diff --git a/docs/advanced/overall_architecture.md b/docs/advanced/overall_architecture.md
new file mode 100644
index 00000000..44320fff
--- /dev/null
+++ b/docs/advanced/overall_architecture.md
@@ -0,0 +1,42 @@
+# Overall architecture
+
+## How things work and where data goes
+
+This document describes the high-level design of the DetectMateLibrary, how components interact, the data contracts they use, and guidance for deploying and extending the system. The library is built around small, composable components that operate on streaming log data and exchange strongly-typed Schema objects.
+
+Key goals:
+
+- Clear separation of concerns (reading, parsing, detection, output).
+- Stream-friendly processing with minimal buffering.
+- Well-defined schema contracts so components can be composed or run as microservices.
+- Easy extensibility: add new readers, parsers or detectors by subclassing core base classes.
+
+## Components flow
+
+The pipeline is strictly directional:
+
+- Parser: consumes raw logs and produces parsed log objects (structured fields, timestamps, variables).
+- Detector: consumes parsed logs and generates alerts/findings when rules or models match anomalous behavior.
+- Alert Aggregation: consumes alerts and aggregates them.
+
+Each arrow represents a stream of Schema objects. Components are designed to run in the same process for lightweight setups or as separate services for scalable deployments.
+
+![Components flow](../img/diagrams_structure.png)
+
+## Components architecture
+
+All components inherit from a `CoreComponent` class. This class provides all the essential functionality required for DetectMate to operate (see UML diagram below). Every `Detector` must inherit from `CoreDetector`, every `AlertAggregator` must inherit from `CoreAlertAggregation` and every `Parser` must inherit from `CoreParser` to ensure compatibility with DetectMate.
+
+Each component's arguments must be stored in its corresponding configuration class. These config classes follow the same design pattern as their components and must inherit from `CoreConfig`.
+
+![Architecture](../img/uml_structure.png)
+
+## Components methods
+
+Each Core* base class exposes a small, stable API that implementations must implement or may override.
+
+```python
+--8<-- "docs/examples/others/components_methods.py:read"
+```
+
+Go back [Index](../index.md)
diff --git a/docs/alert_aggregator.md b/docs/alert_aggregator.md
index cedbcb03..300d2a89 100644
--- a/docs/alert_aggregator.md
+++ b/docs/alert_aggregator.md
@@ -15,7 +15,7 @@ This document explains expected APIs, how to implement a parser, testing tips an
 - `CoreParser.run()` handles lifecycle and calls `aggregate_alerts()` for each input; implement pure alert aggregation logic inside `aggregate_alerts()` where possible.
 - Use a typed `Config` class (subclass of `CoreAlertAggregationConfig`) to hold runtime parameters.
 
-## CoreParser — minimal API
+## CoreParser  --  minimal API
 
 Recommended signatures and behavior:
 
diff --git a/docs/auxiliar/persistency.md b/docs/auxiliar/persistency.md
index f6a785de..d36921a1 100644
--- a/docs/auxiliar/persistency.md
+++ b/docs/auxiliar/persistency.md
@@ -31,12 +31,12 @@ Two families ship today:
   raw rows. Very storage heavy and *not recommended* for production-ready detectors.
 - **Tracker backends** (`EventStabilityTracker`) keep only derived features
   (e.g. "this variable has been constant for the last 10k events") that are relevant for the detector. Use these
-  when you only need a summary or a subset of the log's information, not the raw history — they cost a fraction of
+  when you only need a summary or a subset of the log's information, not the raw history  --  they cost a fraction of
   the memory.
 
 All backends implement the same four-method contract: `add_data`, `get_data`,
 `dump`, `load`. That contract is what `EventPersistency` and
-`PersistencySaver` rely on — anything you add later only has to follow it.
+`PersistencySaver` rely on  --  anything you add later only has to follow it.
 
 ### 3. Saver lifecycle (`PersistencySaver`)
 
@@ -44,7 +44,7 @@ All backends implement the same four-method contract: `add_data`, `get_data`,
 state has to be written somewhere. `PersistencySaver` wraps an
 `EventPersistency` and:
 
-- writes to disk (or any `fsspec` URI) on two triggers — a wall-clock interval
+- writes to disk (or any `fsspec` URI) on two triggers  --  a wall-clock interval
   and an event-count threshold;
 - optionally `auto_load`s previously saved state during construction;
 - exposes `start()` / `stop()` so the background timer can be torn down
@@ -108,10 +108,10 @@ ep[event_id]                       # alias for get_event_data
 | Class | Use when |
 |---|---|
 | `persistency.EventDataFrame` | You need history and a Pandas DataFrame is the natural shape. |
-| `persistency.ChunkedEventDataFrame` | High-volume / streaming workloads — Polars-backed with row-retention and automatic compaction. |
+| `persistency.ChunkedEventDataFrame` | High-volume / streaming workloads  --  Polars-backed with row-retention and automatic compaction. |
 | `persistency.EventStabilityTracker` | You only care about how variables behave over time (`STATIC` / `STABLE` / `UNSTABLE` / `RANDOM`). Cheapest memory footprint. |
 
-All three are re-exported from the top of the package — `persistency.X` is the
+All three are re-exported from the top of the package  --  `persistency.X` is the
 canonical import; the deeply nested submodules are an implementation detail.
 
 ### Persisting to disk
@@ -134,7 +134,7 @@ saver.stop()    # final flush, stops the background timer
 
 `PersistencySaver.save()` is thread-safe, and `stop()` is idempotent. The two
 save triggers (`save_interval_seconds` and `events_until_save`) are
-independent — whichever fires first wins.
+independent  --  whichever fires first wins.
 
 #### Restoring state
 
@@ -147,13 +147,13 @@ saver = persistency.PersistencySaver(
 ```
 
 If `auto_load=True` and no saved state exists, the constructor raises
-`persistency.PersistencyLoadError` immediately — fail-fast rather than
+`persistency.PersistencyLoadError` immediately  --  fail-fast rather than
 silently starting empty.
 
 #### Exporting and importing state on demand
 
-For one-shot transfers — e.g. moving trained state to a new environment, or
-taking a manual snapshot — use the standalone functions directly:
+For one-shot transfers  --  e.g. moving trained state to a new environment, or
+taking a manual snapshot  --  use the standalone functions directly:
 
 ```python
 from detectmatelibrary.utils import persistency
@@ -161,7 +161,7 @@ from detectmatelibrary.utils import persistency
 # Export to a file URI
 persistency.save(ep, "./snapshots/trained-state")
 
-# Export to bytes (no disk I/O — useful when sending state over a network API)
+# Export to bytes (no disk I/O  --  useful when sending state over a network API)
 data: bytes = persistency.save(ep)
 
