PHPackages neutrome-labs/magento2-module-eve - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Logging & Monitoring](/categories/logging) 4. / 5. neutrome-labs/magento2-module-eve ActiveMagento2-module[Logging & Monitoring](/categories/logging) neutrome-labs/magento2-module-eve ================================= Eve Fraud Detection integration for Magento 2 - Event & log collectors with ML-powered anomaly detection 010PHP Since Jan 14Pushed 5mo agoCompare [ Source](https://github.com/neutrome-labs/magento2-module-eve)[ Packagist](https://packagist.org/packages/neutrome-labs/magento2-module-eve)[ RSS](/packages/neutrome-labs-magento2-module-eve/feed)WikiDiscussions main Synced today READMEChangelogDependenciesVersions (1)Used By (0) Neutrome Eve - Magento 2 Fraud Detection Module =============================================== [](#neutrome-eve---magento-2-fraud-detection-module) A Magento 2 module that integrates with the [Eve fraud detection system](https://github.com/neutrome-labs/eve). It intercepts Magento events and system logs, sending them to Eve for ML-powered anomaly detection. Features -------- [](#features) - **Event Collector**: Plugin on `Magento\Framework\Event\Manager` captures Magento events before observers run - **Logs Collector**: Plugin on Logger captures error/warning logs for anomaly detection - **Customer Group Scores**: Configure `input_score` per customer group for flexible training/production modes - **RSS Feed Polling**: Polls Eve feed for `bad_user` notifications (no webhooks needed) - **Auto-Block**: Automatically blocks customers flagged by Eve - **Configurable Collectors**: Enable/disable events and logs collectors independently Installation ------------ [](#installation) ### Option 1: Composer (Recommended) [](#option-1-composer-recommended) ``` composer require neutrome-labs/module-eve bin/magento module:enable NeutromeLabs_Eve bin/magento setup:upgrade bin/magento setup:di:compile bin/magento cache:flush ``` ### Option 2: Manual Installation [](#option-2-manual-installation) ``` # Copy module files cp -r app/code/NeutromeLabs /path/to/magento/app/code/ # Enable module bin/magento module:enable NeutromeLabs_Eve # Run setup bin/magento setup:upgrade bin/magento setup:di:compile bin/magento cache:flush ``` Configuration ------------- [](#configuration) Navigate to **Stores → Configuration → Neutrome → Eve Fraud Detection** ### General Settings [](#general-settings) SettingDescription**Enable**Turn the module on/off### Data Collectors [](#data-collectors) SettingDescription**Events Collector**Collect Magento events (orders, cart, customer actions)**Logs Collector**Collect system logs (errors, warnings) for anomaly detection**Customer Group Scores**Table to set `input_score` per customer group### Customer Group Scores [](#customer-group-scores) Configure how events from each customer group are scored: Input ScoreMeaningUse Case**Empty**ML scoring modeProduction - let ML score events**0.0**Good/normalTraining baseline - known good customers**1.0**Bad/anomalyFlagged groups - known bad actors**0.0-1.0**Custom weightPartial trust levelsExample configuration: Customer GroupInput ScoreDescriptionGeneral*(empty)*ML scores these eventsVIP0.0Training baseline (trusted)Suspicious1.0Flag as anomaliesNOT LOGGED IN*(empty)*ML scores guest events### API Configuration [](#api-configuration) SettingDescription**Vector Endpoint**Vector ingest URL (e.g., `http://eve-host:8080/ingest`)**GraphQL Endpoint**Hasura GraphQL URL for feed queries**Hasura Secret**Admin secret for GraphQL authentication**Series Name**Unique identifier for this Magento instance**Timeout**API request timeout in seconds### Feed Configuration [](#feed-configuration) SettingDescription**Enable Polling**Poll Eve feed via cron (every 5 minutes)**Auto-Block**Automatically