_, list):
             input_ = [input_]
@@ -115,6 +192,12 @@ def aggregate_alerts(
     def _write_output(
         self, input_: list[DetectorSchema], output_: AggregateSchema
     ) -> None:
+        """Write group assignments and discard completed alerts.
+
+        Args:
+            input_: The alerts whose group assignments should be written.
+            output_: The schema to which aggregation results are written.
+        """
         output_["description"] = self.description
         output_["alertsObtain"].update(
             {
@@ -130,6 +213,14 @@ def _write_output(
         self.message_buffer = []
 
     def _add_new_alerts(self, input_: list[DetectorSchema]) -> list[DetectorSchema]:
+        """Add previously unseen alerts to the relevant-alert collection.
+
+        Args:
+            input_: Alerts received by the aggregator.
+
+        Returns:
+            The subset of input alerts that had not been seen before.
+        """
         new_input = [
             alert
             for alert in input_
@@ -144,12 +235,29 @@ def _add_new_alerts(self, input_: list[DetectorSchema]) -> list[DetectorSchema]:
     def _check_threshold(
         self, distance_matrix: list[list[NonNegativeFloat]]
     ) -> list[list[bool]]:
+        """Convert distances into threshold comparisons.
+
+        Args:
+            distance_matrix: The pairwise alert distance matrix.
+
+        Returns:
+            A matrix indicating whether each distance is within the configured
+            clustering threshold.
+        """
         return [
             [distance <= self.config.delta for distance in row]
             for row in distance_matrix
         ]
 
-    def _new_group(self, alert_id: int) -> int:
+    def _new_group(self, alert_id: str) -> int:
+        """Create a group containing a single alert.
+
+        Args:
+            alert_id: The identifier of the alert to place in the new group.
+
+        Returns:
+            The identifier assigned to the new group.
+        """
         group_id = self.next_group_id
         self.alert_id_to_group_id[alert_id] = group_id
         self.active_groups[group_id] = {group_id}
@@ -157,6 +265,20 @@ def _new_group(self, alert_id: int) -> int:
         return group_id
 
     def _check_and_merge_groups(self, close_group_ids: set[int]) -> set[int] | None:
+        """Merge distinct groups associated with nearby alerts.
+
+        Args:
+            close_group_ids: The group identifiers associated with nearby
+                alerts.
+
+        Returns:
+            The merged group when multiple groups were combined, or ``None``
+            when the groups were already merged.
+
+        Raises:
+            Exception: If no active groups can be found for the supplied
+                identifiers.
+        """
         # check if groups are merged already
         groups_to_merge = []
         for group_id in close_group_ids:
@@ -167,7 +289,7 @@ def _check_and_merge_groups(self, close_group_ids: set[int]) -> set[int] | None:
             raise Exception("An error occurred while merging groups!")
         elif num_groups == 1:
             # all groups are merged already
-            return
+            return None
 
         # merge groups
         new_group = set.union(*groups_to_merge)
@@ -182,6 +304,17 @@ def _check_and_merge_groups(self, close_group_ids: set[int]) -> set[int] | None:
     def _assign_new_alert_to_group(
         self, new_alert: DetectorSchema, close_relevant_alerts: list[bool]
     ) -> None:
+        """Assign a new alert to a group based on nearby relevant alerts.
+
+        Args:
+            new_alert: The alert that should receive a group assignment.
+            close_relevant_alerts: Flags indicating which relevant alerts are
+                within the clustering threshold.
+
+        Raises:
+            Exception: If the new alert has no close alerts or if close alerts
+                have no group identifiers.
+        """
         close_alerts = [
             relevant_alert
             for relevant_alert, is_close in zip(
@@ -195,7 +328,6 @@ def _assign_new_alert_to_group(
 
         elif len(close_alerts) == 1:
             # only close alert is itself, create new group
-            assert close_alerts[0]["alertID"] == new_alert["alertID"]
             self._new_group(new_alert["alertID"])
             return
 
@@ -218,18 +350,29 @@ def _assign_new_alert_to_group(
             return
 
         # unlabelled close alerts can be ignored now, they will be labelled in their own iteration
-        close_group_ids.discard(None)
-        close_group_ids: set[int] = close_group_ids
+        valid_group_ids: set[int] = {
+            group_id for group_id in close_group_ids if group_id is not None
+        }
 
         # close alerts have multiple group_ids, add alert to some group_id
-        for group_id in close_group_ids:
+        for group_id in valid_group_ids:
             self.alert_id_to_group_id[new_alert["alertID"]] = group_id
             break
 
         # merge groups if necessary
-        self._check_and_merge_groups(close_group_ids)
+        self._check_and_merge_groups(valid_group_ids)
+
+    def _discard_alerts(self, keep_buffer: bool = True) -> tuple[list[str], set[int]]:
+        """Discard alerts no longer needed for future aggregation.
+
+        Args:
+            keep_buffer: Whether to retain the most recent window-buffer
+                alerts when using window buffering.
 
-    def _discard_alerts(self, keep_buffer: bool = True) -> tuple[list[int], set[int]]:
+        Returns:
+            A tuple containing discarded alert identifiers and group identifiers
+            affected by the discard operation.
+        """
         alerts_to_discard = self.discard_alert_fn(self.relevant_alerts)
         if keep_buffer and self.buffer_mode == BufferMode.WINDOW:
             # set the last self.buffer_size elements of alerts_to_discard to False
@@ -237,7 +380,7 @@ def _discard_alerts(self, keep_buffer: bool = True) -> tuple[list[int], set[int]
                 if i > len(alerts_to_discard):
                     break
                 alerts_to_discard[-i] = False
-        discarded_alert_ids = [
+        discarded_alert_ids: list[str] = [
             alert["alertID"]
             for alert, discard in zip(
                 self.relevant_alerts, alerts_to_discard, strict=True
@@ -246,10 +389,8 @@ def _discard_alerts(self, keep_buffer: bool = True) -> tuple[list[int], set[int]
         ]
         affected_group_ids = {
             group_id
-            for group_id in (
-                self.alert_id_to_group_id.pop(alert_id)
-                for alert_id in discarded_alert_ids
-            )
+            for alert_id in discarded_alert_ids
+            if (group_id := self.alert_id_to_group_id.pop(alert_id)) is not None
         }
         self.relevant_alerts = [
             alert
@@ -261,6 +402,11 @@ def _discard_alerts(self, keep_buffer: bool = True) -> tuple[list[int], set[int]
         return discarded_alert_ids, affected_group_ids
 
     def _check_and_discard_group_ids(self, group_ids_to_check: set[int]) -> None:
+        """Remove groups that are no longer reachable from active alerts.
+
+        Args:
+            group_ids_to_check: Group identifiers affected by discarded alerts.
+        """
         # remove groups that are unreachable anymore
         group_ids_to_discard = {
             group_id

From 0d15c999430bc7d8aca5f173f72d09ab0b73a284 Mon Sep 17 00:00:00 2001
From: LukasKarner <77165679+LukasKarner@users.noreply.github.com>
Date: Fri, 23 Oct 2026 12:14:13 +0200
Subject: [PATCH 72/86] add tests for density-clustering-based alert
 aggregation

---
 .../density_clustering.py                     | 133 ++++++++++++++++++
 1 file changed, 133 insertions(+)
 create mode 100644 tests/test_alert_aggregators/density_clustering.py

diff --git a/tests/test_alert_aggregators/density_clustering.py b/tests/test_alert_aggregators/density_clustering.py
new file mode 100644
index 00000000..5bfdcf7f
--- /dev/null
+++ b/tests/test_alert_aggregators/density_clustering.py
@@ -0,0 +1,133 @@
+import pytest
+
+from detectmatelibrary.alert_aggregation.density_clustering import (
+    DensityClusteringAggregation,
+    DensityClusteringAggregationConfig,
+)
+from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
+from detectmatelibrary.utils.data_buffer import BufferMode
+
+
+def make_alert(alert_id: str, score: float) -> DetectorSchema:
+    return DetectorSchema(
+        {
+            "detectorID": "detector",
+            "detectorType": "dummy",
+            "alertID": alert_id,
+            "detectedTimestamp": 0,
+            "logIDs": [f"log-{alert_id}"],
+            "score": score,
+            "logTimestamps": [0],
+            "description": "test alert",
+            "receivedTimestamp": 0,
+            "alertDetails": {},
+        }
+    )
+
+
+class ConcreteDensityClusteringAggregation(DensityClusteringAggregation):
+    def single_metric(
+        self, alert1: DetectorSchema, alert2: DetectorSchema
+    ) -> float:
+        return abs(alert1["score"] - alert2["score"])
+
+    def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
+        return [alert["alertID"].startswith("discard") for alert in alerts]
+
+
+def create_aggregator(
+    *,
+    buffer_mode: BufferMode = BufferMode.BATCH,
+    buffer_size: int = 3,
+    delta: float = 1.0,
+) -> ConcreteDensityClusteringAggregation:
+    return ConcreteDensityClusteringAggregation(
+        config=DensityClusteringAggregationConfig(
+            buffer_mode=buffer_mode,
+            buffer_size=buffer_size,
+            delta=delta,
+        )
+    )
+
+
+class TestDensityClusteringAggregation:
+    def test_metric_and_threshold(self) -> None:
+        aggregator = create_aggregator(delta=2.0)
+        alerts = [make_alert("a", 1.0), make_alert("b", 4.0)]
+
+        assert aggregator.metric(alerts) == [[0.0, 3.0], [3.0, 0.0]]
+        assert aggregator.metric(alerts, return_last_rows=1) == [[3.0, 0.0]]
+        assert aggregator._check_threshold([[0.0, 2.0], [2.1, 0.0]]) == [
+            [True, True],
+            [False, True],
+        ]
+
+    def test_aggregate_assigns_and_merges_groups(self) -> None:
+        aggregator = create_aggregator(delta=10.0)
+        first = make_alert("a", 0.0)
+        second = make_alert("b", 20.0)
+        bridge = make_alert("c", 10.0)
+
+        first_output = AggregateSchema()
+        assert aggregator.aggregate_alerts(first, first_output)
+        assert first_output["alertsObtain"]["a"] == "0"
+
+        second_output = AggregateSchema()
+        aggregator.aggregate_alerts(second, second_output)
+        assert second_output["alertsObtain"]["b"] == "1"
+
+        bridge_output = AggregateSchema()
+        aggregator.config.delta = 6.0
+        aggregator.aggregate_alerts(bridge, bridge_output)
+
+        assert bridge_output["alertsObtain"]["c"] == "0"
+        assert aggregator.active_groups == {0: {0, 1}, 1: {0, 1}}
+        assert "Groups" in bridge_output["alertsObtain"]["messages"]
+
+    def test_duplicate_alert_is_not_reassigned(self) -> None:
+        aggregator = create_aggregator()
+        alert = make_alert("same", 0.0)
+
+        first_output = AggregateSchema()
+        aggregator.aggregate_alerts(alert, first_output)
+        duplicate_output = AggregateSchema()
+        aggregator.aggregate_alerts(alert, duplicate_output)
+
+        assert duplicate_output["alertsObtain"]["same"] == "0"
+        assert aggregator.next_group_id == 1
+        assert len(aggregator.relevant_alerts) == 1
+
+    def test_window_buffer_keeps_latest_alerts(self) -> None:
+        aggregator = create_aggregator(
+            buffer_mode=BufferMode.WINDOW,
+            buffer_size=2,
+        )
+        alerts = [
+            make_alert("discard-1", 0.0),
+            make_alert("keep-1", 0.0),
+            make_alert("keep-2", 0.0),
+        ]
+        aggregator.relevant_alerts.extend(alerts)
+        aggregator.alert_id_to_group_id.update(
+            {alert["alertID"]: 0 for alert in alerts}
+        )
+
+        discarded, affected_groups = aggregator._discard_alerts()
+
+        assert discarded == ["discard-1"]
+        assert affected_groups == {0}
+        assert [alert["alertID"] for alert in aggregator.relevant_alerts] == [
+            "keep-1",
+            "keep-2",
+        ]
+
+    def test_default_hooks_raise_not_implemented(self) -> None:
+        aggregator = DensityClusteringAggregation(
+            config=DensityClusteringAggregationConfig(delta=1.0)
+        )
+        alert = make_alert("a", 0.0)
+
+        with pytest.raises(NotImplementedError):
+            aggregator.single_metric(alert, alert)
+        with pytest.raises(NotImplementedError):
+            aggregator.discard_alert_fn([alert])

From f57a7fce8dfa9d742c19aa15e857366c535a08ff Mon Sep 17 00:00:00 2001
From: LukasKarner <lukas.karner@ait.ac.at>
Date: Fri, 23 Oct 2026 12:49:13 +0200
Subject: [PATCH 73/86] fixed tests