 # Import from a file URI
@@ -185,7 +185,7 @@ when a saver is active.
 #### Detector-level export and import
 
 When working through a detector (the typical path for DetectMateService), use
-the methods on the detector object directly — no need to access
+the methods on the detector object directly  --  no need to access
 `EventPersistency` internals:
 
 ```python
diff --git a/docs/basic_idea.md b/docs/basic_idea.md
deleted file mode 100644
index bffbc397..00000000
--- a/docs/basic_idea.md
+++ /dev/null
@@ -1,66 +0,0 @@
-# Basic Concepts
-
-DetectMateLibrary is a collection of utilities for detecting anomalies in system logs. This short tutorial explains the core concepts you need to get started.
-
-## What is a log?
-
-Logs are messages produced by logging statements in code that describe events or states during execution.
-
-Example code that produces a log:
-
-```python
-import logging
-
-var1 = "DetectMate getting started"
-var2 = "what is a log"
-
-logging.info(f"hello I am a log about {var1} and about {var2}")
-```
-
-This produces the message:
-
-```
-hello I am a log about DetectMate getting started and about what is a log
-```
-
-A log message can be split into a constant part (the template) and variable parts, for example:
-
-- Template: `hello I am a log about <*> and about <*>`
-- Variables: `["DetectMate getting started", "what is a log"]`
-
-Logs often include a prefix with metadata, such as time stamp, log level, or hostnamem, for example:
-
-```
-INFO [18-05-2005] hello I am a log about DetectMate getting started and about what is a log
-```
-
-To extract the metadata we define a log format. For the example above this would be:
-
-```
-<Level> [<Time>] <Content>
-```
-
-Using that format we can separate the message into the components log level `Level`, time stamp `Time`, and log message `Message`:
-
-- Level: `INFO`
-- Time: `18-05-2005`
-- Message: `hello I am a log about DetectMate getting started and about what is a log`
-
-## What is a parsed log?
-
-A parsed log is a log that has been decomposed into structured fields. Based on the example above:
-
-- log_format: `<Level> [<Time>] <Content>`
-- template: `hello I am a log about <*> and about <*>`
-
-A parsed log would contain fields like:
-
-| Field              | Value                                                                 |
-|--------------------|-----------------------------------------------------------------------|
-| Template           | `hello I am a log about <*> and about <*>`                            |
-| Variables          | `["DetectMate getting started", "what is a log"]`                     |
-| LogFormatVariables | `{"Level": "INFO", "Time": "18-05-2005"}`                              |
-
-Parsed logs expose structured data that downstream detection components use for anomaly detection.
-
-Go back to [Index](index.md)
diff --git a/docs/basic_usage.md b/docs/basic_usage.md
deleted file mode 100644
index 88ec2fa6..00000000
--- a/docs/basic_usage.md
+++ /dev/null
@@ -1,103 +0,0 @@
-
-# Getting started:  Basic usage
-
-In this section, we will show different examples of the basic usage of the DetectMate Library.
-
-## Parser
-
-In this example, we will use the [`MatcherParser`](parsers/template_matcher.md) to parse audit data from the [AIT Log Data Set V2.0](https://zenodo.org/records/5789064). The code loads the logs, parse them and save the input and output in json files using [`from_to`](helper/from_to.md) module.
-
-```python
---8<-- "docs/examples/others/basic_usage.py:example_1"
-```
-
-The logs will be saved in `logs.json` in this format:
-
-```json
-{
-"0": {
-        "log": "type=USER_ACCT msg=audit(1642723741.072:375): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "__version__": "1.0.0",
-        "hostname": "",
-        "logSource": "",
-        "logID": "0"
-    },
-...
-}
-```
-And the `parsed_log.json`:
-
-```json
-{
-    "0": {
-        "parserID": "MatcherParser",
-        "parsedLogID": "10",
-        "logID": "0",
-        "parsedTimestamp": 1772027171,
-        "logFormatVariables": {
-            "Type": "USER_ACCT",
-            "Serial": "375",
-            "Time": "1642723741.072",
-            "Content": "pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"
-        },
-        "__version__": "1.0.0",
-        "receivedTimestamp": 1772027171,
-        "variables": [
-            "10125",
-            "0",
-            "4294967295",
-            "4294967295",
-            "PAM:accounting",
-            "\"root\"",
-            "\"/usr/sbin/cron\"",
-            "?",
-            "?",
-            "cron",
-            "success"
-        ],
-        "log": "type=USER_ACCT msg=audit(1642723741.072:375): pid=10125 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'",
-        "parserType": "matcher_parser",
-        "EventID": 0,
-        "template": "pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'"
-    },
-...
-}
-```
-
-## Detector
-
-In this example, we will use the [`RandomDetector`](detectors/random_detector.md) with the parsed logs from the previous example.
-
-```python
---8<-- "docs/examples/others/basic_usage.py:example_2"
-```
-
-The alerts will be saved in `alerts.json` in this format:
-
-```json
-{
-    "0": {
-        "extractedTimestamps": [
-            1642723752
-        ],
-        "receivedTimestamp": 1772032073,
-        "score": 1.0,
-        "detectionTimestamp": 1772032073,
-        "alertID": "10",
-        "detectorType": "random_detector",
-        "detectorID": "RandomDetector",
-        "description": "",
-        "__version__": "1.0.0",
-        "logIDs": [
-            "6"
-        ],
-        "alertsObtain": {
-            "process": "1.0"
-        }
-    },
-...
-}
-```
-
-
-Go back to [Index](index.md), to previous step: [Installation](installation.md) or to next step: [Create new component](create_components.md).
diff --git a/docs/create_components.md b/docs/create_components.md
deleted file mode 100644
index 2debd11a..00000000
--- a/docs/create_components.md
+++ /dev/null
@@ -1,57 +0,0 @@
-
-# Getting started:  Create new component
-
-DetectMateLibrary includes a small CLI helper to bootstrap standalone workspaces
-for custom parsers and detectors. This is useful if you want to develop and test
-components in isolation while still using the same library and schemas.
-
-## Usage
-
-The CLI entry point is `mate` with a `create` command:
-
-```bash
-mate create --type <parser|detector> --name <workspace_name> --dir <target_dir>
-```
-
-| Option   | Description                                                                                                                                                                   |
-|----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `--type` | Component type to generate:<br>- `parser`: CoreParser-based template<br>- `detector`: CoreDetector-based template                                                             |
-| `--name` | Name of the component and package:<br>- Creates package dir: `<target_dir>/<name>/`<br>- Creates main file: `<name>.py`<br>- Derives class names: `<Name>` and `<Name>Config` |
-| `--dir`  | Directory where the workspace will be created                                                                                                                                 |
-
-
-## What gets generated
-
-For example:
-
-```bash
-mate create --type parser --name custom_parser --dir ./workspaces/custom_parser
-```
-
-will create:
-
-```text
-workspaces/custom_parser/          # workspace root
-├── custom_parser/                 # Python package
-│   ├── __init__.py
-│   └── custom_parser.py           # CoreParser-based template
-├── tests/
-│   └── test_custom_parser.py      # generated from template to test custom_parser
-├── data.json                      # example data to run the code
-├── LICENSE.md                     # copied from main project
-├── .gitignore                     # copied from main project
-├── .pre-commit-config.yaml        # copied from main project
-├── pyproject.toml                 # minimal project + dev extras
-└── README.md                      # setup instructions
-```
-
-## Add component to DetectMateLibrary
-
-To add the new component to the `DetectMateLibrary`, you need to add the component file to the specific folder and update the import paths.
-
-* **Detector**: Add the detector file component in `src/detectmatelibrary/detectors` and the unit tests in `tests/test_detectors`.
-* **Parsers**: Add the parser file component in `src/detectmatelibrary/parsers` and the unit tests in `tests/test_parsers`.
-
-Once that is complete, **ensure that all unit tests and the pre-commit process are successful**.
-
-Go back to [Index](index.md), to previous step: [Basic usage](basic_usage.md).
diff --git a/docs/detectors.md b/docs/detectors.md
index 93f91720..01de5970 100644
--- a/docs/detectors.md
+++ b/docs/detectors.md
@@ -1,5 +1,5 @@
 
-# Components: Detectors
+# Detectors
 
 Detectors process structured logs from Parsers and emit alerts when anomalies are detected.
 
@@ -10,7 +10,7 @@ Detectors process structured logs from Parsers and emit alerts when anomalies ar
 
 This document describes the minimal API, implementation guidance, a short example detector and a unit test pattern.
 
-## CoreDetector — minimal API
+## CoreDetector  --  minimal API
 
 
 
@@ -20,7 +20,7 @@ class CoreDetectorConfig(CoreConfig):
     method_type: str = "core_detector"
     parser: str = "<PLACEHOLDER>"
 
-    auto_config: bool = False
+    auto_config: bool = True
 
 
 class CoreDetector(CoreComponent):
@@ -36,13 +36,11 @@ class CoreDetector(CoreComponent):
     ) -> bool:
         """Empty, must be define in the specific detector"""
 
-    def train(
-        self, input_: ParserSchema | list[ParserSchema]
-    ) -> None:
+    def train(self, input_: ParserSchema | list[ParserSchema]) -> None:
         """Empty, can be define in the detector. It trains the detector"""
 ```
 
-## Implementing a detector — example
+## Implementing a detector  --  example
 
 Simple detector that raises an alert when a numeric variable exceeds a threshold.
 
@@ -51,10 +49,12 @@ class SimpleThresholdConfig(CoreDetectorConfig):
     method_type: str = "simple_threshold"
     threshold: float = 0.0
 
+
 class SimpleThresholdDetector(CoreDetector):
     def __init__(
-        self, name: str = "SimpleThreshold",
-        config: SimpleThresholdConfig | dict[str, Any] = SimpleThresholdConfig()
+        self,
+        name: str = "SimpleThreshold",
+        config: SimpleThresholdConfig | dict[str, Any] = SimpleThresholdConfig(),
     ):
 
         if isinstance(config, dict):
@@ -62,18 +62,17 @@ class SimpleThresholdDetector(CoreDetector):
         super().__init__(name=name, buffer_mode=BufferMode.NO_BUF, config=config)
 
     def detect(
-        self,
-        input_: schemas.ParserSchema,
-        output_: schemas.DetectorSchema
+        self, input_: schemas.ParserSchema, output_: schemas.DetectorSchema
     ) -> bool:
 