block customers on `bad_user` feed entries**Block Threshold**Minimum score (0.0-1.0) to trigger blocking**Notify Admin**Send admin notification when blockingHow It Works ------------ [](#how-it-works) ### Event Collection Flow [](#event-collection-flow) ``` ┌─────────────────────────────────────────────────────────────────┐ │ MAGENTO │ │ ┌─────────────┐ ┌──────────────────┐ ┌───────────────┐ │ │ │ Any Module │───▶│ Event Manager │───▶│ Observers │ │ │ │ dispatch() │ │ beforeDispatch() │ │ (normal flow) │ │ │ └─────────────┘ └────────┬─────────┘ └───────────────┘ │ │ │ │ │ ┌─────────▼─────────┐ │ │ │ EventManagerPlugin│ │ │ │ (intercepts ALL │ │ │ │ events BEFORE │ │ │ │ observers) │ │ │ └─────────┬─────────┘ │ └──────────────────────────────┼──────────────────────────────────┘ │ ┌──────────▼──────────┐ │ Eve Vector │ │ POST /ingest │ │ { │ │ series_name, │ │ user_id, │ │ data_payload, │ │ input_score │ ← Based on customer group │ } │ └─────────────────────┘ ``` ### Logs Collection Flow [](#logs-collection-flow) ``` ┌─────────────────────────────────────────────────────────────────┐ │ MAGENTO │ │ ┌─────────────┐ ┌──────────────────┐ ┌───────────────┐ │ │ │ Any Code │───▶│ Logger │───▶│ Log Handlers │ │ │ │ ->error() │ │ (Monolog) │ │ (file, etc) │ │ │ └─────────────┘ └────────┬─────────┘ └───────────────┘ │ │ │ │ │ ┌─────────▼─────────┐ │ │ │ LoggerPlugin │ │ │ │ (intercepts │ │ │ │ error/warning │ │ │ │ level logs) │ │ │ └─────────┬─────────┘ │ └──────────────────────────────┼──────────────────────────────────┘ │ ┌──────────▼──────────┐ │ Eve Vector │ │ event_name: │ │ system_log_error │ │ system_log_warning│ └─────────────────────┘ ``` ### RSS Feed Polling (Incoming) [](#rss-feed-polling-incoming) ``` ┌─────────────────┐ ┌─────────────────┐ │ Eve Feed Table │◀────────│ Magento Cron │ │ feed_entries │ poll │ PollFeed │ │ │ GraphQL │ (every 5 min) │ └─────────────────┘ └────────┬────────┘ │ ┌────────▼────────┐ │ FeedProcessor │ │ 1. Query feed │ │ 2. Check score │ │ 3. Block user │ └─────────────────┘ ``` ### Feed Entry Types [](#feed-entry-types) Entry TypeHandler Action`bad_user`Block customer if score ≥ threshold`bad_event`Log event details`training_started`Log info`training_completed`Log info`training_failed`Log warningEvent Payload Example --------------------- [](#event-payload-example) ``` { "series_name": "magento2_store", "user_id": "customer_123", "data_payload": { "event_name": "sales_order_place_after", "event_type": "event", "payload": { "order": { "__class": "Magento\\Sales\\Model\\Order", "data": { "entity_id": "1234", "increment_id": "100000123", "grand_total": 99.99, "customer_email": "customer@example.com" } } }, "store_id": 1 }, "happened_at": "2026-01-11T10:30:00+00:00", "input_score": 0.0 } ``` Log Event Payload Example ------------------------- [](#log-event-payload-example) ``` { "series_name": "magento2_store", "user_id": "customer_123", "data_payload": { "event_name": "system_log_error", "event_type": "log", "payload": { "log_level": "error", "message": "Payment gateway timeout after 30 seconds", "context": { "order_id": "1234", "gateway": "stripe" } }, "store_id": 1 }, "happened_at": "2026-01-11T10:30:00+00:00" } ``` Tracked Events -------------- [](#tracked-events) The plugin tracks these event patterns by default: PatternExamples`customer_*`Login, logout, registration, address changes`sales_order_*`Order placement, status changes, refunds`checkout_cart_*`Add to cart, update qty, remove item`catalog_product_*`Product views`wishlist_*`Wishlist additions, removals`review_*`Review submissionsInternal/noisy events (layout, blocks, cache, model\_load) are automatically filtered. Feed Polling ------------ [](#feed-polling) The module polls Eve's RSS feed via cron (every 5 minutes) or CLI: ``` # Poll feed manually