<?php
namespace App\Models;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Relations\BelongsTo;

/**
 * Single security event: CSF block, lfd brute-force, ModSecurity hit.
 * Aggregated into the firewall events page; spikes generate incidents.
 */
class FirewallEvent extends Model
{
    use HasFactory;
    public $timestamps = false;
    protected $fillable = [
        'server_id', 'event_at', 'source', 'event_type',
        'ip', 'country', 'target', 'username',
        'action', 'attempts', 'raw_message', 'details',
    ];
    protected $casts = [
        'event_at' => 'datetime',
        'details' => 'array',
    ];
    public function server(): BelongsTo { return $this->belongsTo(Server::class); }
}
