Protocol Terms Glossary

Terms related to SCHEMABOUND’s communication protocols, serialization formats, and external integrations. These terms are relevant when implementing gRPC clients, parsing audit event payloads, or integrating with observability platforms.

gRPC

Google’s remote procedure call framework used as the primary transport protocol for SCHEMABOUND’s control plane and query execution APIs. The runtime listens on port 50051 by default; all service methods (SubmitPlan, ExecuteStep, GetSchema) are defined as protobuf message types in schemabound-proto. gRPC provides built-in streaming, compression, and mTLS authentication — the same transport used for both client-to-server queries and server-to-SIEM audit exports.

See also: protobuf, Execute Step Request

NDJSON (Newline-Delimited JSON)

The serialization format used by SCHEMABOUND’s audit event stream and MultiTransport Exporter. Each line of an NDJSON file or HTTP POST body contains a single complete JSON object representing one event; lines are delimited by \n. This format is streaming-friendly, parseable line-by-line without loading the full document into memory, and widely supported by SIEM platforms (Splunk, Elastic, Datadog) for log ingestion.

See also: OCSF Format, MultiTransport Exporter

OCSF (Open Cybersecurity Schema Framework)

An open standard for cybersecurity event data modeling maintained by the OCSF community. SCHEMABOUND exports audit events in OCSF v1.1 format, mapping internal QueryExecuted and LlmToolCallAuditRecorded events to OCSF Class 6003 (Database Activity). The framework provides standardized fields for timestamp, actor identity, target resource, metadata trace IDs, and custom extensions — ensuring SIEM platforms can correlate SCHEMABOUND events with other security telemetry without custom parsing.

OCSF Class 6003

The specific OCSF schema class for “Database Activity” events. SCHEMABOUND maps every QueryExecuted and LlmToolCallAuditRecorded event to this class, populating standardized fields: activity_id (query action), database_name, table_name, actor_type (user/service), severity (informational/warning/critical based on AAU weight), and metadata (W3C traceparent headers for distributed tracing correlation).

protobuf

Protocol Buffers, Google’s IDL (Interface Definition Language) and serialization format. SCHEMABOUND defines all gRPC service contracts as .proto files in the schemabound-proto crate: ControlPlaneService, QueryService, SchemaService. Protobuf provides schema versioning via field numbers, binary encoding for efficient wire transfer, and language-specific code generation (Rust, Python, TypeScript, Go) via protoc plugins.

See also: gRPC, Execute Step Request

W3C Traceparent Header

The W3C distributed tracing standard header (traceparent) that identifies a request’s position within a larger trace across multiple services. SCHEMABOUND propagates traceparent through every audit event envelope emitted by the EventBus; when present, values appear as metadata.trace_uid and metadata.span_uid in OCSF records. Upstream instrumentation (OpenTelemetry, Jaeger) can inject these headers to join SCHEMABOUND events into existing observability platforms.