---
 .../alert_aggregation/density_clustering.py   | 14 ++++++++-----
 .../density_clustering.py                     | 20 +++++++++----------
 2 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/src/detectmatelibrary/alert_aggregation/density_clustering.py b/src/detectmatelibrary/alert_aggregation/density_clustering.py
index 33a22dd3..d4c497e1 100644
--- a/src/detectmatelibrary/alert_aggregation/density_clustering.py
+++ b/src/detectmatelibrary/alert_aggregation/density_clustering.py
@@ -59,12 +59,12 @@ class DensityClusteringAggregation(CoreAlertAggregator):
 
     # Labelling of Alerts
     The group labels assigned to alerts are published in the output schema as a
-    dictionary mapping alert IDs to group IDs in the "alertsObtain" field.
+    dictionary mapping alert IDs to group IDs in the "alertDetails" field.
     Every alert is assigned a group ID immediately after it is received,
     but as the aggregation progresses, groups may be merged.
-    This is published in the output schema as a list of messages in the "alertsObtain" field.
+    This is published in the output schema as a list of messages in the "alertDetails" field.
     Likewise, when a group is finished and no longer reachable from any active alert,
-    this is also published in the output schema as a list of messages in the "alertsObtain" field.
+    this is also published in the output schema as a list of messages in the "alertDetails" field.
     """
 
     def __init__(
@@ -165,6 +165,7 @@ def aggregate_alerts(
 
         Returns:
             ``True`` after the aggregation results have been written.
+            ``False`` if no new alerts were aggregated and the output schema was not modified.
         """
 
         if not isinstance(input_, list):
@@ -173,6 +174,9 @@ def aggregate_alerts(
         # identify new alerts and add them to relevant alerts
         new_alerts = self._add_new_alerts(input_)
 
+        if len(new_alerts) == 0:
+            return False  # no new alerts to aggregate
+
         # check distance of new alerts to relevant alerts
         is_same_group = self._check_threshold(
             self.metric(
@@ -199,7 +203,7 @@ def _write_output(
             output_: The schema to which aggregation results are written.
         """
         output_["description"] = self.description
-        output_["alertsObtain"].update(
+        output_["alertDetails"].update(
             {
                 alert["alertID"]: str(self.alert_id_to_group_id[alert["alertID"]])
                 for alert in input_
@@ -209,7 +213,7 @@ def _write_output(
         # discard alerts that are no longer relevant
         _, affected_group_ids = self._discard_alerts()
         self._check_and_discard_group_ids(affected_group_ids)
-        output_["alertsObtain"]["messages"] = "\n".join(self.message_buffer)
+        output_["alertDetails"]["messages"] = "\n".join(self.message_buffer)
         self.message_buffer = []
 
     def _add_new_alerts(self, input_: list[DetectorSchema]) -> list[DetectorSchema]:
diff --git a/tests/test_alert_aggregators/density_clustering.py b/tests/test_alert_aggregators/density_clustering.py
index 5bfdcf7f..45407236 100644
--- a/tests/test_alert_aggregators/density_clustering.py
+++ b/tests/test_alert_aggregators/density_clustering.py
@@ -26,9 +26,7 @@ def make_alert(alert_id: str, score: float) -> DetectorSchema:
 
 
 class ConcreteDensityClusteringAggregation(DensityClusteringAggregation):
-    def single_metric(
-        self, alert1: DetectorSchema, alert2: DetectorSchema
-    ) -> float:
+    def single_metric(self, alert1: DetectorSchema, alert2: DetectorSchema) -> float:
         return abs(alert1["score"] - alert2["score"])
 
     def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
@@ -63,26 +61,26 @@ def test_metric_and_threshold(self) -> None:
         ]
 
     def test_aggregate_assigns_and_merges_groups(self) -> None:
-        aggregator = create_aggregator(delta=10.0)
+        aggregator = create_aggregator(delta=1.0)
         first = make_alert("a", 0.0)
-        second = make_alert("b", 20.0)
-        bridge = make_alert("c", 10.0)
+        second = make_alert("b", 10.0)
+        bridge = make_alert("c", 5.0)
 
         first_output = AggregateSchema()
         assert aggregator.aggregate_alerts(first, first_output)
-        assert first_output["alertsObtain"]["a"] == "0"
+        assert first_output["alertDetails"]["a"] == "0"
 
         second_output = AggregateSchema()
         aggregator.aggregate_alerts(second, second_output)
-        assert second_output["alertsObtain"]["b"] == "1"
+        assert second_output["alertDetails"]["b"] == "1"
 
         bridge_output = AggregateSchema()
         aggregator.config.delta = 6.0
         aggregator.aggregate_alerts(bridge, bridge_output)
 
-        assert bridge_output["alertsObtain"]["c"] == "0"
+        assert bridge_output["alertDetails"]["c"] == "0"
         assert aggregator.active_groups == {0: {0, 1}, 1: {0, 1}}
-        assert "Groups" in bridge_output["alertsObtain"]["messages"]
+        assert "Groups" in bridge_output["alertDetails"]["messages"]
 
     def test_duplicate_alert_is_not_reassigned(self) -> None:
         aggregator = create_aggregator()
@@ -93,7 +91,7 @@ def test_duplicate_alert_is_not_reassigned(self) -> None:
         duplicate_output = AggregateSchema()
         aggregator.aggregate_alerts(alert, duplicate_output)
 
-        assert duplicate_output["alertsObtain"]["same"] == "0"
+        assert "same" not in duplicate_output["alertDetails"]
         assert aggregator.next_group_id == 1
         assert len(aggregator.relevant_alerts) == 1
 

From 992bb4aeef88290de3db8ea9c6208042acc95d07 Mon Sep 17 00:00:00 2001
From: LukasKarner <77165679+LukasKarner@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:58:22 +0200
Subject: [PATCH 74/86] add documentation

---
 docs/alert_aggregator.md                      |  2 +-
 docs/alert_aggregator.md-E                    | 98 +++++++++++++++++++
 docs/alert_aggregators/density_cluster.md     | 38 +++++--
 docs/alert_aggregators/density_cluster.md-E   | 70 +++++++++++++
 .../alert_aggregators/density_cluster.py      | 62 +++++++++++-
 .../alert_aggregators/density_cluster.yaml    |  3 +-
 docs/examples/config/update.py                | 12 +--
 .../alert_aggregation/density_clustering.py   | 17 +++-
 8 files changed, 277 insertions(+), 25 deletions(-)
 create mode 100644 docs/alert_aggregator.md-E
 create mode 100644 docs/alert_aggregators/density_cluster.md-E

diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index 0d1a4738..d22d1799 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -71,7 +71,7 @@ The alert aggregator are numbered from simplest to most complex, and the sidebar
 |---|---|---|
 | 00 | [Basic Concat Aggregator](alert_aggregators/basic_concatenation.md) | Concat a set of alerts. |
 | 01 | [LogID Count Aggregator](alert_aggregators/logid_count.md) | Count the amount of times a logID is in alerts. |
-| 02 | [Density Cluster](alert_aggregators/density_cluster.md) | Add description... ADD_DENSITY_CLUSTER|
+| 02 | [Density Cluster](alert_aggregators/density_cluster.md) | Base class for clustering alerts using a distance function. |
 
 
 ### Common parameters (all alert aggregators)
diff --git a/docs/alert_aggregator.md-E b/docs/alert_aggregator.md-E
new file mode 100644
index 00000000..d22d1799
--- /dev/null
+++ b/docs/alert_aggregator.md-E
@@ -0,0 +1,98 @@
+# Alert Aggregation
+
+Alert aggregators combine the alerts produced by detectors into aggregated records.
+
+|            | Schema                     | Description        |
+|------------|----------------------------|--------------------|
+| **Input**  | [DetectorSchema](schemas.md)    | Alerts from detectors  |
+| **Output** | [AggregateSchema](schemas.md) | Aggregated alerts    |
+
+This document explains the expected API and how to implement an alert aggregator.
+
+## Overview
+
+- Alert aggregators must inherit from `CoreAlertAggregator` and provide an `aggregate_alerts()` implementation.
+- `CoreAlertAggregator.run()` handles the lifecycle and calls `aggregate_alerts()`. Aggregators use a
+  sliding window (a `WINDOW` [data buffer](auxiliar/input_buffer.md)) of `buffer_size` alerts, so
+  `aggregate_alerts()` always receives a **list**: the most recent `buffer_size` alerts. It is first
+  called once the window is full, and then once for every new alert, so consecutive windows overlap.
+  With the default `buffer_size` of 1, it is called for every alert with a list of one.
+- Use a typed `Config` class (subclass of `CoreAlertAggregatorConfig`) to hold runtime parameters.
+
+
+## CoreAlertAggregator: minimal API
+
+```python
+class CoreAlertAggregator(CoreComponent):
+    def __init__(
+        self,
+        name: str = "CoreAlertAggregator",
+        buffer_mode: BufferMode = BufferMode.WINDOW,
+        buffer_size: int | None = 1,
+        config: CoreAlertAggregatorConfig | dict[str, Any] | None = CoreAlertAggregatorConfig(),
+    ) -> None:
+        """buffer_mode and buffer_size set which alerts aggregate_alerts() receives per call."""
+
+    def aggregate_alerts(
+        self,
+        input_: list[DetectorSchema] | DetectorSchema,
+        output_: AggregateSchema,
+    ) -> bool:
+        """Implement the aggregation here.
+        - Return True to emit output_ as the aggregated record.
+        - Return False to emit nothing: process() then returns None.
+        """
+
+    def train(self, input_: DetectorSchema | list[DetectorSchema]) -> None:
+        """Optional: learn from alerts. Can be a no-op."""
+```
+
+## What `run()` fills in for you
+
+Before calling `aggregate_alerts()`, `CoreAlertAggregator.run()` collects these fields from the
+alerts in the window:
+
+- `detectorIDs`, `detectorTypes`, `alertIDs`: one entry per alert
+- `logIDs`, `logTimestamps`: the entries of all alerts, combined into one list
+
+After `aggregate_alerts()` returns `True`, `run()` also sets `aggregatedTimestamp`. So the only
+fields left for `aggregate_alerts()` to fill are `description` and `alertDetails`.
+
+!!! warning "The alerts' details are not carried over"
+    `run()` copies only the fields listed above. Everything else in the incoming alerts is dropped
+    unless your `aggregate_alerts()` keeps it, including their `detectedTimestamp` and
+    `receivedTimestamp`.
+
+## Alert aggregator methods
+
+The alert aggregator are numbered from simplest to most complex, and the sidebar lists them in the same order.
+
+| # | Detector | What it detects |
+|---|---|---|
+| 00 | [Basic Concat Aggregator](alert_aggregators/basic_concatenation.md) | Concat a set of alerts. |
+| 01 | [LogID Count Aggregator](alert_aggregators/logid_count.md) | Count the amount of times a logID is in alerts. |
+| 02 | [Density Cluster](alert_aggregators/density_cluster.md) | Base class for clustering alerts using a distance function. |
+
+
+### Common parameters (all alert aggregators)
+
+There are some parameters, that **every** alert aggregator inherits from `CoreAlertAggregatorConfig`/`CoreConfigCoreAlertAggregator`/`BasicConfig`, regardless of what it does. The other parameters, that are **specific** for the respective detector, are explained right at the detectors documentation page, later on.
+
+<!-- Start common_arguments -->
+???+ note "Top level"
+
+    | Field | Type | Default | Description |
+    |---|---|---|---|
+    | `auto_config` | boolean | False | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Description |
+    |---|---|---|---|
+    | `start_id` | integer | 10 | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | Number of logs used for the configuration step. None skips it. |
+    | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End common_arguments -->
diff --git a/docs/alert_aggregators/density_cluster.md b/docs/alert_aggregators/density_cluster.md
index b9b16771..b692aac4 100644
--- a/docs/alert_aggregators/density_cluster.md
+++ b/docs/alert_aggregators/density_cluster.md
@@ -1,10 +1,6 @@
 # Density Cluster Alert Aggregation
 
-add stuff, dont remove start and end arguments.
-
-## In/out
-
-Input and output schemas in the pipeline
+The density-clustering-based alert aggregator is a base class to implement alert aggregation by clustering alerts according a given distance function of alerts.
 