         # calculate is a dummy method
         if calculate(input_) > self.config.threshold:
-
             output_["alertID"] = f"{self.name}-{int(time.time())}"
             output_["logIDs"].extend([ev.logID] if ev.logID else [])
             output_["score"] = float(value)
-            output_["description"] = f"Value {value} > threshold {self.config.threshold}"
+            output_["description"] = (
+                f"Value {value} > threshold {self.config.threshold}"
+            )
             return True
 
         return False
@@ -126,13 +125,54 @@ detectors:
 ```
 
 
+### Common parameters (all detectors)
+
+There are some parameters, that **every** detector inhertis from `CoreDetectorConfig`/`CoreConfig`/`BasicConfig`, regardless of what it does. The other parameters, that are **specific** for the respective detector, are explained right at the detectors documentation page, later on.
+
+<!-- Start common_arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|auto_config|boolean|True|Runs the configuration step before the training process.|
+|start_id|integer|10|Number used to start the unique ID generator.|
+|data_use_training|integer, null|None|Data used for training, if None, training is not done.|
+|data_use_configure|integer, null|None|Data used for configuration, if None, configuration is not done.|
+|use_config_data_as_training|boolean|True|Combine the configured data in the training process if True.|
+|parser|string|PARSER|Name of the parser used.|
+|events|object|{}|Events configuration dict keyed by event_id.|
+|global_instances|object|{}|Configuration for a specific instance within an event.|
+<!-- End common_arguments -->
+
+Beyond the common parameters, two groups of detectors inherit group-specific configurations.
+
+### Per-variable model detectors
+
+The detectors that learn a per-variable model ([Bigram Frequency](detectors/bigram_frequency.md), [Charset](detectors/charset.md), [Combo Detector](detectors/combo.md), [New Value](detectors/new_value.md), [Value Range](detectors/value_range.md)) share the following parameters, inherited from `VariableDetectorConfig`.
+
+<!-- Start variable_arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+<!-- End variable_arguments -->
+
+### Deep learning detectors
+
+The two neural detectors ([Deeplog](detectors/deeplog.md), [LogBert](detectors/logbert.md)) share the following parameters, inherited from `DeepLearningDetectorConfig`.
+
+<!-- Start deeplearning_arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|window_size|integer|10|Number of consecutive events used as one training/detection sequence.|
+|validation_per|number|0.2|Fraction of data held out for validation during (fine)training.|
+|finetune_epochs|integer|2|Number of epochs used when finetuning during the configuration phase.|
+|hyperparameters|object|{'Model': {}, 'Train': {}, 'Finetune': []}|Model, training and hyperparameter-search settings passed to the underlying deep learning model.|
+<!-- End deeplearning_arguments -->
+
 ### Configuration semantics (preliminary)
 
-**`events` key** — The integer key is the `EventID` (or `event_id`) to monitor (see the [Template Matcher](parsers/template_matcher.md) docs for how the EventID is assigned.
+**`events` key**  --  The integer key is the `EventID` (or `event_id`) to monitor (see the [Template Matcher](parsers/template_matcher.md) docs for how the EventID is assigned.
 
 **`global` key** - This one has a similar functionality as the `events` key but refers to variables, that are not bound to events (thus can only contain `header_variables`).
 
-**`variables[].pos`** — The 0-indexed position of the `<*>` wildcard in the matched template, counting from left to right starting at 0. For example, given:
+**`variables[].pos`**  --  The 0-indexed position of the `<*>` wildcard in the matched template, counting from left to right starting at 0. For example, given:
 
 ```text
 pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=<*> terminal=<*> res=<*>'
@@ -140,12 +180,12 @@ pid=<*> uid=<*> auid=<*> ses=<*> msg='op=<*> acct=<*> exe=<*> hostname=<*> addr=
 
 `pos: 0` captures `pid=`, `pos: 6` captures `exe=`, etc.
 
-**`header_variables[].pos`** — A named field from the log format string (e.g., `Type`, `Time`, `Content`) rather than a wildcard position.
+**`header_variables[].pos`**  --  A named field from the log format string (e.g., `Type`, `Time`, `Content`) rather than a wildcard position.
 
 
 ### Auto-configuration (optional)
 
-Detectors can optionally support **auto-configuration** — a process where the detector automatically discovers which variables are worth monitoring, instead of requiring the user to specify them manually.
+Detectors can optionally support **auto-configuration**  --  a process where the detector automatically discovers which variables are worth monitoring, instead of requiring the user to specify them manually.
 
 Auto-configuration is controlled by the `auto_config` flag in the pipeline config (e.g. `config/pipeline_config_default.yaml`):
 
@@ -155,7 +195,7 @@ detectors:
     method_type: new_value_detector
     auto_config: True       # enable auto-configuration
     params: {}
-    # no "events" block needed — it will be generated automatically
+    # no "events" block needed  --  it will be generated automatically
 ```
 
 
@@ -163,9 +203,9 @@ detectors:
 
 When auto-configuration is enabled, the detector goes through two extra phases before training:
 
-**Phase 1 — `configure(input_)`**: The detector ingests events into an `EventPersistency` instance that uses a tracker backend to analyze variable behavior — for example, whether each variable is stable, random, or still has insufficient data. This instance is typically separate from the one used for training, because the configuration phase needs to observe *all* variables to decide which ones are worth monitoring, while training only tracks the variables that were selected as a result.
+**Phase 1  --  `configure(input_)`**: The detector ingests events into an `EventPersistency` instance that uses a tracker backend to analyze variable behavior  --  for example, whether each variable is stable, random, or still has insufficient data. This instance is typically separate from the one used for training, because the configuration phase needs to observe *all* variables to decide which ones are worth monitoring, while training only tracks the variables that were selected as a result.
 
-**Phase 2 — `set_configuration()`**: After enough data has been ingested, the detector queries the tracker to select variables that meet its criteria (e.g. only stable variables). It then generates a full `events` configuration from those results and updates its own config. At this point `auto_config` is set to `False` in the generated config, since the configuration is now explicit.
+**Phase 2  --  `set_configuration()`**: After enough data has been ingested, the detector queries the tracker to select variables that meet its criteria (e.g. only stable variables). It then generates a full `events` configuration from those results and updates its own config. At this point `auto_config` is set to `False` in the generated config, since the configuration is now explicit.
 
 After these two phases, the detector proceeds with the normal `train()` and `detect()` lifecycle using the generated configuration.
 
@@ -201,7 +241,7 @@ def configure(self, input_):
 ```
 
 The `set_configuration()` method queries the tracker results and writes the
-final `events` block. It touches nothing else on the config — everything the
+final `events` block. It touches nothing else on the config  --  everything the
 operator set under `params` or `auto_config_params` must survive untouched, so
 `set_configuration` never rebuilds the config from scratch:
 
@@ -230,9 +270,9 @@ When `auto_config` is `False`, steps 1 and 2 are skipped entirely.
 That distinction is visible in the config. A detector's settings live in two
 blocks:
 
-* **`auto_config_params`** — inputs *to* the configure phase. They pick which
+* **`auto_config_params`**  --  inputs *to* the configure phase. They pick which
   variables the phase selects and are read only while `auto_config` is `True`.
-* **`params`** — operational settings, read during training and detection on
+* **`params`**  --  operational settings, read during training and detection on
   every run.
 
 The configure phase writes its results into the top-level `events` block (and,
@@ -241,8 +281,8 @@ for `EventSequenceDetector`, into `fixed_window_size`) and then sets
 be rerun with `auto_config: False` and reproduce the same detector.
 
 Both `auto_config` and `Component.configure()` are declared on the shared base,
-so `auto_config_params` is declared there too — on `BasicConfig`, beside
-`auto_config` — rather than on the detector config alone. Detectors are the only
+so `auto_config_params` is declared there too  --  on `BasicConfig`, beside
+`auto_config`  --  rather than on the detector config alone. Detectors are the only
 component type with a real configure phase today, so they are the only ones that
 narrow the block with fields; parsers and alert aggregators inherit it empty, and
 an empty block is omitted from the serialized config, so their YAML is unaffected.
@@ -266,11 +306,11 @@ axes:
 | `slope_time` | change centroid vs. `slope_threshold` | normalized timestamps |
 
 Any subset of the four may be enabled, and any single one may stand alone. The
-default — `index` alone — is the historical behaviour: each segment's mean rate
-of change is compared against its entry in `segment_thresholds` — four segments
-by default, one threshold per segment — and the segments are **equal-count**:
+default  --  `index` alone  --  is the historical behaviour: each segment's mean rate
+of change is compared against its entry in `segment_thresholds`  --  four segments
+by default, one threshold per segment  --  and the segments are **equal-count**:
 each holds the same number of observations, regardless of how much time they
-cover. For bursty log sources that is misleading — a variable that changed
+cover. For bursty log sources that is misleading  --  a variable that changed
 constantly during a quiet night and then went silent under a flood of daytime
 traffic looks stable, because the flood supplies enough samples to dominate the
 later segments. Enabling `time` cuts the same segments at **equal
@@ -278,12 +318,12 @@ durations** instead, so each segment covers the same amount of wall-clock time;
 the detector then needs an event time per record, which it reads from the log's
 named variables (`logFormatVariables`, i.e. the fields declared in the parser's
 `log_format`) under the name given by `timestamp_variable`. `slope_index` and
-`slope_time` ask a different question — whether the change centroid sits early
-or late in the series — on the index axis and the time axis respectively.
+`slope_time` ask a different question  --  whether the change centroid sits early
+or late in the series  --  on the index axis and the time axis respectively.
 
