enum Action 
{ 
ADD = 1; 
DELETE = 2; 
UPDATE = 3; 
}

message MacAddress {
required bytes addr = 1;
}

message RapidsStreamingEvent 
{
required string cust_id = 1; 
repeated RogueEvent rogue = 2; 
repeated WIDSEvent idsEvent = 3; 
}

message RogueEvent 
{
required MacAddress rogue_id = 1; 
required uint32 classification = 2; 
optional string first_seen = 3; 
optional string last_seen = 4; 
optional string rogue_name = 5; 
optional string ssid = 6; 
optional string lan_mac = 7; 
optional string first_det_device = 8; 
optional string last_det_device = 9; 
optional uint32 encryption = 10; 
optional string port = 11; 
optional string containment_status = 12; 
optional string mac_vendor = 13; 
}

message WIDSEvent 
{
required string device_id = 1; 
required uint32 event_number = 2; 
optional string event_type = 3; 
optional string attack_type = 4; 
optional string description = 5; 
optional string detected_ap = 6; 
optional MacAddress mac_addr = 7;
optional string radio_band = 8; 
optional string level = 9; 
}

cust_id: "d9f16c95f70c40a59155266f0180b587"
rogue 
{
  rogue_id {
    addr: "\270\'\353\311\225\220"
  }
  classification: 3
  first_seen: "2021-04-11T16:10:37.136Z"
  last_seen: "2021-04-13T13:41:37.873Z"
  rogue_name: "Raspberry Pi-C9:95:94"
  ssid: "CX-RoguePi9"
  first_det_device: "CNKKKD532C"
  last_det_device: "CNKKKD532D"
  encryption: 3
  containment_status: "Un-contained"
  mac_vendor: "Raspberry Pi Foundation"
}

cust_id: "d9f16c95f70c40a59155266f0180b587"
idsEvent 
{
  device_id: "CNJCJ0T2WS"
  event_number: 1188
  event_type: "infrastructuredetection"
  attack_type: "detect_malformed_frame_wrong_channel"
  description: "An AP detected that the Access Point with MAC 
  A8:BD:27:D1:B4:30 and BSSID A8:BD:27:D1:B4:30 has sent a beacon 
  for SSID APACSouth_test This beacon advertizes channel 116 but 
  was received on channel."
  detected_ap: "7c:57:3c:c9:07:9a"
  mac_addr {
    addr: "\250\275\'\321\2640"
  }
  radio_band: "1"
  level: "critical"
}