 ## In/out
 
@@ -13,15 +9,41 @@ Input and output schemas in the pipeline
 | **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
 | **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
 
-## Description
-
-
 ## At a glance
 
 | Learns from training data | Auto-configuration | Needs `events` | Federation |
 |---|---|---|---|
 | ❌ | ❌ | ❌ | ❌ |
 
+## Description
+
+This class implements alert aggregation by density clustering.
+
+### Implementation Details
+
+This abstract class requires the implementation of 2 methods in subclasses:
+
+1. One has to implement either the single_metric or the metric function.
+The single_metric function computes the distance between 2 alerts,
+while the metric function computes the distance matrix between a list of alerts.
+If both functions are implemented, the metric function will be used.
+
+2. The discard_alert_fn function must be implemented to determine which alerts
+should no longer be considered for aggregation.
+To this end, after each aggregation step, the discard_alert_fn
+function is called with the list of relevant alerts.
+It should return a list of booleans indicating which alerts should be discarded (True)
+and which should be kept (False).
+
+### Labelling of Alerts
+
+The group labels assigned to alerts are published in the output schema as a
+dictionary mapping alert IDs to group IDs in the "alertDetails" field.
+Every alert is assigned a group ID immediately after it is received,
+but as the aggregation progresses, groups may be merged.
+This is published in the output schema as a list of messages in the "alertDetails" field.
+Likewise, when a group is finished and no longer reachable from any active alert,
+this is also published in the output schema as a list of messages in the "alertDetails" field.
 
 ## Example
 
diff --git a/docs/alert_aggregators/density_cluster.md-E b/docs/alert_aggregators/density_cluster.md-E
new file mode 100644
index 00000000..b692aac4
--- /dev/null
+++ b/docs/alert_aggregators/density_cluster.md-E
@@ -0,0 +1,70 @@
+# Density Cluster Alert Aggregation
+
+The density-clustering-based alert aggregator is a base class to implement alert aggregation by clustering alerts according a given distance function of alerts.
+
+## In/out
+
+|            | Schema                     | Description        |
+|------------|----------------------------|--------------------|
+| **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
+| **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
+
+## At a glance
+
+| Learns from training data | Auto-configuration | Needs `events` | Federation |
+|---|---|---|---|
+| ❌ | ❌ | ❌ | ❌ |
+
+## Description
+
+This class implements alert aggregation by density clustering.
+
+### Implementation Details
+
+This abstract class requires the implementation of 2 methods in subclasses:
+
+1. One has to implement either the single_metric or the metric function.
+The single_metric function computes the distance between 2 alerts,
+while the metric function computes the distance matrix between a list of alerts.
+If both functions are implemented, the metric function will be used.
+
+2. The discard_alert_fn function must be implemented to determine which alerts
+should no longer be considered for aggregation.
+To this end, after each aggregation step, the discard_alert_fn
+function is called with the list of relevant alerts.
+It should return a list of booleans indicating which alerts should be discarded (True)
+and which should be kept (False).
+
+### Labelling of Alerts
+
+The group labels assigned to alerts are published in the output schema as a
+dictionary mapping alert IDs to group IDs in the "alertDetails" field.
+Every alert is assigned a group ID immediately after it is received,
+but as the aggregation progresses, groups may be merged.
+This is published in the output schema as a list of messages in the "alertDetails" field.
+Likewise, when a group is finished and no longer reachable from any active alert,
+this is also published in the output schema as a list of messages in the "alertDetails" field.
+
+## Example
+
+```python
+--8<-- "docs/examples/alert_aggregators/density_cluster.py:example_1"
+```
+
+## Configuration file
+
+The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
+
+```yaml
+--8<-- "docs/examples/alert_aggregators/density_cluster.yaml"
+```
+
+Load it with `yaml.safe_load` and pass the dict as `config=`, as in the example. The key under `alert_aggregators:` must match the aggregator's `name`.
+
+## Configuration arguments
+
+All parameters this alert aggregator accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this aggregator or `shared` with other alert aggregators.
+
+<!-- Start arguments -->
+
+<!-- End arguments -->
diff --git a/docs/examples/alert_aggregators/density_cluster.py b/docs/examples/alert_aggregators/density_cluster.py
index 3c86f9a3..c1560071 100644
--- a/docs/examples/alert_aggregators/density_cluster.py
+++ b/docs/examples/alert_aggregators/density_cluster.py
@@ -1,9 +1,63 @@
 # --8<-- [start:example_1]
+import yaml
 
-print("Hello World")
+from detectmatelibrary.alert_aggregation.density_clustering import (
+    DensityClusteringAggregation,
+)
+from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
 
-#  Check BasicConcat of LogID count documentation to add your example here
-#  Use the example config -> density_cluster.yaml from same folder
-#  ADD_DENSITY_CLUSTER
+with open("docs/examples/alert_aggregators/density_cluster.yaml") as f:
+    config = yaml.safe_load(f)
+
+
+def make_alert(alert_id: str, score: float) -> DetectorSchema:
+    return DetectorSchema(
+        {
+            "detectorID": "detector",
+            "detectorType": "dummy",
+            "alertID": alert_id,
+            "detectedTimestamp": 0,
+            "logIDs": [f"log-{alert_id}"],
+            "score": score,
+            "logTimestamps": [0],
+            "description": "test alert",
+            "receivedTimestamp": 0,
+            "alertDetails": {},
+        }
+    )
+
+
+class ConcreteDensityClusteringAggregation(DensityClusteringAggregation):
+    def single_metric(
+        self,
+        alert1: DetectorSchema,
+        alert2: DetectorSchema
+    ) -> float:
+        return abs(alert1["score"] - alert2["score"])
+
+    def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
+        return [False for alert in alerts]
+
+
+aggregator = DensityClusteringAggregation(config)
+first = make_alert("a", 0.0)
+second = make_alert("b", 6.0)
+bridge = make_alert("c", 3.0)
+
+first_output = AggregateSchema()
+aggregator.aggregate_alerts(first, first_output)
+
+second_output = AggregateSchema()
+aggregator.aggregate_alerts(second, second_output)
+
+bridge_output = AggregateSchema()
+aggregator.aggregate_alerts(bridge, bridge_output)
+
+print(first_output["alertDetails"]["a"] == "0")  # True
+print(second_output["alertDetails"]["b"] == "1")  # True
+print(bridge_output["alertDetails"]["c"] == "0")  # True
+
+# group labels 0 and 1 are merged into a single group
+print(aggregator.active_groups[1] == {0, 1})  # True
 
 # --8<-- [end:example_1]
diff --git a/docs/examples/alert_aggregators/density_cluster.yaml b/docs/examples/alert_aggregators/density_cluster.yaml
index b690caf5..eb969170 100644
--- a/docs/examples/alert_aggregators/density_cluster.yaml
+++ b/docs/examples/alert_aggregators/density_cluster.yaml
@@ -1,3 +1,4 @@
 alert_aggregators:
     NAME:
-        method_type: "ADD_DENSITY_CLUSTER"
+        method_type: density_clustering_aggregator
+        delta: 4.0
diff --git a/docs/examples/config/update.py b/docs/examples/config/update.py
index 85f1f2ae..dab7e674 100644
--- a/docs/examples/config/update.py
+++ b/docs/examples/config/update.py
@@ -28,6 +28,7 @@
 from detectmatelibrary.common.parser import CoreParserConfig
 from detectmatelibrary.common.alert_aggregator import CoreAlertAggregatorConfig
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregationConfig
+from detectmatelibrary.alert_aggregation.density_clustering import DensityClusteringAggregationConfig
 from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegationConfig
 from detectmatelibrary.base_detectors import TrackerDetectorConfig
 from detectmatelibrary.base_detectors import VariableDetectorConfig
@@ -278,12 +279,11 @@ def update_shared_args_aggregation(doc_path: str) -> None:
         CoreAlertAggregatorConfig,
         "docs/alert_aggregators/logid_count.md"
     ),
-    # ADD_DENSITY_CLUSTER
-    # (
-    #   DensityClusteringAggregationConfig,
-    #   CoreAlertAggregatorConfig,
-    #   "docs/alert_aggregators/logid_count.md"
-    # ),
+    (
+      DensityClusteringAggregationConfig(),
+      CoreAlertAggregatorConfig,
+      "docs/alert_aggregators/logid_count.md"
+    ),
 ]
 
 update_shared_args_detectors("docs/detectors.md")
diff --git a/src/detectmatelibrary/alert_aggregation/density_clustering.py b/src/detectmatelibrary/alert_aggregation/density_clustering.py
index d4c497e1..6e6539e8 100644
--- a/src/detectmatelibrary/alert_aggregation/density_clustering.py
+++ b/src/detectmatelibrary/alert_aggregation/density_clustering.py
@@ -6,7 +6,7 @@
 which defines the configuration for the DensityClusteringAggregation class.
 """
 
-from pydantic import NonNegativeFloat
+from pydantic import Field, NonNegativeFloat
 
 from detectmatelibrary.common.alert_aggregator import (
     CoreAlertAggregator,
@@ -25,10 +25,17 @@ class DensityClusteringAggregationConfig(CoreAlertAggregatorConfig):
         delta (NonNegativeFloat): The threshold for the clustering.
     """
 
-    method_type: str = "density_clustering_aggregator"
-    buffer_size: int = 3
-    buffer_mode: BufferMode = BufferMode.BATCH
-    delta: NonNegativeFloat
+    method_type: str = Field(
+        default="density_clustering_aggregator",
+        description="The kind of aggregation method.",
+    )
+    buffer_size: int = Field(default=3, description="The size of the buffer.")
+    buffer_mode: BufferMode = Field(
+        default=BufferMode.BATCH, description="The mode of the buffer."
+    )
+    delta: NonNegativeFloat = Field(
+        default=0.5, description="The threshold for the clustering."
+    )
 
 
 class DensityClusteringAggregation(CoreAlertAggregator):

From 5ce746b63407a4b954aad4edf3e0607bae6f5ff3 Mon Sep 17 00:00:00 2001
From: LukasKarner <77165679+LukasKarner@users.noreply.github.com>
Date: Tue, 27 Oct 2026 12:29:15 +0100
Subject: [PATCH 75/86] fix requested changes

---
 docs/alert_aggregator.md-E                    | 98 -------------------
 docs/alert_aggregators/density_cluster.md     |  2 +-
 docs/alert_aggregators/density_cluster.md-E   | 70 -------------
 .../alert_aggregators/density_cluster.yaml    |  2 +-
 docs/examples/config/update.py                |  2 +-
 .../alert_aggregation/density_clustering.py   | 36 +++----
 ...ustering.py => test_density_clustering.py} |  0
 7 files changed, 16 insertions(+), 194 deletions(-)
 delete mode 100644 docs/alert_aggregator.md-E
 delete mode 100644 docs/alert_aggregators/density_cluster.md-E
 rename tests/test_alert_aggregators/{density_clustering.py => test_density_clustering.py} (100%)