 These parameters live on every `VariableDetector` subclass (`NewValueDetector`,
 `NewValueComboDetector`, `ValueRangeDetector`, `CharsetDetector`, `BigramDetector`, …)
-and go in the detector's `auto_config_params` block — they are inputs to the
+and go in the detector's `auto_config_params` block  --  they are inputs to the
 auto-configuration phase, read only while `auto_config` is `True`, and never
 consulted at detection time.
 
@@ -329,7 +369,7 @@ requires strictly more than half of them to.
 
 Ties resolve to UNSTABLE. That keeps `majority` from ever being more lenient
 than a coin-flip, and makes it collapse onto `consensus` at one and two enabled
-methods — turning a third method on is the only place the rule starts to matter.
+methods  --  turning a third method on is the only place the rule starts to matter.
 
 **All four methods false is a config error**, rejected by a pydantic validator.
 It is not a harmless no-op: classification decides `INSUFFICIENT_DATA`,
@@ -345,7 +385,7 @@ All of these live in the detector's `auto_config_params` block.
 | `use_stable_vars` | `bool` | `true` | Include variables classified `STABLE` in the generated configuration. |
 | `use_static_vars` | `bool` | `true` | Include variables classified `STATIC`. Defaults to `false` on `NewValueComboDetector`. |
 | `classification` | `ClassificationMethods` | see below | Which classification methods run and how their verdicts combine. |
-| `timestamp_variable` | `str \| null` | `null` | Name of the field in `logFormatVariables` holding the record's event time. Required for `time` and `slope_time` to have any effect. Only named log-format fields are consulted — never the positional `variables` list. |
+| `timestamp_variable` | `str \| null` | `null` | Name of the field in `logFormatVariables` holding the record's event time. Required for `time` and `slope_time` to have any effect. Only named log-format fields are consulted  --  never the positional `variables` list. |
 | `timestamp_format` | `str \| null` | `null` | Explicit [`strftime`](https://docs.python.org/3/library/datetime.html#strftime-and-strptime-format-codes) pattern for parsing that field. When unset, `TimeFormatHandler` auto-detects the format (ISO 8601, Apache, syslog, numeric epoch seconds/milliseconds, and other common layouts). |
 
 Set `timestamp_format` when the source uses a layout the auto-detection does not
@@ -382,23 +422,23 @@ Time-aware classification is best-effort and never fails a run:
   falls back to the index axis.
 * If timestamps stop lining up with the recorded observations, or the observed time
   span is zero, or they arrive out of order, `time` silently reuses the equal-index
-  cuts, and `slope_time` computes its centroid on the index axis instead — it
+  cuts, and `slope_time` computes its centroid on the index axis instead  --  it
   degrades to `slope_index`.
 * Under `majority`, a fallen-back method still casts its own vote: if `slope_index`
   and `slope_time` are both enabled and timestamps are unusable, both entries compute
   the same index-axis centroid, and that verdict carries two of the votes rather than
-  one. This is deliberate — dropping a fallen-back method from the vote would change
+  one. This is deliberate  --  dropping a fallen-back method from the vote would change
   the enabled count from variable to variable and make `majority` mean something
   different for each one. The reason string names the axis each slope actually used,
   so a doubled vote is visible in the note.
 * The same doubling applies to the segment-threshold pair: if `index` and `time` are
   both enabled and timestamps are unusable, `time` silently reuses the same equal-count
   cuts as `index`, so an identical verdict again carries two votes under `majority`
-  rather than one. Unlike the slope pair, the reason string does not surface this —
+  rather than one. Unlike the slope pair, the reason string does not surface this  --
   each entry is still labelled by its configured method name (`index` or `time`), not
   by the axis it actually used, so a doubled segment-pair vote is invisible in the note.
 
-In every fallback case classification still runs and produces a result — only the
+In every fallback case classification still runs and produces a result  --  only the
 axis behind it changes back to index.
 
 A segment with no observations in it is *not* a fallback: it scores a mean of 0.0,
@@ -406,7 +446,7 @@ because nothing observed means nothing changed. Once the segment floor above is
 met, equal-index cuts never leave a segment empty; equal-duration cuts of a bursty
 variable still do, routinely, so `time` on its own is lenient towards a burst of
 churn followed by silence. Enable `index` and `time` together when that leniency
-matters — the index pass keeps every segment populated.
+matters  --  the index pass keeps every segment populated.
 
 
 ### Saving state (persist)
@@ -429,7 +469,7 @@ detectors:
       ...
 ```
 
-All fields are optional — `persist: {}` uses all defaults. Omitting `persist:` entirely
+All fields are optional  --  `persist: {}` uses all defaults. Omitting `persist:` entirely
 disables saving (backward compatible).
 
 The detector name is automatically appended to `path`, so `path: ./state` for a detector
@@ -439,7 +479,7 @@ named `NewValueDetector` writes to `./state/NewValueDetector/`.
 
 The default `path` is CWD-relative. systemd services usually run with CWD `/`,
 so `./state` would resolve to `/state` (wrong location, needs root). To avoid
-this, set `StateDirectory=` in your unit file — systemd creates `/var/lib/<dir>`
+this, set `StateDirectory=` in your unit file  --  systemd creates `/var/lib/<dir>`
 with the right ownership and exports `$STATE_DIRECTORY`, which the default `path`
 reads automatically. No explicit `path:` needed:
 
@@ -463,7 +503,7 @@ Setting `path:` explicitly (e.g. an `s3://` URL) always overrides `$STATE_DIRECT
 
 #### Storage options examples
 
-**Local filesystem** — no `storage_options` needed:
+**Local filesystem**  --  no `storage_options` needed:
 
 ```yaml
 persist:
@@ -513,7 +553,7 @@ persist:
 ```
 
 In practice, credentials are usually supplied via environment variables
-(`AWS_ACCESS_KEY_ID`, etc.) or instance roles — in which case `storage_options`
+(`AWS_ACCESS_KEY_ID`, etc.) or instance roles  --  in which case `storage_options`
 stays empty or is omitted.
 
 Go back [Index](index.md)
diff --git a/docs/detectors/bigram_frequency.md b/docs/detectors/bigram_frequency.md
index 1975d1a9..384424de 100644
--- a/docs/detectors/bigram_frequency.md
+++ b/docs/detectors/bigram_frequency.md
@@ -1,6 +1,10 @@
 # Bigram Frequency Detector
 
-The Bigram Frequency Detector raises alerts when a variable's character bigrams (pairs of adjacent characters) appear improbable under a learned per-variable bigram frequency model. Optionally, an English-language bigram table can be consulted as a fallback for bigrams not yet seen during training.
+The Bigram Frequency Detector raises alerts when a variable's character bigrams (pairs of neighbouring letters/characters) appear improbable under a learned per-variable bigram frequency model. Optionally, an English-language bigram table can be consulted as a fallback for bigrams not yet seen during training.
+
+## In/out
+
+Input and output schemas in the pipeline
 
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
@@ -11,36 +15,47 @@ The Bigram Frequency Detector raises alerts when a variable's character bigrams
 
 ## Description
 
-For each configured variable, the detector walks every observed value character-by-character (with virtual boundary characters before the first and after the last) and updates a per-(event, variable) bigram frequency table. At detect time, the average per-bigram conditional probability of a new value is computed against this table. Values scoring below `prob_thresh` (default `0.05`) are flagged. When `default_freqs` is enabled, a built-in English bigram table acts as a fallback for bigrams unseen during training.
+For each configured variable, the detector walks every observed value character-by-character (with virtual boundary characters before the first and after the last) and updates a per-(event, variable) bigram frequency table. At detect time, the average per-bigram conditional probability of a new value is computed against this table. Values scoring below `prob_thresh` are flagged. When `default_freqs` is enabled, a built-in English bigram table acts as a fallback for bigrams unseen during training.
+
+## Configuration arguments
+
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) and [Variable detector parameters](../detectors.md#variable-detector-parameters) in the Detectors overview for the rest.
 
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|bigram_frequency_detector|Indicates what type of method it is.|
+|prob_thresh|number|0.05|Limit for the average probability of character pairs below which anomalies are reported.|
+|default_freqs|boolean|False|Initialize the probabilities with default values from https://github.com/markbaggett/freq.|
+|skip_repetitions|boolean|True|Only use distinct values for character-pair counting. This counteracts the problem of imbalanced word frequencies that distort the frequency table generated in a single run.|
+<!-- End arguments -->
 
-## Configuration example
+## Examples
+### Service usage
 
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
 detectors:
-    BigramFrequencyDetector:
+    <COMPONENT_NAME>:
         method_type: bigram_frequency_detector
-        auto_config: False
+        auto_config: true
         params:
-            prob_thresh: 0.05        # limit for the average probability of character pairs for which anomalies are reported.
-            default_freqs: False     # initializes the probabilities with default values from https://github.com/markbaggett/freq.
-            skip_repetitions: False  # boolean that determines whether only distinct values are used for character pair counting. This counteracts the problem of imbalanced word frequencies that distort the frequency table generated in a single aminer run.
-        events:
-            1:
-                test:
-                    params: {}
-                    variables:
-                        - pos: 0
-                          name: var1
-                          params:
-                              threshold: 0.
-                    header_variables:
-                        - pos: level
-                          params: {}
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+            prob_thresh: 0.05
+            default_freqs: false
+            skip_repetitions: true
+        events: {}
 ```
-
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/bigram_frequency.py:example"
diff --git a/docs/detectors/charset.md b/docs/detectors/charset.md
index 6f904028..b3f520c5 100644
--- a/docs/detectors/charset.md
+++ b/docs/detectors/charset.md
@@ -2,6 +2,10 @@
 
