add event type & logging interceptor for unknown hosts (#157)

* add event type & logging interceptor for unknown hosts

* update logging

* add break

* rename host_observation interceptor to audit_logger

* restore MITMDecider and make AuditLogger telemetry skip MITM on CONNECT

internal/eventlog/eventlog.go

@@ -24,6 +24,7 @@ const (
 	EventTypeInstallStarted        EventType = "install_started"
 	EventTypeDependencyResolved    EventType = "dependency_resolved"
 	EventTypeInstallInsecureBypass EventType = "install_insecure_bypass"
+	EventTypeProxyHostObserved     EventType = "proxy_host_observed"
 	EventTypeError                 EventType = "error"
 )
 
@@ -391,6 +392,27 @@ func LogInstallStarted(packageManager string, args []string) {
 	}
 }
 
+// LogProxyHostObserved logs when proxy mode observes outbound traffic to a host.
+func LogProxyHostObserved(hostname, method, reason string, details map[string]interface{}) {
+	event := Event{
+		EventType: EventTypeProxyHostObserved,
+		Message:   fmt.Sprintf("Proxy observed outbound host: %s", hostname),
+		Details: map[string]interface{}{
+			"hostname": hostname,
+			"method":   method,
+			"reason":   reason,
+		},
+	}
+
+	for k, v := range details {
+		event.Details[k] = v
+	}
+
+	if err := LogEvent(event); err != nil {
+		log.Warnf("failed to log proxy host observed event: %s", err)
+	}
+}
+
 // LogError logs an error event
 func LogError(message string, err error) {
 	event := Event{