bin/magento eve:feed:poll --limit=50 ``` ### Feed Query Example [](#feed-query-example) The module queries Eve via GraphQL: ``` query GetFeedEntries($series: String!, $since: timestamptz!) { feed_entries( where: { series_name: { _eq: $series } published_at: { _gt: $since } } order_by: { published_at: asc } limit: 100 ) { id entry_type title content published_at } } ``` Files Structure --------------- [](#files-structure) ``` app/code/NeutromeLabs/Eve/ ├── etc/ │ ├── module.xml # Module declaration │ ├── di.xml # Dependency injection & plugin config │ ├── config.xml # Default configuration values │ ├── acl.xml # Admin ACL resources │ ├── crontab.xml # Cron job definitions │ └── adminhtml/ │ └── system.xml # Admin configuration UI ├── Block/ │ └── Adminhtml/Form/Field/ │ ├── CustomerGroupScores.php # Dynamic rows field │ └── CustomerGroupColumn.php # Customer group dropdown ├── Model/ │ ├── Config.php # Configuration provider │ └── Config/Backend/ │ └── CustomerGroupScores.php # Backend model for scores table ├── Plugin/ │ ├── EventManagerPlugin.php # Event interceptor │ └── LoggerPlugin.php # Logger interceptor ├── Service/ │ ├── ApiClient.php # Eve API client (sends to Vector) │ ├── FeedProcessor.php # RSS feed processor │ └── CustomerBlockService.php # Customer blocking logic ├── Console/Command/ │ └── PollFeedCommand.php # CLI command for feed polling ├── Cron/ │ └── PollFeed.php # Cron job for feed polling ├── registration.php # Module registration └── composer.json # Composer package definition ``` Troubleshooting --------------- [](#troubleshooting) ### Events Not Sending [](#events-not-sending) 1. Check if module is enabled: `bin/magento module:status NeutromeLabs_Eve` 2. Verify Events Collector is enabled in config 3. Verify API endpoint is reachable from Magento server 4. Check Magento logs: `var/log/neutrome_eve.log` ### Logs Not Being Collected [](#logs-not-being-collected) 1. Verify Logs Collector is enabled in config 2. Only error, warning, critical, alert, emergency levels are tracked 3. Internal Eve logs are automatically skipped to prevent recursion ### Customer Not Being Blocked [](#customer-not-being-blocked) 1. Verify Feed Polling is enabled in config 2. Verify Auto-Block is enabled in config 3. Check Block Threshold - score must be ≥ threshold 4. Ensure customer exists in Magento with matching `user_id` 5. Check feed poll logs: `bin/magento eve:feed:poll -v` ### Customer Group Scores Not Working [](#customer-group-scores-not-working) 1. Ensure you saved the config after adding rows 2. Customer group ID 0 = "NOT LOGGED IN" (guests) 3. Empty input\_score means ML scoring mode (no score sent) License ------- [](#license) MIT ### Health Score 18 — LowBetter than 8% of packages Maintenance48 Moderate activity, may be stable Popularity5 Limited adoption so far Community6 Small or concentrated contributor base Maturity13 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Community Maintainers ![](https://avatars.githubusercontent.com/u/83121880?v=4)[Roman](/maintainers/theuargb)[@theuargb](https://github.com/theuargb) --- Top Contributors [![theuargb](https://avatars.githubusercontent.com/u/83121880?v=4)](https://github.com/theuargb "theuargb (1 commits)") ### Embed Badge ![Health badge](/badges/neutrome-labs-magento2-module-eve/health.svg) ``` [![Health](https://phpackages.com/badges/neutrome-labs-magento2-module-eve/health.svg)](https://phpackages.com/packages/neutrome-labs-magento2-module-eve) ``` ### Alternatives [psr/log Common interface for logging libraries 10.4k1.2B11.5k](/packages/psr-log)[open-telemetry/api API for OpenTelemetry PHP. 1941.5M276](/packages/open-telemetry-api)[open-telemetry/sdk SDK for OpenTelemetry PHP. 2328.5M343](/packages/open-telemetry-sdk) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)