 The Charset Detector raises alerts when previously unseen characters appear in configured fields. It is useful to detect novelty, configuration drift, or the appearance of new actors in the environment.
 
+## In/out
+
+Input and output schemas in the pipeline
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
@@ -13,31 +17,39 @@ The Charset Detector raises alerts when previously unseen characters appear in c
 
 This detector maintains a lightweight set of observed characters per monitored field and emits an alert when a character not present in the set is seen for the first time (subject to configuration).
 
+## Configuration arguments
+
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) and [Variable detector parameters](../detectors.md#variable-detector-parameters) in the Detectors overview for the rest.
+
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|charset_detector|Indicates what type of method it is.|
+<!-- End arguments -->
 
-## Configuration example
+## Examples
+### Service usage
 
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
 detectors:
-    CharsetDetector:
+    <COMPONENT_NAME>:
         method_type: charset_detector
-        auto_config: False
-        params: {}
-        events:
-            1:
-                test:
-                    params: {}
-                    variables:
-                        - pos: 0
-                          name: var1
-                          params:
-                              threshold: 0.
-                    header_variables:
-                        - pos: level
-                          params: {}
+        auto_config: true
+        params:
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+        events: {}
 ```
-
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/charset.py:example"
diff --git a/docs/detectors/combo.md b/docs/detectors/combo.md
index e8c81081..8f0fc901 100644
--- a/docs/detectors/combo.md
+++ b/docs/detectors/combo.md
@@ -1,7 +1,11 @@
-# Combo Detector
+# New Value Combo Detector
 
 The New Combo Value Detector raises alerts when previously unseen combinations of values appear in configured fields (for example new user names, IP addresses, or process names). It is useful to detect novelty, configuration drift, or the appearance of new actors in the environment.
 
+## In/out
+
+Input and output schemas in the pipeline
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
@@ -10,29 +14,42 @@ The New Combo Value Detector raises alerts when previously unseen combinations o
 ✅ Federation compatible.
 
 ## Description
+
 This detector maintains a lightweight set of observed combination of values per monitored fields and emits an alert when a combination is not present in the set seen for the first time (subject to configuration).
 
-## Configuration
+## Configuration arguments
+
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) and [Variable detector parameters](../detectors.md#variable-detector-parameters) in the Detectors overview for the rest.
 
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|new_value_combo_detector|Indicates what type of method it is.|
+<!-- End arguments -->
+
+## Examples
+### Service usage
+
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
 detectors:
-    NewValueComboDetector:
+    <COMPONENT_NAME>:
         method_type: new_value_combo_detector
-        auto_config: False
-        auto_config_params:
-            max_combo_size: 3
-        events:
-            1:
-                test:
-                    params: {}
-                    variables:
-                        - pos: 0
-                          name: var1
-                    header_variables:
-                        - pos: level
+        auto_config: true
+        params:
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+        events: {}
 ```
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/combo.py:example"
diff --git a/docs/detectors/deeplog.md b/docs/detectors/deeplog.md
index ff86e760..36f2aa62 100644
--- a/docs/detectors/deeplog.md
+++ b/docs/detectors/deeplog.md
@@ -2,42 +2,85 @@
 
 The Deeplog Detector is inspired from [Deeplog paper](https://dl.acm.org/doi/10.1145/3133956.3134015).
 
+## In/out
+
+Input and output schemas in the pipeline
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
 | **Output** | [DetectorSchema](../schemas.md) | Combined alert / finding |
 
 ## Description
-Deep learning method that looks at the event ID sequence
 
-## Configuration
+Deep learning method that looks at the event ID sequence.
+
+## Configuration arguments
+
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) and [Deep learning detector parameters](../detectors.md#deep-learning-detector-parameters) in the Detectors overview for the rest.
+
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|deeplog_detector|Indicates what type of method it is.|
+|hyperparameters|object|{'Model': {'hidden_dim': 64, 'n_layers': 2}, 'Train': {'seed': 0, 'batch_size': 2048, 'learning_rate': 0.01, 'epochs': 10, 'patience': 3}, 'Finetune': [['Model', 'hidden_dim', [128, 256, 512]], ['Model', 'n_layers', [1, 2, 3]], ['Train', 'learning_rate', [0.01, 0.02, 0.03]]]}|Model, training and hyperparameter-search settings for the DeepLog model.|
+<!-- End arguments -->
 
+## Examples
+### Service usage
+
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
 detectors:
-    DeeplogDetector:
+    <COMPONENT_NAME>:
         method_type: deeplog_detector
-        auto_config: False
-        data_use_training: 10
-        window_size: 3
-        hyperparameters:
-            Model: 
-                hidden_dim: 64
-                n_layers: 2
-            Train: 
-                seed: 0
-                batch_size: 2048
-                learning_rate: 0.01
-                epochs: 10
-                patience: 3
-            Finetune: 
-                - ["Model", "hidden_dim", [128, 256, 512]]
-                - ["Model", "n_layers", [1, 2, 3]]
-                - ["Train", "learning_rate", [0.01, 0.02, 0.03]]
+        auto_config: true
+        params:
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+            window_size: 10
+            validation_per: 0.2
+            finetune_epochs: 2
+            hyperparameters:
+                Model:
+                    hidden_dim: 64
+                    n_layers: 2
+                Train:
+                    seed: 0
+                    batch_size: 2048
+                    learning_rate: 0.01
+                    epochs: 10
+                    patience: 3
+                Finetune:
+                -   - Model
+                    - hidden_dim
+                    -   - 128
+                        - 256
+                        - 512
+                -   - Model
+                    - n_layers
+                    -   - 1
+                        - 2
+                        - 3
+                -   - Train
+                    - learning_rate
+                    -   - 0.01
+                        - 0.02
+                        - 0.03
+        events: {}
 ```
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/deeplog_detector.py:example"
 ```
+
 Go back [Index](../index.md)
diff --git a/docs/detectors/ecvc_detector.md b/docs/detectors/ecvc_detector.md
index 9d64f167..c44e484a 100644
--- a/docs/detectors/ecvc_detector.md
+++ b/docs/detectors/ecvc_detector.md
@@ -2,6 +2,10 @@
 
 The Event Count Vector Clustering Detector (ECVC) detects anomalies by calculating the distance between the count vectors from training and new ones. The method can be found in [this publication](https://dl.acm.org/doi/10.1145/3660768).
 
+## In/out
+
+Input and output schemas in the pipeline
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
@@ -12,22 +16,51 @@ The Event Count Vector Clustering Detector (ECVC) detects anomalies by calculati
 
 ## Description
 
-A count vector is form by counting the number of appearance of each event ID in a sequence of a specific window size.
+A count vector is formed by counting the number of appearances of each event ID in a sequence of a specific window size.
+
+Count vectors learned during training are stored via [persistency](../auxiliar/persistency.md), so a trained model can be saved and restored with a `persist:` block. A count vector is only comparable within the window it was counted over, so restoring state at a different `window_size` logs a warning  --  the restored vectors cannot match and every window would alert.
+
+## Configuration arguments
 
-Count vectors learned during training are stored via [persistency](../auxiliar/persistency.md), so a trained model can be saved and restored with a `persist:` block. A count vector is only comparable within the window it was counted over, so restoring state at a different `window_size` logs a warning — the restored vectors cannot match and every window would alert.
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) in the Detectors overview for the rest.
 