diff --git a/docs/alert_aggregator.md-E b/docs/alert_aggregator.md-E
deleted file mode 100644
index d22d1799..00000000
--- a/docs/alert_aggregator.md-E
+++ /dev/null
@@ -1,98 +0,0 @@
-# Alert Aggregation
-
-Alert aggregators combine the alerts produced by detectors into aggregated records.
-
-|            | Schema                     | Description        |
-|------------|----------------------------|--------------------|
-| **Input**  | [DetectorSchema](schemas.md)    | Alerts from detectors  |
-| **Output** | [AggregateSchema](schemas.md) | Aggregated alerts    |
-
-This document explains the expected API and how to implement an alert aggregator.
-
-## Overview
-
-- Alert aggregators must inherit from `CoreAlertAggregator` and provide an `aggregate_alerts()` implementation.
-- `CoreAlertAggregator.run()` handles the lifecycle and calls `aggregate_alerts()`. Aggregators use a
-  sliding window (a `WINDOW` [data buffer](auxiliar/input_buffer.md)) of `buffer_size` alerts, so
-  `aggregate_alerts()` always receives a **list**: the most recent `buffer_size` alerts. It is first
-  called once the window is full, and then once for every new alert, so consecutive windows overlap.
-  With the default `buffer_size` of 1, it is called for every alert with a list of one.
-- Use a typed `Config` class (subclass of `CoreAlertAggregatorConfig`) to hold runtime parameters.
-
-
-## CoreAlertAggregator: minimal API
-
-```python
-class CoreAlertAggregator(CoreComponent):
-    def __init__(
-        self,
-        name: str = "CoreAlertAggregator",
-        buffer_mode: BufferMode = BufferMode.WINDOW,
-        buffer_size: int | None = 1,
-        config: CoreAlertAggregatorConfig | dict[str, Any] | None = CoreAlertAggregatorConfig(),
-    ) -> None:
-        """buffer_mode and buffer_size set which alerts aggregate_alerts() receives per call."""
-
-    def aggregate_alerts(
-        self,
-        input_: list[DetectorSchema] | DetectorSchema,
-        output_: AggregateSchema,
-    ) -> bool:
-        """Implement the aggregation here.
-        - Return True to emit output_ as the aggregated record.
-        - Return False to emit nothing: process() then returns None.
-        """
-
-    def train(self, input_: DetectorSchema | list[DetectorSchema]) -> None:
-        """Optional: learn from alerts. Can be a no-op."""
-```
-
-## What `run()` fills in for you
-
-Before calling `aggregate_alerts()`, `CoreAlertAggregator.run()` collects these fields from the
-alerts in the window:
-
-- `detectorIDs`, `detectorTypes`, `alertIDs`: one entry per alert
-- `logIDs`, `logTimestamps`: the entries of all alerts, combined into one list
-
-After `aggregate_alerts()` returns `True`, `run()` also sets `aggregatedTimestamp`. So the only
-fields left for `aggregate_alerts()` to fill are `description` and `alertDetails`.
-
-!!! warning "The alerts' details are not carried over"
-    `run()` copies only the fields listed above. Everything else in the incoming alerts is dropped
-    unless your `aggregate_alerts()` keeps it, including their `detectedTimestamp` and
-    `receivedTimestamp`.
-
-## Alert aggregator methods
-
-The alert aggregator are numbered from simplest to most complex, and the sidebar lists them in the same order.
-
-| # | Detector | What it detects |
-|---|---|---|
-| 00 | [Basic Concat Aggregator](alert_aggregators/basic_concatenation.md) | Concat a set of alerts. |
-| 01 | [LogID Count Aggregator](alert_aggregators/logid_count.md) | Count the amount of times a logID is in alerts. |
-| 02 | [Density Cluster](alert_aggregators/density_cluster.md) | Base class for clustering alerts using a distance function. |
-
-
-### Common parameters (all alert aggregators)
-
-There are some parameters, that **every** alert aggregator inherits from `CoreAlertAggregatorConfig`/`CoreConfigCoreAlertAggregator`/`BasicConfig`, regardless of what it does. The other parameters, that are **specific** for the respective detector, are explained right at the detectors documentation page, later on.
-
-<!-- Start common_arguments -->
-???+ note "Top level"
-
-    | Field | Type | Default | Description |
-    |---|---|---|---|
-    | `auto_config` | boolean | False | Runs the configuration step before the training process. |
-
-???+ note "params"
-
-    | Field | Type | Default | Description |
-    |---|---|---|---|
-    | `start_id` | integer | 10 | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | Number of logs used for training. None skips training. |
-    | `data_use_configure` | integer, null | None | Number of logs used for the configuration step. None skips it. |
-    | `use_config_data_as_training` | boolean | True | Combine the configured data in the training process if True. |
-    | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
-    | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
-<!-- End common_arguments -->
diff --git a/docs/alert_aggregators/density_cluster.md b/docs/alert_aggregators/density_cluster.md
index b692aac4..017c55d3 100644
--- a/docs/alert_aggregators/density_cluster.md
+++ b/docs/alert_aggregators/density_cluster.md
@@ -21,7 +21,7 @@ This class implements alert aggregation by density clustering.
 
 ### Implementation Details
 
-This abstract class requires the implementation of 2 methods in subclasses:
+Creating a custom density clustering aggregator requires the implementation of 2 methods in subclasses:
 
 1. One has to implement either the single_metric or the metric function.
 The single_metric function computes the distance between 2 alerts,
diff --git a/docs/alert_aggregators/density_cluster.md-E b/docs/alert_aggregators/density_cluster.md-E
deleted file mode 100644
index b692aac4..00000000
--- a/docs/alert_aggregators/density_cluster.md-E
+++ /dev/null
@@ -1,70 +0,0 @@
-# Density Cluster Alert Aggregation
-
-The density-clustering-based alert aggregator is a base class to implement alert aggregation by clustering alerts according a given distance function of alerts.
-
-## In/out
-
-|            | Schema                     | Description        |
-|------------|----------------------------|--------------------|
-| **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
-| **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
-
-## At a glance
-
-| Learns from training data | Auto-configuration | Needs `events` | Federation |
-|---|---|---|---|
-| ❌ | ❌ | ❌ | ❌ |
-
-## Description
-
-This class implements alert aggregation by density clustering.
-
-### Implementation Details
-
-This abstract class requires the implementation of 2 methods in subclasses:
-
-1. One has to implement either the single_metric or the metric function.
-The single_metric function computes the distance between 2 alerts,
-while the metric function computes the distance matrix between a list of alerts.
-If both functions are implemented, the metric function will be used.
-
-2. The discard_alert_fn function must be implemented to determine which alerts
-should no longer be considered for aggregation.
-To this end, after each aggregation step, the discard_alert_fn
-function is called with the list of relevant alerts.
-It should return a list of booleans indicating which alerts should be discarded (True)
-and which should be kept (False).
-
-### Labelling of Alerts
-
-The group labels assigned to alerts are published in the output schema as a
-dictionary mapping alert IDs to group IDs in the "alertDetails" field.
-Every alert is assigned a group ID immediately after it is received,
-but as the aggregation progresses, groups may be merged.
-This is published in the output schema as a list of messages in the "alertDetails" field.
-Likewise, when a group is finished and no longer reachable from any active alert,
-this is also published in the output schema as a list of messages in the "alertDetails" field.
-
-## Example
-
-```python
---8<-- "docs/examples/alert_aggregators/density_cluster.py:example_1"
-```
-
-## Configuration file
-
-The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
-
-```yaml
---8<-- "docs/examples/alert_aggregators/density_cluster.yaml"
-```
-
-Load it with `yaml.safe_load` and pass the dict as `config=`, as in the example. The key under `alert_aggregators:` must match the aggregator's `name`.
-
-## Configuration arguments
-
-All parameters this alert aggregator accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this aggregator or `shared` with other alert aggregators.
-
-<!-- Start arguments -->
-
-<!-- End arguments -->
diff --git a/docs/examples/alert_aggregators/density_cluster.yaml b/docs/examples/alert_aggregators/density_cluster.yaml
index eb969170..6a5ed1bb 100644
--- a/docs/examples/alert_aggregators/density_cluster.yaml
+++ b/docs/examples/alert_aggregators/density_cluster.yaml
@@ -1,4 +1,4 @@
 alert_aggregators:
-    NAME:
+    DensityClusteringAggregator:
         method_type: density_clustering_aggregator
         delta: 4.0
diff --git a/docs/examples/config/update.py b/docs/examples/config/update.py
index dab7e674..924035cf 100644
--- a/docs/examples/config/update.py
+++ b/docs/examples/config/update.py
@@ -282,7 +282,7 @@ def update_shared_args_aggregation(doc_path: str) -> None:
     (
       DensityClusteringAggregationConfig(),
       CoreAlertAggregatorConfig,
-      "docs/alert_aggregators/logid_count.md"
+      "docs/alert_aggregators/density_cluster.md"
     ),
 ]
 
diff --git a/src/detectmatelibrary/alert_aggregation/density_clustering.py b/src/detectmatelibrary/alert_aggregation/density_clustering.py
index 6e6539e8..ec188dd4 100644
--- a/src/detectmatelibrary/alert_aggregation/density_clustering.py
+++ b/src/detectmatelibrary/alert_aggregation/density_clustering.py
@@ -1,10 +1,4 @@
-"""This module implements alert aggregation by density clustering.
-
-It provides the DensityClusteringAggregation class, which is an abstract class that requires the
-implementation of two methods in subclasses: single_metric or metric, and discard_alert_fn.
-The module also provides the DensityClusteringAggregationConfig class,
-which defines the configuration for the DensityClusteringAggregation class.
-"""
+from typing import Any
 
 from pydantic import Field, NonNegativeFloat
 
@@ -50,7 +44,7 @@ class DensityClusteringAggregation(CoreAlertAggregator):
         message_buffer (list[str]): A buffer for messages to be published in the output schema.
 
     # Implementation Details
-    This abstract class requires the implementation of 2 methods in subclasses:
+    Creating a custom density clustering aggregator requires the implementation of 2 methods in subclasses:
 
     1. One has to implement either the single_metric or the metric function.
     The single_metric function computes the distance between 2 alerts,
@@ -76,7 +70,7 @@ class DensityClusteringAggregation(CoreAlertAggregator):
 
     def __init__(
         self,
-        config: DensityClusteringAggregationConfig,
+        config: DensityClusteringAggregationConfig | dict[str, Any],
         name: str = "DensityClusteringAggregator",
     ) -> None:
         """Initialize the density clustering aggregator.
@@ -85,6 +79,9 @@ def __init__(
             config: The configuration for the aggregator.
             name: The name of the aggregator.
         """
+        if isinstance(config, dict):
+            config = DensityClusteringAggregationConfig.from_dict(config, name)
+
         self.buffer_size = config.buffer_size
         self.buffer_mode = config.buffer_mode
         super().__init__(
@@ -104,7 +101,9 @@ def __init__(
     def single_metric(
         self, alert1: DetectorSchema, alert2: DetectorSchema
     ) -> NonNegativeFloat:
-        """Compute the distance between two alerts.
+        """Compute the distance between two alerts. This placeholder
+        implementation always returns 0.0, indicating that all alerts are
+        considered identical.
 
         Args:
             alert1: The first alert.
@@ -112,13 +111,8 @@ def single_metric(
 
         Returns:
             The distance between the two alerts.
-
-        Raises:
-            NotImplementedError: If the method is not implemented by a subclass.
         """
-        raise NotImplementedError(
-            "The metric function must be implemented in a subclass of DensityClusteringAggregation."
-        )
+        return 0.0
 
     def metric(
         self, alerts: list[DetectorSchema], return_last_rows: int = 0
@@ -144,7 +138,8 @@ def metric(
 
     def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
         """Determine which alerts should no longer be considered for
-        aggregation.
+        aggregation. This placeholder implementation always returns a list of
+        ``True`` values, indicating that all alerts should be discarded.
 
         Args:
             alerts: The alerts currently relevant for aggregation.
@@ -153,13 +148,8 @@ def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
             A list of booleans indicating which alerts should be discarded.
             ``True`` values indicate alerts to discard, and ``False`` values
             indicate alerts to keep.
-
-        Raises:
-            NotImplementedError: If the method is not implemented by a subclass.
         """
-        raise NotImplementedError(
-            "The discard_alert_fn function must be implemented in a subclass of DensityClusteringAggregation."
-        )
+        return [True] * len(alerts)
 
     def aggregate_alerts(
         self, input_: list[DetectorSchema] | DetectorSchema, output_: AggregateSchema
diff --git a/tests/test_alert_aggregators/density_clustering.py b/tests/test_alert_aggregators/test_density_clustering.py
similarity index 100%
rename from tests/test_alert_aggregators/density_clustering.py
rename to tests/test_alert_aggregators/test_density_clustering.py

From 7bd4493a96b97b40939fd230a75dc80bcc1092e6 Mon Sep 17 00:00:00 2001
From: LukasKarner <lukas.karner@ait.ac.at>
Date: Tue, 27 Oct 2026 14:22:26 +0100
Subject: [PATCH 76/86] fix tests

---
 .../alert_aggregators/density_cluster.py      |  2 +-
 .../alert_aggregation/density_clustering.py   | 26 +------------------
 .../test_density_clustering.py                | 10 +++----
 3 files changed, 5 insertions(+), 33 deletions(-)

diff --git a/docs/examples/alert_aggregators/density_cluster.py b/docs/examples/alert_aggregators/density_cluster.py
index c1560071..299accbb 100644
--- a/docs/examples/alert_aggregators/density_cluster.py
+++ b/docs/examples/alert_aggregators/density_cluster.py
@@ -39,7 +39,7 @@ def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
         return [False for alert in alerts]
 
 
-aggregator = DensityClusteringAggregation(config)
+aggregator = ConcreteDensityClusteringAggregation(config)
 first = make_alert("a", 0.0)
 second = make_alert("b", 6.0)
 bridge = make_alert("c", 3.0)
diff --git a/src/detectmatelibrary/alert_aggregation/density_clustering.py b/src/detectmatelibrary/alert_aggregation/density_clustering.py
index ec188dd4..0ea29405 100644
--- a/src/detectmatelibrary/alert_aggregation/density_clustering.py
+++ b/src/detectmatelibrary/alert_aggregation/density_clustering.py
@@ -42,30 +42,6 @@ class DensityClusteringAggregation(CoreAlertAggregator):
         alert_id_to_group_id (dict[str, int | None]): A mapping from alert IDs to group IDs.
         active_groups (dict[int, set[int]]): A mapping from group IDs to sets of merged group IDs.
         message_buffer (list[str]): A buffer for messages to be published in the output schema.
-
-    # Implementation Details
-    Creating a custom density clustering aggregator requires the implementation of 2 methods in subclasses:
-
-    1. One has to implement either the single_metric or the metric function.
-    The single_metric function computes the distance between 2 alerts,
-    while the metric function computes the distance matrix between a list of alerts.
-    If both functions are implemented, the metric function will be used.
-
-    2. The discard_alert_fn function must be implemented to determine which alerts
-    should no longer be considered for aggregation.
-    To this end, after each aggregation step, the discard_alert_fn
-    function is called with the list of relevant alerts.
-    It should return a list of booleans indicating which alerts should be discarded (True)
-    and which should be kept (False).
-
-    # Labelling of Alerts
-    The group labels assigned to alerts are published in the output schema as a
-    dictionary mapping alert IDs to group IDs in the "alertDetails" field.
-    Every alert is assigned a group ID immediately after it is received,
-    but as the aggregation progresses, groups may be merged.
-    This is published in the output schema as a list of messages in the "alertDetails" field.
-    Likewise, when a group is finished and no longer reachable from any active alert,
-    this is also published in the output schema as a list of messages in the "alertDetails" field.
     """
 
     def __init__(
@@ -99,7 +75,7 @@ def __init__(
         self.description = "Alert aggregation by density clustering."
 
