Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

Log field, metric, action and event names now say what they count
and, for timings, the unit. Package internal/waf is internal/coreruleset.

Model: opus-5-5

internal/alerts/alerts.go

@@ -44,10 +44,10 @@ const (
 	// EventAnomaly is a count of requests or bytes over an anomaly
 	// threshold.
 	EventAnomaly = "anomaly"
-	// EventWAFBlock is a request the Core Rule Set scored at or over
+	// EventCoreRuleSetMatch is a request the Core Rule Set scored at or over
 	// SWW_WAF_ANOMALY_THRESHOLD, refused in block mode, let through in
 	// detect mode.
-	EventWAFBlock = "waf_block"
+	EventCoreRuleSetMatch = "core_rule_set_match"
 	// EventReputationHit is a request whose client a blocklist, the
 	// CrowdSec decision list or a DNSBL zone lists, or whose AbuseIPDB score
 	// is a hit.
@@ -72,7 +72,7 @@ const (
 // default.
 func Events() []string {
 	return []string{
-		EventBan, EventPermanentBan, EventWAFBlock, EventAnomaly,
+		EventBan, EventPermanentBan, EventCoreRuleSetMatch, EventAnomaly,
 		EventReputationHit, EventSourceFailure, EventFileError,
 	}
 }
@@ -871,7 +871,7 @@ func ntfyPriority(event string) string {
 		return "high"
 	case EventReputationHit:
 		return "low"
-	default: // ban, waf_block and summary
+	default: // ban, core_rule_set_match and summary
 		return "default"
 	}
 }
@@ -882,7 +882,7 @@ func ntfyTag(event string) string {
 	switch event {
 	case EventBan, EventPermanentBan:
 		return "no_entry"
-	case EventWAFBlock:
+	case EventCoreRuleSetMatch:
 		return "shield"
 	case EventAnomaly:
 		return "chart_with_upwards_trend"