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|ecvc_detector_detector|Indicates what type of method it is.|
+|window_size|integer|10|Length of the event-ID window a count vector is built over.|
+|validation_per|number|0.2|Fraction of the learned count vectors held out as a validation split and used to derive the anomaly threshold.|
+|seed|integer|0|Random seed used to shuffle count vectors into train/validation splits.|
+|threshold_method|string|mean|Method used to derive the anomaly threshold from the validation split: 'mean' averages the distance scores, 'default' uses a fixed threshold of 0.|
+<!-- End arguments -->
 
-## Configuration example
+## Examples
+### Service usage
 
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
 detectors:
-    ECVCDetector:
+    <COMPONENT_NAME>:
         method_type: ecvc_detector_detector
-        window_size: 10
+        auto_config: true
+        params:
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+            window_size: 10
+            validation_per: 0.2
+            seed: 0
+            threshold_method: mean
+        events: {}
 ```
-
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/ecvc_detector.py:example"
diff --git a/docs/detectors/event_sequence.md b/docs/detectors/event_sequence.md
index c4dc65e9..760fc48a 100644
--- a/docs/detectors/event_sequence.md
+++ b/docs/detectors/event_sequence.md
@@ -2,6 +2,10 @@
 
 The Event Sequence Detector raises alerts when a run of consecutive event IDs appears in an order that was never observed during training. It is useful to detect broken or unexpected workflows in an environment where the individual events are all benign on their own.
 
+## In/out
+
+Input and output schemas in the pipeline
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
@@ -13,25 +17,37 @@ The Event Sequence Detector raises alerts when a run of consecutive event IDs ap
 
 The detector slides a window of `fixed_window_size` event IDs over the log stream. During training every full window is stored as a known sequence; during detection a window whose exact sequence is not in that set is reported as an anomaly.
 
-Because a novel event stays inside the window for `fixed_window_size` steps, a single unexpected event produces up to `fixed_window_size` consecutive alerts — one per window it invalidates. This is intentional: each of those windows is a distinct sequence that was never trained.
+Because a novel event stays inside the window for `fixed_window_size` steps, a single unexpected event produces up to `fixed_window_size` consecutive alerts  --  one per window it invalidates. This is intentional: each of those windows is a distinct sequence that was never trained.
 
 Sequences are stored as fixed-length n-grams, so a persisted model is only meaningful at the length it was trained with. When state is restored via [persistency](../auxiliar/persistency.md) at a different `fixed_window_size`, the detector logs a warning, adopts the persisted length, and skips auto-configuration.
 
-## Auto configuration
+### Auto configuration
 
 With `auto_config: True` the detector spends the configure phase feeding one window per candidate length in `min_window_size .. max_window_size` (inclusive) and tracking how stable the resulting sequences are. The longest candidate whose sequences are classified `STABLE` or `STATIC` is written to `fixed_window_size`, so the resulting configuration can be replayed verbatim with `auto_config: False`.
 
 Candidates whose window never filled during the configure phase are skipped, so a short configure phase simply narrows the choice.
 
-If no candidate is stable, no window length is meaningful for this log stream. Rather than fall back to an arbitrary length and alert on nearly every window, the detector generates an empty configuration: **no instance of the detector is created**, `fixed_window_size` stays `None`, and it neither trains nor alerts for the rest of the run. A warning names the range that was searched. The same applies to `auto_config: False` without a `fixed_window_size` — the detector stays inert.
+If no candidate is stable, no window length is meaningful for this log stream. Rather than fall back to an arbitrary length and alert on nearly every window, the detector generates an empty configuration: **no instance of the detector is created**, `fixed_window_size` stays `None`, and it neither trains nor alerts for the rest of the run. A warning names the range that was searched. The same applies to `auto_config: False` without a `fixed_window_size`  --  the detector stays inert.
 
 Longer windows are more specific and therefore alert more readily; if the auto-configured length is too sensitive, narrow the range or set `fixed_window_size` explicitly.
 
-## Configuration example
+## Configuration arguments
+
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) in the Detectors overview for the rest.
+
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|event_sequence_detector|Indicates what type of method it is.|
+|fixed_window_size|integer, null|None|Length of the sliding EventID window. A window whose exact EventID sequence was not seen during training is reported as an anomaly. When set it overrides the `auto_config_params` window range and skips auto-configuration; auto-configuration writes its own choice here. While it is None the detector is unconfigured and neither trains nor alerts.|
+
+## Examples
+### Service usage
+
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
 
 ```yaml
 detectors:
-    EventSequenceDetector:
+    <COMPONENT_NAME>:
         method_type: event_sequence_detector
         auto_config: False
         params:
@@ -49,6 +65,8 @@ detectors:
         auto_config_params:
             min_window_size: 2
             max_window_size: 10
+            fixed_window_size: null
+        events: {}
 ```
 
 | Parameter | Default | Description |
@@ -65,29 +83,7 @@ detectors:
 ## Example usage
 
 ```python
-from detectmatelibrary.detectors.event_sequence_detector import EventSequenceDetector, \
-    EventSequenceDetectorConfig
-import detectmatelibrary.schemas as schemas
-
-detector = EventSequenceDetector(
-    name="EventSequenceTest",
-    config=EventSequenceDetectorConfig(auto_config=False, fixed_window_size=3),
-)
-
-parser_data = schemas.ParserSchema({
-    "parserType": "test",
-    "EventID": 1,
-    "template": "test template",
-    "variables": ["var1"],
-    "logID": "1",
-    "parsedLogID": "1",
-    "parserID": "test_parser",
-    "log": "test log message",
-    "logFormatVariables": {"timestamp": "123456"}
-})
-
-
-alert = detector.process(parser_data)
+--8<-- "docs/examples/detectors/event_sequence.py:example"
 ```
 
 The sequences learned so far are available via `detector.get_known_sequences()`, which returns a set of event-ID tuples.
diff --git a/docs/detectors/logbert.md b/docs/detectors/logbert.md
index dbfde1e7..55474a91 100644
--- a/docs/detectors/logbert.md
+++ b/docs/detectors/logbert.md
@@ -2,47 +2,91 @@
 
 The LogBert Detector is inspired from [LogBert paper](https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=9534113).
 
+## In/out
+
+Input and output schemas in the pipeline
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
 | **Output** | [DetectorSchema](../schemas.md) | Combined alert / finding |
 
 ## Description
-Deep learning method that looks at the event ID sequence
 
-## Configuration
+Deep learning method that looks at the event ID sequence.
+
+## Configuration arguments
+
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) and [Deep learning detector parameters](../detectors.md#deep-learning-detector-parameters) in the Detectors overview for the rest.
+
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|logbert_detector|Indicates what type of method it is.|
+|hyperparameters|object|{'Model': {'n_embed': 10, 'hidden': 32, 'num_heads': 2, 'n_layers': 1, 'dropout': 0.0, 'max_len': 1000}, 'Train': {'seed': 0, 'batch_size': 256, 'learning_rate': 0.01, 'epochs': 10, 'mask_per': 0.4, 'alpha': 0.0, 'patience': 3}, 'Finetune': [['Model', 'hidden', [64, 128, 256]], ['Model', 'n_layers', [1, 2, 3]], ['Train', 'learning_rate', [0.002, 0.001, 0.005]]]}|Model, training and hyperparameter-search settings for the LogBERT model.|
+<!-- End arguments -->
 
+## Examples
+### Service usage
+
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
 detectors:
-    LogBertDetector:
+    <COMPONENT_NAME>:
         method_type: logbert_detector
-        auto_config: False
-        data_use_training: 10
-        window_size: 4
-        hyperparameters:
-            Model: 
-                hidden: 32
-                num_heads: 2
-                n_layers: 1
-                dropout: 0.0
-                max_len: 1000
-            Train: 
-                seed: 0
-                batch_size: 256
-                learning_rate: 0.01
-                epochs: 10
-                mask_per: 0.4
-                alpha: 0.0
-                patience: 3
-            Finetune: 
-                - ["Model", "hidden", [64, 128, 256]]
-                - ["Model", "n_layers", [1, 2, 3]]
-                - ["Train", "learning_rate", [0.002, 0.001, 0.005]]
+        auto_config: true
+        params:
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+            window_size: 10
+            validation_per: 0.2
+            finetune_epochs: 2
+            hyperparameters:
+                Model:
+                    n_embed: 10
+                    hidden: 32
+                    num_heads: 2
+                    n_layers: 1
+                    dropout: 0.0
+                    max_len: 1000
+                Train:
+                    seed: 0
+                    batch_size: 256
+                    learning_rate: 0.01
+                    epochs: 10
+                    mask_per: 0.4
+                    alpha: 0.0
+                    patience: 3
+                Finetune:
+                -   - Model
+                    - hidden
+                    -   - 64
+                        - 128
+                        - 256
+                -   - Model
+                    - n_layers
+                    -   - 1
+                        - 2
+                        - 3
+                -   - Train
+                    - learning_rate
+                    -   - 0.002
+                        - 0.001
+                        - 0.005
+        events: {}
 ```
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/logbert_detector.py:example"
 ```
+
 Go back [Index](../index.md)
diff --git a/docs/detectors/new_event.md b/docs/detectors/new_event.md
index 935950ac..f223922e 100644
--- a/docs/detectors/new_event.md
+++ b/docs/detectors/new_event.md
@@ -2,6 +2,10 @@
 
 The New Event Detector raises alerts when previously unseen log templates, distinguished by event IDs, appear in log data. It is useful to detect unexpected types of events in the environment.
 
+## In/out
+
+Input and output schemas in the pipeline
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
@@ -14,19 +18,39 @@ The New Event Detector raises alerts when previously unseen log templates, disti
 
 This detector maintains a lightweight set of observed event IDs and emits an alert when an event ID not present in the set is seen for the first time (subject to configuration).
 
+## Configuration arguments
+
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) in the Detectors overview for the rest.
+
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|new_event_detector|Indicates what type of method it is.|
+<!-- End arguments -->
 
-## Configuration example
+## Examples
+### Service usage
 
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
 detectors:
-    NewEventDetector:
+    <COMPONENT_NAME>:
         method_type: new_event_detector
-        auto_config: False
-        params: {}
+        auto_config: true
+        params:
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+        events: {}
 ```
-
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/new_event.py:example"
diff --git a/docs/detectors/new_value.md b/docs/detectors/new_value.md
index 5e4e24cc..cc5db79f 100644
--- a/docs/detectors/new_value.md
+++ b/docs/detectors/new_value.md
@@ -2,6 +2,10 @@
 