     def single_metric(
-        self, alert1: DetectorSchema, alert2: DetectorSchema
+        self, alert1: DetectorSchema, alert2: DetectorSchema  # noqa: ARG002
     ) -> NonNegativeFloat:
         """Compute the distance between two alerts. This placeholder
         implementation always returns 0.0, indicating that all alerts are
diff --git a/tests/test_alert_aggregators/test_density_clustering.py b/tests/test_alert_aggregators/test_density_clustering.py
index 45407236..7907ad37 100644
--- a/tests/test_alert_aggregators/test_density_clustering.py
+++ b/tests/test_alert_aggregators/test_density_clustering.py
@@ -1,5 +1,3 @@
-import pytest
-
 from detectmatelibrary.alert_aggregation.density_clustering import (
     DensityClusteringAggregation,
     DensityClusteringAggregationConfig,
@@ -119,13 +117,11 @@ def test_window_buffer_keeps_latest_alerts(self) -> None:
             "keep-2",
         ]
 
-    def test_default_hooks_raise_not_implemented(self) -> None:
+    def test_default_hooks_return_dummy_values(self) -> None:
         aggregator = DensityClusteringAggregation(
             config=DensityClusteringAggregationConfig(delta=1.0)
         )
         alert = make_alert("a", 0.0)
 
-        with pytest.raises(NotImplementedError):
-            aggregator.single_metric(alert, alert)
-        with pytest.raises(NotImplementedError):
-            aggregator.discard_alert_fn([alert])
+        assert aggregator.single_metric(alert, alert) == 0.0
+        assert aggregator.discard_alert_fn([alert]) == [True]

From f4b116bc9e7dfa26c4433acdc76b45807b3f85a7 Mon Sep 17 00:00:00 2001
From: ipmach <andre.gg96@gmail.com>
Date: Tue, 27 Oct 2026 14:53:09 +0100
Subject: [PATCH 77/86] Add Lukas Karner to authors list in metadata.py

---
 src/detectmatelibrary/metadata.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/detectmatelibrary/metadata.py b/src/detectmatelibrary/metadata.py
index 3bc99247..8dfd6571 100644
--- a/src/detectmatelibrary/metadata.py
+++ b/src/detectmatelibrary/metadata.py
@@ -1,5 +1,5 @@
 __authors__ = ["André García Gómez", "Viktor Beck", "Thorina Boenke", "Wolfgang Hotwagner", "Anna Erdi",
-               "Ernst Leierzopf", "Leonhard Kaufmann"]
+               "Ernst Leierzopf", "Leonhard Kaufmann", "Lukas Karner"]
 __contact__ = "aecid@ait.ac.at"
 __copyright__ = "Copyright 2026, AIT Austrian Institute of Technology GmbH"
 __date__ = "2026/05/18"

From ebe4a88c4a4a2b4796a50ae4a9427efc26ef0d61 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 14:58:52 +0100
Subject: [PATCH 78/86] Automated documentation update

---
 docs/alert_aggregators/density_cluster.md | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/docs/alert_aggregators/density_cluster.md b/docs/alert_aggregators/density_cluster.md
index 017c55d3..3efe5155 100644
--- a/docs/alert_aggregators/density_cluster.md
+++ b/docs/alert_aggregators/density_cluster.md
@@ -66,5 +66,24 @@ Load it with `yaml.safe_load` and pass the dict as `config=`, as in the example.
 All parameters this alert aggregator accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this aggregator or `shared` with other alert aggregators.
 
 <!-- Start arguments -->
-
+??? note "Top level"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `method_type` | string | density_clustering_aggregator | shared | The kind of aggregation method. |
+    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `buffer_size` | integer | 3 | specific | The size of the buffer. |
+    | `buffer_mode` | object | BufferMode.BATCH | specific | The mode of the buffer. |
+    | `delta` | number | 0.5 | specific | The threshold for the clustering. |
+    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
+    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
 <!-- End arguments -->

From ecdd4b40e07b58b19d308c0439bfd3a186c5f13b Mon Sep 17 00:00:00 2001
From: LukasKarner <77165679+LukasKarner@users.noreply.github.com>
Date: Tue, 27 Oct 2026 20:14:08 +0100
Subject: [PATCH 79/86] add time-delta alert aggregation

---
 .../alert_aggregation/time_delta.py           | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 src/detectmatelibrary/alert_aggregation/time_delta.py

diff --git a/src/detectmatelibrary/alert_aggregation/time_delta.py b/src/detectmatelibrary/alert_aggregation/time_delta.py
new file mode 100644
index 00000000..9d8596a5
--- /dev/null
+++ b/src/detectmatelibrary/alert_aggregation/time_delta.py
@@ -0,0 +1,59 @@
+from collections.abc import Callable
+from typing import Any
+
+from pydantic import NonNegativeFloat
+
+from detectmatelibrary.alert_aggregation.density_clustering import (
+    DensityClusteringAggregation,
+    DensityClusteringAggregationConfig,
+)
+from detectmatelibrary.schemas import DetectorSchema
+
+
+class TimeDeltaAggregationConfig(DensityClusteringAggregationConfig):
+    """Configuration of the TimeDeltaAggregation class.
+
+    Args:
+        delta (NonNegativeFloat): The time threshold below which two alerts are allocated to the same group.
+    """
+
+    method_type: str = "time_delta_aggregator"
+    delta: NonNegativeFloat = 10.0
+
+
+class TimeDeltaAggregation(DensityClusteringAggregation):
+    """This class implements alert aggregation by the time-delta method introduced by
+    [Landauer et al.](https://dl.acm.org/doi/pdf/10.1145/3510581).
+    Two alerts will be assigned to the same group if the time difference between them is below a certain
+    threshold delta. The time difference is computed based on the last extracted timestamp of each alert.
+
+    Args:
+        name (str): The name identifying this aggregation method.
+        config (TimeDeltaAggregationConfig): The configuration of this method.
+    """
+
+    def __init__(
+        self,
+        config: TimeDeltaAggregationConfig | dict[str, Any],
+        name: str = "TimeDeltaAggregator",
+    ) -> None:
+        if isinstance(config, dict):
+            config = TimeDeltaAggregationConfig.from_dict(config, name)
+
+        super().__init__(name=name, config=config)
+        self.timestamp_extraction_fn: Callable[[DetectorSchema], float] = lambda alert: float(
+            alert["logTimestamps"][-1]
+        )
+        self.description = "Alert aggregation by the time-delta method."
+
+    def single_metric(
+        self,
+        alert1: DetectorSchema,
+        alert2: DetectorSchema,
+    ) -> NonNegativeFloat:
+        return abs(
+            self.timestamp_extraction_fn(alert1) - self.timestamp_extraction_fn(alert2)
+        )
+
+    def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
+        return [i + 1 != len(alerts) for i in range(len(alerts))]

From 508a3b4e37d805bacbeb225c5b58e7881f433b3d Mon Sep 17 00:00:00 2001
From: LukasKarner <77165679+LukasKarner@users.noreply.github.com>
Date: Tue, 27 Oct 2026 20:14:33 +0100
Subject: [PATCH 80/86] add tests for time-delta alert aggregation

---
 .../test_alert_aggregators/test_time_delta.py | 93 +++++++++++++++++++
 1 file changed, 93 insertions(+)
 create mode 100644 tests/test_alert_aggregators/test_time_delta.py

diff --git a/tests/test_alert_aggregators/test_time_delta.py b/tests/test_alert_aggregators/test_time_delta.py
new file mode 100644
index 00000000..1389bb6e
--- /dev/null
+++ b/tests/test_alert_aggregators/test_time_delta.py
@@ -0,0 +1,93 @@
+from detectmatelibrary.alert_aggregation.time_delta import (
+    TimeDeltaAggregation,
+    TimeDeltaAggregationConfig,
+)
+from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
+
+
+def make_alert(alert_id: str, timestamp: int) -> DetectorSchema:
+    return DetectorSchema(
+        {
+            "detectorID": "detector",
+            "detectorType": "dummy",
+            "alertID": alert_id,
+            "detectedTimestamp": timestamp,
+            "logIDs": [f"log-{alert_id}"],
+            "score": 0.0,
+            "logTimestamps": [timestamp],
+            "description": "test alert",
+            "receivedTimestamp": timestamp,
+            "alertDetails": {},
+        }
+    )
+
+
+def create_aggregator(*, delta: float = 10.0) -> TimeDeltaAggregation:
+    return TimeDeltaAggregation(
+        config=TimeDeltaAggregationConfig(buffer_size=3, delta=delta)
+    )
+
+
+class TestTimeDeltaAggregation:
+    def test_default_configuration(self) -> None:
+        config = TimeDeltaAggregationConfig()
+
+        assert config.method_type == "time_delta_aggregator"
+        assert config.delta == 10.0
+
+    def test_single_metric_returns_absolute_timestamp_delta(self) -> None:
+        aggregator = create_aggregator()
+        first = make_alert("first", 100)
+        second = make_alert("second", 93)
+
+        assert aggregator.single_metric(first, second) == 7.0
+        assert aggregator.single_metric(second, first) == 7.0
+
+    def test_single_metric_uses_last_extracted_timestamp(self) -> None:
+        aggregator = create_aggregator()
+        first = make_alert("first", 100)
+        second = make_alert("second", 106)
+        first["logTimestamps"] = [90, 100]
+        second["logTimestamps"] = [101, 106]
+
+        assert aggregator.single_metric(first, second) == 6.0
+
+    def test_discard_alert_fn_keeps_only_latest_alert(self) -> None:
+        aggregator = create_aggregator()
+        alerts = [
+            make_alert("first", 1),
+            make_alert("second", 2),
+            make_alert("third", 3),
+        ]
+
+        assert aggregator.discard_alert_fn(alerts) == [True, True, False]
+
+    def test_alerts_within_delta_are_assigned_to_same_group(self) -> None:
+        aggregator = create_aggregator(delta=10.0)
+        first_output = AggregateSchema()
+        second_output = AggregateSchema()
+
+        assert aggregator.aggregate_alerts(make_alert("first", 100), first_output)
+        assert aggregator.aggregate_alerts(make_alert("second", 110), second_output)
+
+        assert first_output["alertDetails"]["first"] == "0"
+        assert second_output["alertDetails"]["second"] == "0"
+        assert second_output["description"] == (
+            "Alert aggregation by the time-delta method."
+        )
+
+    def test_alerts_outside_delta_are_assigned_to_different_groups(self) -> None:
+        aggregator = create_aggregator(delta=10.0)
+        aggregator.aggregate_alerts(make_alert("first", 100), AggregateSchema())
+        second_output = AggregateSchema()
+
+        assert aggregator.aggregate_alerts(make_alert("second", 111), second_output)
+
+        assert second_output["alertDetails"]["second"] == "1"
+
+    def test_only_latest_alert_remains_relevant_after_aggregation(self) -> None:
+        aggregator = create_aggregator()
+        aggregator.aggregate_alerts(make_alert("first", 100), AggregateSchema())
+        aggregator.aggregate_alerts(make_alert("second", 105), AggregateSchema())
+
+        assert [alert["alertID"] for alert in aggregator.relevant_alerts] == ["second"]

From dd9040a0cdbfa5b07aafd9e70ae85cb0046c4aee Mon Sep 17 00:00:00 2001
From: LukasKarner <77165679+LukasKarner@users.noreply.github.com>
Date: Tue, 27 Oct 2026 20:34:02 +0100
Subject: [PATCH 81/86] init docs for time-delta alert aggregation

