v0.18.1

What's New

Generic webhook adapter transforms

Per-field transforms applied after JSONPath extraction in the generic webhook adapter (ADR 020). Operators can now reshape detector payloads without writing a shim or pre-processing pipeline.

Three transform variants:

• unit_conversion — multiply an extracted numeric value (bps, pps, confidence) by a constant. Useful for Mbps→bps, kpps→pps, %→ratio.
• regex_extract — pull a capture group out of an extracted vector string. Maps free-form alert descriptions ("Detected: udp_flood at 250Gbps") onto prefixd vector names.
• computed — replace a numeric field's value with scale * Π(extract(path_i)). Lets operators derive fields not directly present in the payload (e.g. bps = packets × avg_size × 8).

Example:

transforms:
  bps:
    type: unit_conversion
    multiplier: 1000000        # detector reports Mbps
  vector:
    type: regex_extract
    pattern: "(\\w+)_flood"
    group: 0
  pps:
    type: computed
    paths: ["$.metrics.packets", "$.metrics.duration_inv"]
    scale: 1.0

All transforms are validated at config load (POST /v1/config/reload) — invalid regex, NaN multipliers, type mismatches, and unsupported field names are rejected immediately. Misconfigurations never silently produce zero events at request time.

Tests

17 new tests (14 unit + 3 end-to-end integration). Full suite: 250 unit + 133 integration + 16 postgres + 87 frontend all pass.

Migration

None required. transforms defaults to an empty map; webhook adapters without it behave exactly as before.

Dependencies

• New: regex = "1"

Full Changelog

v0.18.0...v0.18.1