 The New Value Detector raises alerts when previously unseen values appear in configured fields (for example new user names, IP addresses, or process names). It is useful to detect novelty, configuration drift, or the appearance of new actors in the environment.
 
+## In/out
+
+Input and output schemas in the pipeline
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
@@ -14,35 +18,39 @@ The New Value Detector raises alerts when previously unseen values appear in con
 
 This detector maintains a lightweight set of observed values per monitored field and emits an alert when a value not present in the set is seen for the first time (subject to configuration).
 
+## Configuration arguments
+
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) and [Variable detector parameters](../detectors.md#variable-detector-parameters) in the Detectors overview for the rest.
+
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|new_value_detector|Indicates what type of method it is.|
+<!-- End arguments -->
 
-## Configuration example
+## Examples
+### Service usage
 
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
 detectors:
-    NewValueDetector:
+    <COMPONENT_NAME>:
         method_type: new_value_detector
-        auto_config: False
-        params: {}
-        persist:                      # optional — omit to disable saving
-          path: ./state
-          interval_seconds: 300
-          auto_load: false
-        events:
-            1:
-                test:
-                    params: {}
-                    variables:
-                        - pos: 0
-                          name: var1
-                          params:
-                              threshold: 0.
-                    header_variables:
-                        - pos: level
-                          params: {}
+        auto_config: true
+        params:
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+        events: {}
 ```
-
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/new_value.py:example"
diff --git a/docs/detectors/random_detector.md b/docs/detectors/random_detector.md
index 5bf112d1..67f78e65 100644
--- a/docs/detectors/random_detector.md
+++ b/docs/detectors/random_detector.md
@@ -1,38 +1,49 @@
 # Random Detector
 
-The Random Detector produces randomized alerts for incoming parsed logs. It is useful for testing pipelines, alert routing, and downstream consumers without needing a real detection model.
+The Random Detector inspects incoming ParserSchema instances and, according to its configuration, emits alerts with synthetic content. It can be configured to sample specific log variables, set thresholds or control alert frequency. Use it for integration testing, load testing, or as a simple example of a detector implementation.
+
+## In/out
+
+Input and output schemas in the pipeline
 
 |            | Schema                 | Description        |
 |------------|------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
 | **Output** | [DetectorSchema](../schemas.md) | Generated alerts |
 
-## Description
+## Configuration arguments
+
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) in the Detectors overview for the rest.
 
-The detector inspects incoming ParserSchema instances and, according to its configuration, emits alerts with synthetic content. It can be configured to sample specific log variables, set thresholds or control alert frequency. Use it for integration testing, load testing, or as a simple example of a detector implementation.
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|random_detector|Indicates what type of method it is.|
+<!-- End arguments -->
 
-## Configuration example
+## Examples
+### Service usage
 
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
-    RandomDetector:
+detectors:
+    <COMPONENT_NAME>:
         method_type: random_detector
-        auto_config: False
-        params: {}
-        events:
-            1:
-                test:
-                    params: {}
-                    variables:
-                        - pos: 0
-                          name: var1
-                          params:
-                              threshold: 0.
-                    header_variables:
-                        - pos: level
-                          params: {}
+        auto_config: true
+        params:
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+        events: {}
 ```
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/random_detector.py:example"
diff --git a/docs/detectors/rule_based.md b/docs/detectors/rule_based.md
index e4e29c2c..5c5cc763 100644
--- a/docs/detectors/rule_based.md
+++ b/docs/detectors/rule_based.md
@@ -2,6 +2,10 @@
 
 The Rule-based Detector raises alerts based on a configurable set of rules.
 
+## In/out
+
+Input and output schemas in the pipeline
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
@@ -27,23 +31,44 @@ Notes on table columns:
 - **Requires arguments**: Whether the rule needs additional arguments.
 - **Enabled by default**: Whether the rule is active when not explicitly overridden.
 
-## Configuration example
+## Configuration arguments
+
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) in the Detectors overview for the rest.
+
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|rule_detector|Indicates what type of method it is.|
+|rules|array|[{'rule': 'R001 - TemplateNotFound'}, {'rule': 'R003 - CheckForExceptions'}, {'rule': 'R004 - ErrorLevelFound'}]|List of rules to evaluate, each a dict with a 'rule' name and an optional 'args' list.|
+<!-- End arguments -->
 
+## Examples
+### Service usage
+
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
 detectors:
-  RuleDetector:
-    method_type: rule_detector
-    auto_config: False
-    params:
-      rules:
-        - rule: "R001 - TemplateNotFound"
-        - rule: "R002 - SpecificKeyword"
-          args:
-            - "critical"
-            - "anomaly"
+    <COMPONENT_NAME>:
+        method_type: rule_detector
+        auto_config: true
+        params:
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+            rules:
+            -   rule: R001 - TemplateNotFound
+            -   rule: R003 - CheckForExceptions
+            -   rule: R004 - ErrorLevelFound
+        events: {}
 ```
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/rule_based.py:example"
diff --git a/docs/detectors/scvs_detector.md b/docs/detectors/scvs_detector.md
index 7c1b9897..611baab9 100644
--- a/docs/detectors/scvs_detector.md
+++ b/docs/detectors/scvs_detector.md
@@ -2,6 +2,10 @@
 
 The Sequence Count Vector Set Detector (SCVS) detects anomalies by finding count vectors that were not present in the training dataset.
 
+## In/out
+
+Input and output schemas in the pipeline
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
@@ -9,23 +13,46 @@ The Sequence Count Vector Set Detector (SCVS) detects anomalies by finding count
 
 ## Description
 
-A count vector is formed by counting the number of appearance of each event ID in a sequence of a specific window size.
+A count vector is formed by counting the number of appearances of each event ID in a sequence of a specific window size.
 
-Count vectors learned during training are stored via [persistency](../auxiliar/persistency.md), so a trained model can be saved and restored with a `persist:` block. A count vector is only comparable within the window it was counted over, so restoring state at a different `window_size` logs a warning — the restored vectors cannot match and every window would alert.
+Count vectors learned during training are stored via [persistency](../auxiliar/persistency.md), so a trained model can be saved and restored with a `persist:` block. A count vector is only comparable within the window it was counted over, so restoring state at a different `window_size` logs a warning  --  the restored vectors cannot match and every window would alert.
 
+## Configuration arguments
 ✅ Federation compatible (Binary not available).
 
-## Configuration example
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) in the Detectors overview for the rest.
+
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|scvs_detector|Indicates what type of method it is.|
+|window_size|integer|10|Length of the event-ID window a count vector is built over.|
+<!-- End arguments -->
+
+## Examples
+### Service usage
 
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
 detectors:
-    SCVSDetector:
+    <COMPONENT_NAME>:
         method_type: scvs_detector
-        window_size: 10
+        auto_config: true
+        params:
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+            window_size: 10
+        events: {}
 ```
-
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/scvs_detector.py:example"
diff --git a/docs/detectors/value_range.md b/docs/detectors/value_range.md
index 264d3242..4ae59a54 100644
--- a/docs/detectors/value_range.md
+++ b/docs/detectors/value_range.md
@@ -2,6 +2,10 @@
 
 The Value Range Detector raises alerts when numerical values outside of known ranges appear in configured fields. It is useful to detect unexpected changes, configuration drift, or the appearance of new actors in the environment.
 