---
 docs/alert_aggregator.md                            | 1 +
 docs/alert_aggregators/time_delta.md                | 1 +
 docs/examples/alert_aggregators/time_delta.py       | 1 +
 docs/examples/config/update.py                      | 6 ++++++
 src/detectmatelibrary/alert_aggregation/__init__.py | 3 +++
 5 files changed, 12 insertions(+)
 create mode 100644 docs/alert_aggregators/time_delta.md
 create mode 100644 docs/examples/alert_aggregators/time_delta.py

diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index d22d1799..54eb8f7a 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -72,6 +72,7 @@ The alert aggregator are numbered from simplest to most complex, and the sidebar
 | 00 | [Basic Concat Aggregator](alert_aggregators/basic_concatenation.md) | Concat a set of alerts. |
 | 01 | [LogID Count Aggregator](alert_aggregators/logid_count.md) | Count the amount of times a logID is in alerts. |
 | 02 | [Density Cluster](alert_aggregators/density_cluster.md) | Base class for clustering alerts using a distance function. |
+| 03 | [Time Delta](alert_aggregators/time_delta.md) | Group alerts by their time difference. |
 
 
 ### Common parameters (all alert aggregators)
diff --git a/docs/alert_aggregators/time_delta.md b/docs/alert_aggregators/time_delta.md
new file mode 100644
index 00000000..5b845582
--- /dev/null
+++ b/docs/alert_aggregators/time_delta.md
@@ -0,0 +1 @@
+# tbd
diff --git a/docs/examples/alert_aggregators/time_delta.py b/docs/examples/alert_aggregators/time_delta.py
new file mode 100644
index 00000000..5b845582
--- /dev/null
+++ b/docs/examples/alert_aggregators/time_delta.py
@@ -0,0 +1 @@
+# tbd
diff --git a/docs/examples/config/update.py b/docs/examples/config/update.py
index 924035cf..b0288c78 100644
--- a/docs/examples/config/update.py
+++ b/docs/examples/config/update.py
@@ -29,6 +29,7 @@
 from detectmatelibrary.common.alert_aggregator import CoreAlertAggregatorConfig
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregationConfig
 from detectmatelibrary.alert_aggregation.density_clustering import DensityClusteringAggregationConfig
+from detectmatelibrary.alert_aggregation.time_delta import TimeDeltaAggregationConfig
 from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegationConfig
 from detectmatelibrary.base_detectors import TrackerDetectorConfig
 from detectmatelibrary.base_detectors import VariableDetectorConfig
@@ -284,6 +285,11 @@ def update_shared_args_aggregation(doc_path: str) -> None:
       CoreAlertAggregatorConfig,
       "docs/alert_aggregators/density_cluster.md"
     ),
+    (
+        TimeDeltaAggregationConfig(),
+        CoreAlertAggregatorConfig,
+        "docs/alert_aggregators/time_delta.md"
+    )
 ]
 
 update_shared_args_detectors("docs/detectors.md")
diff --git a/src/detectmatelibrary/alert_aggregation/__init__.py b/src/detectmatelibrary/alert_aggregation/__init__.py
index b858e98b..2bede321 100644
--- a/src/detectmatelibrary/alert_aggregation/__init__.py
+++ b/src/detectmatelibrary/alert_aggregation/__init__.py
@@ -4,12 +4,15 @@
     DensityClusteringAggregationConfig,
 )
 from .logid_count import LogIDCountAggegation, LogIDCountAggegationConfig
+from .time_delta import TimeDeltaAggregation, TimeDeltaAggregationConfig
 
 __all__ = [
     "BasicConcatAggregation",
     "BasicConcatAggregationConfig",
     "DensityClusteringAggregation",
     "DensityClusteringAggregationConfig",
+    "TimeDeltaAggregation",
+    "TimeDeltaAggregationConfig",
     "LogIDCountAggegation",
     "LogIDCountAggegationConfig",
 ]

From 102392a78386e1a7a4306101cdfa7a538a035f5b Mon Sep 17 00:00:00 2001
From: LukasKarner <77165679+LukasKarner@users.noreply.github.com>
Date: Tue, 27 Oct 2026 21:20:00 +0100
Subject: [PATCH 82/86] add docs for time-delta aggregation

---
 docs/alert_aggregators/time_delta.md          | 68 ++++++++++++++++++-
 docs/examples/alert_aggregators/time_delta.py | 54 ++++++++++++++-
 .../alert_aggregators/time_delta.yaml         |  4 ++
 mkdocs.yml                                    |  1 +
 .../alert_aggregation/time_delta.py           | 63 ++++++++++++++---
 5 files changed, 180 insertions(+), 10 deletions(-)
 create mode 100644 docs/examples/alert_aggregators/time_delta.yaml

diff --git a/docs/alert_aggregators/time_delta.md b/docs/alert_aggregators/time_delta.md
index 5b845582..023e83b1 100644
--- a/docs/alert_aggregators/time_delta.md
+++ b/docs/alert_aggregators/time_delta.md
@@ -1 +1,67 @@
-# tbd
+# Time Delta Alert Aggregation
+
+The time-delta alert aggregator implements alert aggregation by grouping alerts according their time-difference as proposed by [Landauer et al.](https://dl.acm.org/doi/pdf/10.1145/3510581).
+
+## In/out
+
+|            | Schema                     | Description        |
+|------------|----------------------------|--------------------|
+| **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
+| **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
+
+## At a glance
+
+| Learns from training data | Auto-configuration | Needs `events` | Federation |
+|---|---|---|---|
+| ❌ | ❌ | ❌ | ❌ |
+
+## Description
+
+This class implements alert aggregation by considering the differences between the timestamps of alerts.
+
+Two alerts will be assigned to the same group if the time difference between them is below a certain threshold delta.
+The time difference is computed based on the timestamps of the last logs associated with each alert as these determine the earliest time at which the alert was detected.
+Important: It is assumed that the alerts arrive in order of their timestamps!
+
+## Example
+
+```python
+--8<-- "docs/examples/alert_aggregators/time_delta.py:example_1"
+```
+
+## Configuration file
+
+The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
+
+```yaml
+--8<-- "docs/examples/alert_aggregators/time_delta.yaml"
+```
+
+Load it with `yaml.safe_load` and pass the dict as `config=`, as in the example. The key under `alert_aggregators:` must match the aggregator's `name`.
+
+## Configuration arguments
+
+All parameters this alert aggregator accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this aggregator or `shared` with other alert aggregators.
+
+<!-- Start arguments -->
+??? note "Top level"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `method_type` | string | density_clustering_aggregator | shared | The kind of aggregation method. |
+    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `buffer_size` | integer | 3 | specific | The size of the buffer. |
+    | `buffer_mode` | object | BufferMode.BATCH | specific | The mode of the buffer. |
+    | `delta` | number | 0.5 | specific | The threshold for the clustering. |
+    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
+    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End arguments -->
diff --git a/docs/examples/alert_aggregators/time_delta.py b/docs/examples/alert_aggregators/time_delta.py
index 5b845582..2b01157a 100644
--- a/docs/examples/alert_aggregators/time_delta.py
+++ b/docs/examples/alert_aggregators/time_delta.py
@@ -1 +1,53 @@
-# tbd
+# --8<-- [start:example_1]
+import yaml
+
+from detectmatelibrary.alert_aggregation.time_delta import (
+    TimeDeltaAggregation,
+)
+from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
+
+with open("docs/examples/alert_aggregators/time_delta.yaml") as f:
+    config = yaml.safe_load(f)
+
+
+def make_alert(alert_id: str, timestamp: float) -> DetectorSchema:
+    return DetectorSchema(
+        {
+            "detectorID": "detector",
+            "detectorType": "dummy",
+            "alertID": alert_id,
+            "detectedTimestamp": 0,
+            "logIDs": [f"log-{alert_id}"],
+            "score": 0.0,
+            "logTimestamps": [timestamp],
+            "description": "test alert",
+            "receivedTimestamp": 0,
+            "alertDetails": {},
+        }
+    )
+
+
+aggregator = TimeDeltaAggregation(config)
+first = make_alert("a", 0)
+second = make_alert("b", 6)
+third = make_alert("c", 9)
+fourth = make_alert("d", 15)
+
+first_output = AggregateSchema()
+aggregator.aggregate_alerts(first, first_output)
+
+second_output = AggregateSchema()
+aggregator.aggregate_alerts(second, second_output)
+
+third_output = AggregateSchema()
+aggregator.aggregate_alerts(third, third_output)
+
+fourth_output = AggregateSchema()
+aggregator.aggregate_alerts(fourth, fourth_output)
+
+print(first_output["alertDetails"]["a"] == "0")  # True
+print(second_output["alertDetails"]["b"] == "1")  # True
+print(third_output["alertDetails"]["c"] == "1")  # True
+print(fourth_output["alertDetails"]["d"] == "2")  # True
+
+# --8<-- [end:example_1]
diff --git a/docs/examples/alert_aggregators/time_delta.yaml b/docs/examples/alert_aggregators/time_delta.yaml
new file mode 100644
index 00000000..b00bb97b
--- /dev/null
+++ b/docs/examples/alert_aggregators/time_delta.yaml
@@ -0,0 +1,4 @@
+alert_aggregators:
+    TimeDeltaAggregator:
+        method_type: time_delta_aggregator
+        delta: 4.0
diff --git a/mkdocs.yml b/mkdocs.yml
index b0e19095..eb562bb5 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -69,6 +69,7 @@ nav:
       - 00_Basic Concat: alert_aggregators/basic_concatenation.md
       - 01_LogID Count: alert_aggregators/logid_count.md
       - 02_Density Cluster: alert_aggregators/density_cluster.md
+      - 03_Time Delta: alert_aggregators/time_delta.md
     - Helpers:
       - FromTo: helper/from_to.md
       - Select Component: helper/select_component.md
diff --git a/src/detectmatelibrary/alert_aggregation/time_delta.py b/src/detectmatelibrary/alert_aggregation/time_delta.py
index 9d8596a5..0393198c 100644
--- a/src/detectmatelibrary/alert_aggregation/time_delta.py
+++ b/src/detectmatelibrary/alert_aggregation/time_delta.py
@@ -7,7 +7,7 @@
     DensityClusteringAggregation,
     DensityClusteringAggregationConfig,
 )
-from detectmatelibrary.schemas import DetectorSchema
+from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
 
 
 class TimeDeltaAggregationConfig(DensityClusteringAggregationConfig):
@@ -24,12 +24,12 @@ class TimeDeltaAggregationConfig(DensityClusteringAggregationConfig):
 class TimeDeltaAggregation(DensityClusteringAggregation):
     """This class implements alert aggregation by the time-delta method introduced by
     [Landauer et al.](https://dl.acm.org/doi/pdf/10.1145/3510581).
-    Two alerts will be assigned to the same group if the time difference between them is below a certain
-    threshold delta. The time difference is computed based on the last extracted timestamp of each alert.
+    Two alerts will be assigned to the same group if the time difference
+    between them is below a certain threshold delta.
+    The time difference is computed based on the timestamps of the last logs associated
+    with each alert as these determine the earliest time at which the alert was detected.
+    Important: It is assumed that the alerts arrive in order of their timestamps!
 
-    Args:
-        name (str): The name identifying this aggregation method.
-        config (TimeDeltaAggregationConfig): The configuration of this method.
     """
 
     def __init__(
@@ -37,23 +37,70 @@ def __init__(
         config: TimeDeltaAggregationConfig | dict[str, Any],
         name: str = "TimeDeltaAggregator",
     ) -> None:
+        """Initialize the TimeDeltaAggregation class.
+
+        Args:
+            name (str): The name identifying this aggregation method.
+            config (TimeDeltaAggregationConfig): The configuration of this method.
+        """
         if isinstance(config, dict):
             config = TimeDeltaAggregationConfig.from_dict(config, name)
 
         super().__init__(name=name, config=config)
-        self.timestamp_extraction_fn: Callable[[DetectorSchema], float] = lambda alert: float(
-            alert["logTimestamps"][-1]
+        self.timestamp_extraction_fn: Callable[[DetectorSchema], float] = lambda alert: (
+            float(alert["logTimestamps"][-1])
         )
         self.description = "Alert aggregation by the time-delta method."
 
+    def aggregate_alerts(
+        self, input_: list[DetectorSchema] | DetectorSchema, output_: AggregateSchema
+    ) -> bool:
+        """Aggregate input alerts and write the results to the output.
+
+        Args:
+            input_: The alert or alerts to aggregate.
+            output_: The schema to which aggregation results are written.
+
+        Returns:
+            ``True`` after the aggregation results have been written.
+            ``False`` if no new alerts were aggregated and the output schema was not modified.
+        """
+
+        if not isinstance(input_, list):
+            input_ = [input_]
+
+        if self.timestamp_extraction_fn(input_[0]) < self.timestamp_extraction_fn(
+            self.relevant_alerts[-1]
+        ):
+            raise ValueError("Alerts must be aggregated in order of their timestamps!")
+
+        return super().aggregate_alerts(input_, output_)
+
     def single_metric(
         self,
         alert1: DetectorSchema,
         alert2: DetectorSchema,
     ) -> NonNegativeFloat:
+        """Compute the time difference between two alerts.
+
+        Args:
+            alert1 (DetectorSchema): The first alert.
+            alert2 (DetectorSchema): The second alert.
+        Returns:
+            NonNegativeFloat: The time difference between the two alerts.
+        """
         return abs(
             self.timestamp_extraction_fn(alert1) - self.timestamp_extraction_fn(alert2)
         )
 
     def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
+        """Discards all but the last alert in a list of alerts as this is the
+        only one relevant for the time-delta method.
+
+        Args:
+            alerts (list[DetectorSchema]): The list of alerts to discard from.
+
+        Returns:
+            list[bool]: A list of booleans indicating which alerts to discard.
+        """
         return [i + 1 != len(alerts) for i in range(len(alerts))]

From 256897408365ed6fa94ee24c0784146d2e13c248 Mon Sep 17 00:00:00 2001
From: LukasKarner <77165679+LukasKarner@users.noreply.github.com>
Date: Tue, 27 Oct 2026 21:26:05 +0100
Subject: [PATCH 83/86] add field

---
 src/detectmatelibrary/alert_aggregation/time_delta.py | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/detectmatelibrary/alert_aggregation/time_delta.py b/src/detectmatelibrary/alert_aggregation/time_delta.py
index 0393198c..52d027df 100644
--- a/src/detectmatelibrary/alert_aggregation/time_delta.py
+++ b/src/detectmatelibrary/alert_aggregation/time_delta.py
@@ -1,7 +1,7 @@
 from collections.abc import Callable
 from typing import Any
 
-from pydantic import NonNegativeFloat
+from pydantic import Field, NonNegativeFloat
 
 from detectmatelibrary.alert_aggregation.density_clustering import (
     DensityClusteringAggregation,
@@ -17,8 +17,13 @@ class TimeDeltaAggregationConfig(DensityClusteringAggregationConfig):
         delta (NonNegativeFloat): The time threshold below which two alerts are allocated to the same group.
     """
 
-    method_type: str = "time_delta_aggregator"
-    delta: NonNegativeFloat = 10.0
+    method_type: str = Field(
+        default="time_delta_aggregator",
+        description="The kind of aggregation method.",
+    )
+    delta: NonNegativeFloat = Field(
+        default=10.0, description="The threshold for the clustering."
+    )
 
 
 class TimeDeltaAggregation(DensityClusteringAggregation):

From 82c5ff20ec9ce30ec5498ffe0df88a0ac6e8d8f9 Mon Sep 17 00:00:00 2001
From: LukasKarner <lukas.karner@ait.ac.at>
Date: Wed, 28 Oct 2026 14:05:04 +0100
Subject: [PATCH 84/86] change density-clustering aggregator to be a
 base_aggregator

---
 docs/alert_aggregator.md                      | 30 ++++++-
 docs/alert_aggregators/density_cluster.md     | 89 -------------------
 .../alert_aggregators/density_cluster.py      | 63 -------------
 .../alert_aggregators/density_cluster.yaml    |  4 -
 docs/examples/config/update.py                | 13 ++-
 .../alert_aggregation/__init__.py             |  6 --
 .../alert_aggregation/time_delta.py           |  5 +-
 .../base_alert_aggregation/__init__.py        |  9 ++
 .../density_clustering.py                     | 26 ++++++
 .../test_density_clustering.py                |  2 +-
 10 files changed, 78 insertions(+), 169 deletions(-)
 delete mode 100644 docs/alert_aggregators/density_cluster.md
 delete mode 100644 docs/examples/alert_aggregators/density_cluster.py
 delete mode 100644 docs/examples/alert_aggregators/density_cluster.yaml
 create mode 100644 src/detectmatelibrary/base_alert_aggregation/__init__.py
 rename src/detectmatelibrary/{alert_aggregation => base_alert_aggregation}/density_clustering.py (91%)
 rename tests/{test_alert_aggregators => test_base_alert_aggregators}/test_density_clustering.py (98%)

diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index 54eb8f7a..5c3e4d65 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -71,8 +71,7 @@ The alert aggregator are numbered from simplest to most complex, and the sidebar
 |---|---|---|
 | 00 | [Basic Concat Aggregator](alert_aggregators/basic_concatenation.md) | Concat a set of alerts. |
 | 01 | [LogID Count Aggregator](alert_aggregators/logid_count.md) | Count the amount of times a logID is in alerts. |
-| 02 | [Density Cluster](alert_aggregators/density_cluster.md) | Base class for clustering alerts using a distance function. |
-| 03 | [Time Delta](alert_aggregators/time_delta.md) | Group alerts by their time difference. |
+| 02 | [Time Delta](alert_aggregators/time_delta.md) | Group alerts by their time difference. |
 
 
 ### Common parameters (all alert aggregators)
@@ -97,3 +96,30 @@ There are some parameters, that **every** alert aggregator inherits from `CoreAl
     | `train_buffer_max_records` | integer | 100000 | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
     | `train_buffer_dir` | string, null | None | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
 <!-- End common_arguments -->
+
+### Density Clustering Aggregator
+
+The alert aggregators that are based on density clustering ([Time Delta](alert_aggregators/time_delta.md)) accept also the following arguments:
+
+<!-- Start density_clustering_arguments -->
+??? note "Top level"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `method_type` | string | density_clustering_aggregator | shared | The kind of aggregation method. |
+    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
+
+???+ note "params"
+
+    | Field | Type | Default | Scope | Description |
+    |---|---|---|---|---|
+    | `buffer_size` | integer | 3 | specific | The size of the buffer. |
+    | `buffer_mode` | object | BufferMode.BATCH | specific | The mode of the buffer. |
+    | `delta` | number | 0.5 | specific | The threshold for the clustering. |
+    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
+    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
+    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
+    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
+    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
+    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+<!-- End density_clustering_arguments -->
diff --git a/docs/alert_aggregators/density_cluster.md b/docs/alert_aggregators/density_cluster.md
deleted file mode 100644
index 3efe5155..00000000
--- a/docs/alert_aggregators/density_cluster.md
+++ /dev/null
@@ -1,89 +0,0 @@
-# Density Cluster Alert Aggregation
-
-The density-clustering-based alert aggregator is a base class to implement alert aggregation by clustering alerts according a given distance function of alerts.
-
-## In/out
-
-|            | Schema                     | Description        |
-|------------|----------------------------|--------------------|
-| **Input**  | [DetectorSchema](../schemas.md)    | Alerts from detectors  |
-| **Output** | [AggregateSchema](../schemas.md) | Aggregated alerts    |
-
-## At a glance
-
-| Learns from training data | Auto-configuration | Needs `events` | Federation |
-|---|---|---|---|
-| ❌ | ❌ | ❌ | ❌ |
-
-## Description
-
-This class implements alert aggregation by density clustering.
-
-### Implementation Details
-
-Creating a custom density clustering aggregator requires the implementation of 2 methods in subclasses:
-
-1. One has to implement either the single_metric or the metric function.
-The single_metric function computes the distance between 2 alerts,
-while the metric function computes the distance matrix between a list of alerts.
-If both functions are implemented, the metric function will be used.
-
-2. The discard_alert_fn function must be implemented to determine which alerts
-should no longer be considered for aggregation.
-To this end, after each aggregation step, the discard_alert_fn
-function is called with the list of relevant alerts.
-It should return a list of booleans indicating which alerts should be discarded (True)
-and which should be kept (False).
-
-### Labelling of Alerts
-
-The group labels assigned to alerts are published in the output schema as a
-dictionary mapping alert IDs to group IDs in the "alertDetails" field.
-Every alert is assigned a group ID immediately after it is received,
-but as the aggregation progresses, groups may be merged.
-This is published in the output schema as a list of messages in the "alertDetails" field.
-Likewise, when a group is finished and no longer reachable from any active alert,
-this is also published in the output schema as a list of messages in the "alertDetails" field.
-
-## Example
-
-```python
---8<-- "docs/examples/alert_aggregators/density_cluster.py:example_1"
-```
-
-## Configuration file
-
-The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see [Configuration arguments](#configuration-arguments)).
-
-```yaml
---8<-- "docs/examples/alert_aggregators/density_cluster.yaml"
-```
-
-Load it with `yaml.safe_load` and pass the dict as `config=`, as in the example. The key under `alert_aggregators:` must match the aggregator's `name`.
-
-## Configuration arguments
-
-All parameters this alert aggregator accepts, grouped by the YAML block they go in. **Scope** tells whether a parameter is `specific` to this aggregator or `shared` with other alert aggregators.
-
-<!-- Start arguments -->
-??? note "Top level"
-
-    | Field | Type | Default | Scope | Description |
-    |---|---|---|---|---|
-    | `method_type` | string | density_clustering_aggregator | shared | The kind of aggregation method. |
-    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
-
-???+ note "params"
-
-    | Field | Type | Default | Scope | Description |
-    |---|---|---|---|---|
-    | `buffer_size` | integer | 3 | specific | The size of the buffer. |
-    | `buffer_mode` | object | BufferMode.BATCH | specific | The mode of the buffer. |
-    | `delta` | number | 0.5 | specific | The threshold for the clustering. |
-    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
-    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
-    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
-    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
-    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
-<!-- End arguments -->
diff --git a/docs/examples/alert_aggregators/density_cluster.py b/docs/examples/alert_aggregators/density_cluster.py
deleted file mode 100644
index 299accbb..00000000
--- a/docs/examples/alert_aggregators/density_cluster.py
+++ /dev/null
@@ -1,63 +0,0 @@
-# --8<-- [start:example_1]
-import yaml
-
-from detectmatelibrary.alert_aggregation.density_clustering import (
-    DensityClusteringAggregation,
-)
-from detectmatelibrary.schemas import AggregateSchema, DetectorSchema
-
-with open("docs/examples/alert_aggregators/density_cluster.yaml") as f:
-    config = yaml.safe_load(f)
-
-
-def make_alert(alert_id: str, score: float) -> DetectorSchema:
-    return DetectorSchema(
-        {
-            "detectorID": "detector",
-            "detectorType": "dummy",
-            "alertID": alert_id,
-            "detectedTimestamp": 0,
-            "logIDs": [f"log-{alert_id}"],
-            "score": score,
-            "logTimestamps": [0],
-            "description": "test alert",
-            "receivedTimestamp": 0,
-            "alertDetails": {},
-        }
-    )
-
-
-class ConcreteDensityClusteringAggregation(DensityClusteringAggregation):
-    def single_metric(
-        self,
-        alert1: DetectorSchema,
-        alert2: DetectorSchema
-    ) -> float:
-        return abs(alert1["score"] - alert2["score"])
-
-    def discard_alert_fn(self, alerts: list[DetectorSchema]) -> list[bool]:
-        return [False for alert in alerts]
-
-
-aggregator = ConcreteDensityClusteringAggregation(config)
-first = make_alert("a", 0.0)
-second = make_alert("b", 6.0)
-bridge = make_alert("c", 3.0)
-
-first_output = AggregateSchema()
-aggregator.aggregate_alerts(first, first_output)
-
-second_output = AggregateSchema()
-aggregator.aggregate_alerts(second, second_output)
-
-bridge_output = AggregateSchema()
-aggregator.aggregate_alerts(bridge, bridge_output)
-
-print(first_output["alertDetails"]["a"] == "0")  # True
-print(second_output["alertDetails"]["b"] == "1")  # True
-print(bridge_output["alertDetails"]["c"] == "0")  # True
-
-# group labels 0 and 1 are merged into a single group
-print(aggregator.active_groups[1] == {0, 1})  # True
-
-# --8<-- [end:example_1]
diff --git a/docs/examples/alert_aggregators/density_cluster.yaml b/docs/examples/alert_aggregators/density_cluster.yaml
deleted file mode 100644
index 6a5ed1bb..00000000
--- a/docs/examples/alert_aggregators/density_cluster.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-alert_aggregators:
-    DensityClusteringAggregator:
-        method_type: density_clustering_aggregator
-        delta: 4.0
diff --git a/docs/examples/config/update.py b/docs/examples/config/update.py
index b0288c78..cda4a5fa 100644
--- a/docs/examples/config/update.py
+++ b/docs/examples/config/update.py
@@ -27,8 +27,8 @@
 from detectmatelibrary.common.detector import CoreDetectorConfig
 from detectmatelibrary.common.parser import CoreParserConfig
 from detectmatelibrary.common.alert_aggregator import CoreAlertAggregatorConfig
+from detectmatelibrary.base_alert_aggregation.density_clustering import DensityClusteringAggregationConfig
 from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregationConfig
-from detectmatelibrary.alert_aggregation.density_clustering import DensityClusteringAggregationConfig
 from detectmatelibrary.alert_aggregation.time_delta import TimeDeltaAggregationConfig
 from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegationConfig
 from detectmatelibrary.base_detectors import TrackerDetectorConfig
@@ -203,6 +203,17 @@ def update_shared_args_aggregation(doc_path: str) -> None:
             end_cmd="<!-- End common_arguments -->\n",
             add=get_arguments(CoreAlertAggregatorConfig().get_docs(), with_scope=False),
         )
+        docs = append_docs(
+            docs=docs,
+            start_cmd="<!-- Start density_clustering_arguments -->\n",
+            end_cmd="<!-- End density_clustering_arguments -->\n",
+            add=get_arguments(
+                _family_rows(
+                    DensityClusteringAggregationConfig(), base=CoreAlertAggregatorConfig
+                ),
+                with_scope=False,
+            ),
+        )
         with open(doc_path, "w") as f:
             f.writelines(docs)
     except Exception as e:
diff --git a/src/detectmatelibrary/alert_aggregation/__init__.py b/src/detectmatelibrary/alert_aggregation/__init__.py
index 2bede321..c292591e 100644
--- a/src/detectmatelibrary/alert_aggregation/__init__.py
+++ b/src/detectmatelibrary/alert_aggregation/__init__.py
@@ -1,16 +1,10 @@
 from .basic_concat import BasicConcatAggregation, BasicConcatAggregationConfig
-from .density_clustering import (
-    DensityClusteringAggregation,
-    DensityClusteringAggregationConfig,
-)
 from .logid_count import LogIDCountAggegation, LogIDCountAggegationConfig
 from .time_delta import TimeDeltaAggregation, TimeDeltaAggregationConfig
 
 __all__ = [
     "BasicConcatAggregation",
     "BasicConcatAggregationConfig",
-    "DensityClusteringAggregation",
-    "DensityClusteringAggregationConfig",
     "TimeDeltaAggregation",
     "TimeDeltaAggregationConfig",
     "LogIDCountAggegation",
diff --git a/src/detectmatelibrary/alert_aggregation/time_delta.py b/src/detectmatelibrary/alert_aggregation/time_delta.py
index 52d027df..a5b0d5ba 100644
--- a/src/detectmatelibrary/alert_aggregation/time_delta.py
+++ b/src/detectmatelibrary/alert_aggregation/time_delta.py
@@ -3,7 +3,7 @@
 
 from pydantic import Field, NonNegativeFloat
 
-from detectmatelibrary.alert_aggregation.density_clustering import (
+from detectmatelibrary.base_alert_aggregation.density_clustering import (
     DensityClusteringAggregation,
     DensityClusteringAggregationConfig,
 )
@@ -28,13 +28,12 @@ class TimeDeltaAggregationConfig(DensityClusteringAggregationConfig):
 
 class TimeDeltaAggregation(DensityClusteringAggregation):
     """This class implements alert aggregation by the time-delta method introduced by
-    [Landauer et al.](https://dl.acm.org/doi/pdf/10.1145/3510581).
+    [Landauer et al.](https://doi.org/10.1145/3510581).
     Two alerts will be assigned to the same group if the time difference
     between them is below a certain threshold delta.
     The time difference is computed based on the timestamps of the last logs associated
     with each alert as these determine the earliest time at which the alert was detected.
     Important: It is assumed that the alerts arrive in order of their timestamps!
-
     """
 
     def __init__(
diff --git a/src/detectmatelibrary/base_alert_aggregation/__init__.py b/src/detectmatelibrary/base_alert_aggregation/__init__.py
new file mode 100644
index 00000000..b061cade
--- /dev/null
+++ b/src/detectmatelibrary/base_alert_aggregation/__init__.py
@@ -0,0 +1,9 @@
+from .density_clustering import (
+    DensityClusteringAggregation,
+    DensityClusteringAggregationConfig,
+)
+
+__all__ = [
+    "DensityClusteringAggregation",
+    "DensityClusteringAggregationConfig",
+]
diff --git a/src/detectmatelibrary/alert_aggregation/density_clustering.py b/src/detectmatelibrary/base_alert_aggregation/density_clustering.py
similarity index 91%
rename from src/detectmatelibrary/alert_aggregation/density_clustering.py
rename to src/detectmatelibrary/base_alert_aggregation/density_clustering.py
index 0ea29405..b41a587a 100644
--- a/src/detectmatelibrary/alert_aggregation/density_clustering.py
+++ b/src/detectmatelibrary/base_alert_aggregation/density_clustering.py
@@ -42,6 +42,32 @@ class DensityClusteringAggregation(CoreAlertAggregator):
         alert_id_to_group_id (dict[str, int | None]): A mapping from alert IDs to group IDs.
         active_groups (dict[int, set[int]]): A mapping from group IDs to sets of merged group IDs.
         message_buffer (list[str]): A buffer for messages to be published in the output schema.
+
+    # Implementation Details
+
+    Creating a custom density clustering aggregator requires the implementation of 2 methods in subclasses:
+
+    1. One has to implement either the single_metric or the metric function.
+    The single_metric function computes the distance between 2 alerts,
+    while the metric function computes the distance matrix between a list of alerts.
+    If both functions are implemented, the metric function will be used.
+
+    2. The discard_alert_fn function must be implemented to determine which alerts
+    should no longer be considered for aggregation.
+    To this end, after each aggregation step, the discard_alert_fn
+    function is called with the list of relevant alerts.
+    It should return a list of booleans indicating which alerts should be discarded (True)
+    and which should be kept (False).
+
+    # Labelling of Alerts
+
+    The group labels assigned to alerts are published in the output schema as a
+    dictionary mapping alert IDs to group IDs in the "alertDetails" field.
+    Every alert is assigned a group ID immediately after it is received,
+    but as the aggregation progresses, groups may be merged.
+    This is published in the output schema as a list of messages in the "alertDetails" field.
+    Likewise, when a group is finished and no longer reachable from any active alert,
+    this is also published in the output schema as a list of messages in the "alertDetails" field.
     """
 
     def __init__(
diff --git a/tests/test_alert_aggregators/test_density_clustering.py b/tests/test_base_alert_aggregators/test_density_clustering.py
similarity index 98%
rename from tests/test_alert_aggregators/test_density_clustering.py
rename to tests/test_base_alert_aggregators/test_density_clustering.py
index 7907ad37..d2ecd737 100644
--- a/tests/test_alert_aggregators/test_density_clustering.py
+++ b/tests/test_base_alert_aggregators/test_density_clustering.py
@@ -1,4 +1,4 @@
-from detectmatelibrary.alert_aggregation.density_clustering import (
+from detectmatelibrary.base_alert_aggregation.density_clustering import (
     DensityClusteringAggregation,
     DensityClusteringAggregationConfig,
 )

From 8c4ba12e539810434e709d8aaa4f5b382bb80a56 Mon Sep 17 00:00:00 2001
From: LukasKarner <lukas.karner@ait.ac.at>
Date: Wed, 28 Oct 2026 14:35:22 +0100
Subject: [PATCH 85/86] fix tests

---
 docs/examples/config/update.py                        | 5 -----
 src/detectmatelibrary/alert_aggregation/time_delta.py | 7 ++++---
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/docs/examples/config/update.py b/docs/examples/config/update.py
index cda4a5fa..4abb5b06 100644
--- a/docs/examples/config/update.py
+++ b/docs/examples/config/update.py
@@ -291,11 +291,6 @@ def update_shared_args_aggregation(doc_path: str) -> None:
         CoreAlertAggregatorConfig,
         "docs/alert_aggregators/logid_count.md"
     ),
-    (
-      DensityClusteringAggregationConfig(),
-      CoreAlertAggregatorConfig,
-      "docs/alert_aggregators/density_cluster.md"
-    ),
     (
         TimeDeltaAggregationConfig(),
         CoreAlertAggregatorConfig,
diff --git a/src/detectmatelibrary/alert_aggregation/time_delta.py b/src/detectmatelibrary/alert_aggregation/time_delta.py
index a5b0d5ba..7c1c7b9c 100644
--- a/src/detectmatelibrary/alert_aggregation/time_delta.py
+++ b/src/detectmatelibrary/alert_aggregation/time_delta.py
@@ -55,6 +55,7 @@ def __init__(
             float(alert["logTimestamps"][-1])
         )
         self.description = "Alert aggregation by the time-delta method."
+        self.last_timestamp: float = 0.0
 
     def aggregate_alerts(
         self, input_: list[DetectorSchema] | DetectorSchema, output_: AggregateSchema
@@ -73,10 +74,10 @@ def aggregate_alerts(
         if not isinstance(input_, list):
             input_ = [input_]
 
-        if self.timestamp_extraction_fn(input_[0]) < self.timestamp_extraction_fn(
-            self.relevant_alerts[-1]
-        ):
+        if self.timestamp_extraction_fn(input_[0]) < self.last_timestamp:
             raise ValueError("Alerts must be aggregated in order of their timestamps!")
+        else:
+            self.last_timestamp = self.timestamp_extraction_fn(input_[-1])
 
         return super().aggregate_alerts(input_, output_)
 

From f6a4fcaad64efd46171c10ec0af6d5db55efc95a Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 15:27:52 +0100
Subject: [PATCH 86/86] Automated documentation update

---
 docs/alert_aggregator.md             | 23 +++++------------------
 docs/alert_aggregators/time_delta.md |  4 ++--
 2 files changed, 7 insertions(+), 20 deletions(-)

diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index 5c3e4d65..086eaf72 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -102,24 +102,11 @@ There are some parameters, that **every** alert aggregator inherits from `CoreAl
 The alert aggregators that are based on density clustering ([Time Delta](alert_aggregators/time_delta.md)) accept also the following arguments:
 
 <!-- Start density_clustering_arguments -->
-??? note "Top level"
-
-    | Field | Type | Default | Scope | Description |
-    |---|---|---|---|---|
-    | `method_type` | string | density_clustering_aggregator | shared | The kind of aggregation method. |
-    | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
-
 ???+ note "params"
 
-    | Field | Type | Default | Scope | Description |
-    |---|---|---|---|---|
-    | `buffer_size` | integer | 3 | specific | The size of the buffer. |
-    | `buffer_mode` | object | BufferMode.BATCH | specific | The mode of the buffer. |
-    | `delta` | number | 0.5 | specific | The threshold for the clustering. |
-    | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
-    | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
-    | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |
-    | `use_config_data_as_training` | boolean | True | shared | Combine the configured data in the training process if True. |
-    | `train_buffer_max_records` | integer | 100000 | shared | Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records. |
-    | `train_buffer_dir` | string, null | None | shared | Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind. |
+    | Field | Type | Default | Description |
+    |---|---|---|---|
+    | `buffer_size` | integer | 3 | The size of the buffer. |
+    | `buffer_mode` | object | BufferMode.BATCH | The mode of the buffer. |
+    | `delta` | number | 0.5 | The threshold for the clustering. |
 <!-- End density_clustering_arguments -->
diff --git a/docs/alert_aggregators/time_delta.md b/docs/alert_aggregators/time_delta.md
index 023e83b1..f65fba67 100644
--- a/docs/alert_aggregators/time_delta.md
+++ b/docs/alert_aggregators/time_delta.md
@@ -48,7 +48,7 @@ All parameters this alert aggregator accepts, grouped by the YAML block they go
 
     | Field | Type | Default | Scope | Description |
     |---|---|---|---|---|
-    | `method_type` | string | density_clustering_aggregator | shared | The kind of aggregation method. |
+    | `method_type` | string | time_delta_aggregator | shared | The kind of aggregation method. |
     | `auto_config` | boolean | False | shared | Runs the configuration step before the training process. |
 
 ???+ note "params"
@@ -57,7 +57,7 @@ All parameters this alert aggregator accepts, grouped by the YAML block they go
     |---|---|---|---|---|
     | `buffer_size` | integer | 3 | specific | The size of the buffer. |
     | `buffer_mode` | object | BufferMode.BATCH | specific | The mode of the buffer. |
-    | `delta` | number | 0.5 | specific | The threshold for the clustering. |
+    | `delta` | number | 10.0 | specific | The threshold for the clustering. |
     | `start_id` | integer | 10 | shared | Number used to start the unique ID generator. |
     | `data_use_training` | integer, null | None | shared | Number of logs used for training. None skips training. |
     | `data_use_configure` | integer, null | None | shared | Number of logs used for the configuration step. None skips it. |