+## In/out
+
+Input and output schemas in the pipeline
+
 |            | Schema                     | Description        |
 |------------|----------------------------|--------------------|
 | **Input**  | [ParserSchema](../schemas.md) | Structured log  |
@@ -14,31 +18,41 @@ The Value Range Detector raises alerts when numerical values outside of known ra
 
 This detector maintains a lightweight set of observed values per monitored field and emits an alert when a value outside the learned range is seen (subject to configuration).
 
+## Configuration arguments
+
+Only parameters specific to this detector are listed below -- see [Common parameters](../detectors.md#common-parameters-all-detectors) and [Variable detector parameters](../detectors.md#variable-detector-parameters) in the Detectors overview for the rest.
+
+<!-- Start arguments -->
+| Field  | Type  | Default Value| Description|
+|-------|------|-----|---|
+|method_type|string|value_range_detector|Indicates what type of method it is.|
+|ignore_non_numerical_val|boolean|True|Drop non-numeric values instead of raising when a configured variable cannot be cast to a number.|
+<!-- End arguments -->
 
-## Configuration example
+## Examples
+### Service usage
 
+To use it in [DetectMateService](https://github.com/ait-detectmate/DetectMateService), you can use the example below.
+
+<!-- Start config -->
 ```yaml
 detectors:
-    ValueRangeDetector:
+    <COMPONENT_NAME>:
         method_type: value_range_detector
-        auto_config: False
-        params: {"ignore_non_numerical_val": True}
-        events:
-            1:
-                test:
-                    params: {}
-                    variables:
-                        - pos: 0
-                          name: var1
-                          params:
-                              threshold: 0.
-                    header_variables:
-                        - pos: level
-                          params: {}
+        auto_config: true
+        params:
+            start_id: 10
+            data_use_training: null
+            data_use_configure: null
+            use_config_data_as_training: true
+            parser: PARSER
+            global_instances: {}
+            ignore_non_numerical_val: true
+        events: {}
 ```
-
-
-## Example usage
+<!-- End config -->
+### Library usage
+To use it as a python script, you can follow the example below.
 
 ```python
 --8<-- "docs/examples/detectors/value_range.py:example"
diff --git a/docs/development.md b/docs/development.md
index e8293958..342631f6 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -75,7 +75,7 @@ from detectmatelibrary.parsers.logbatcher import LogBatcherParser, LogBatcherPar
 You can also include the whole file by dropping the `:section` suffix
 (`--8<-- "docs/examples/parsers/template_tree_matcher.py"`), but section markers
 are the norm. Because `check_paths: true` is set, the build aborts if the file or
-marker doesn't exist — a missing snippet is caught at build time.
+marker doesn't exist  --  a missing snippet is caught at build time.
 
 **3. Make sure it's testable.** The test (`tests/test_docs/test_doc_examples.py`)
 globs every `.py` under `docs/examples/` and runs each one as a script via
diff --git a/docs/diagrams.drawio b/docs/diagrams.drawio
deleted file mode 100644
index 3444a1ca..00000000
--- a/docs/diagrams.drawio
+++ /dev/null
@@ -1,446 +0,0 @@
-<mxfile host="65bd71144e">
-    <diagram id="2GtUaBTsSb7tlzDZL1Ph" name="Federaton (Stack later)">
-        <mxGraphModel dx="1440" dy="771" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
-            <root>
-                <mxCell id="0"/>
-                <mxCell id="1" parent="0"/>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-1" value="&lt;b&gt;Component 1&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
-                    <mxGeometry x="60" y="340" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-2" value="&lt;b&gt;Component 2&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
-                    <mxGeometry x="60" y="420" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-3" value="&lt;b&gt;Component N&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
-                    <mxGeometry x="61" y="523" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-4" value="&lt;b&gt;&lt;font style=&quot;font-size: 24px;&quot;&gt;Stack later&lt;/font&gt;&lt;/b&gt;" style="text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;" vertex="1" parent="1">
-                    <mxGeometry x="40" y="270" width="190" height="30" as="geometry"/>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-5" value="" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;fillColor=#000000;" vertex="1" parent="1">
-                    <mxGeometry x="103" y="497" width="10" height="10" as="geometry"/>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-6" value="" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;fillColor=#000000;" vertex="1" parent="1">
-                    <mxGeometry x="117" y="497" width="10" height="10" as="geometry"/>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-7" value="" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;fillColor=#000000;" vertex="1" parent="1">
-                    <mxGeometry x="131" y="497" width="10" height="10" as="geometry"/>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-16" value="" style="endArrow=classic;html=1;" edge="1" parent="1" target="G8Zvb4cSwF66s35sz91u-20">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="208" y="383" as="sourcePoint"/>
-                        <mxPoint x="268" y="383" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-17" value="" style="endArrow=classic;html=1;" edge="1" parent="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="200" y="453" as="sourcePoint"/>
-                        <mxPoint x="260" y="453" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-18" value="" style="endArrow=classic;html=1;" edge="1" parent="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="200" y="550" as="sourcePoint"/>
-                        <mxPoint x="260" y="532.5" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-19" value="&lt;span style=&quot;font-size: 18px;&quot;&gt;&lt;b&gt;Aggregate&lt;/b&gt;&lt;/span&gt;" style="rounded=0;whiteSpace=wrap;html=1;rotation=90;" vertex="1" parent="1">
-                    <mxGeometry x="628" y="433" width="210" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-20" value="&lt;font style=&quot;font-size: 24px;&quot;&gt;Do your stuff&lt;/font&gt;" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" vertex="1" parent="1">
-                    <mxGeometry x="248" y="363" width="230" height="220" as="geometry"/>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-21" value="&lt;div&gt;&lt;b&gt;&lt;span style=&quot;font-size: 18px;&quot;&gt;Stack in Component 1&lt;/span&gt;&lt;/b&gt;&lt;/div&gt;" style="rounded=0;whiteSpace=wrap;html=1;rotation=90;" vertex="1" parent="1">
-                    <mxGeometry x="478" y="433" width="210" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-22" value="" style="endArrow=classic;html=1;entryX=0.082;entryY=0.541;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="466.07" y="453.48" as="sourcePoint"/>
-                        <mxPoint x="539.9300000000002" y="452.5" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-23" value="" style="endArrow=classic;html=1;" edge="1" parent="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="208" y="373" as="sourcePoint"/>
-                        <mxPoint x="528" y="373" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-24" value="" style="endArrow=classic;html=1;entryX=0.082;entryY=0.541;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="466.06999999999994" y="533.48" as="sourcePoint"/>
-                        <mxPoint x="539.9300000000002" y="532.5" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="G8Zvb4cSwF66s35sz91u-25" value="" style="endArrow=classic;html=1;entryX=0.082;entryY=0.541;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="618" y="453.48" as="sourcePoint"/>
-                        <mxPoint x="691.8600000000001" y="452.5" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-            </root>
-        </mxGraphModel>
-    </diagram>
-    <diagram id="WHzQ0MSqRCq44H5VYT6H" name="Federation (Combine first)">
-        <mxGraphModel dx="1440" dy="771" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
-            <root>
-                <mxCell id="0"/>
-                <mxCell id="1" parent="0"/>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-1" value="&lt;b&gt;Component 1&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
-                    <mxGeometry x="60" y="340" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-2" value="&lt;b&gt;Component 2&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
-                    <mxGeometry x="60" y="420" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-3" value="&lt;b&gt;Component N&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
-                    <mxGeometry x="61" y="523" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-4" value="&lt;b&gt;&lt;font style=&quot;font-size: 24px;&quot;&gt;Combine first&lt;/font&gt;&lt;/b&gt;" style="text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;" vertex="1" parent="1">
-                    <mxGeometry x="40" y="270" width="190" height="30" as="geometry"/>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-5" value="" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;fillColor=#000000;" vertex="1" parent="1">
-                    <mxGeometry x="103" y="497" width="10" height="10" as="geometry"/>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-6" value="" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;fillColor=#000000;" vertex="1" parent="1">
-                    <mxGeometry x="117" y="497" width="10" height="10" as="geometry"/>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-7" value="" style="ellipse;whiteSpace=wrap;html=1;aspect=fixed;fillColor=#000000;" vertex="1" parent="1">
-                    <mxGeometry x="131" y="497" width="10" height="10" as="geometry"/>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-8" value="&lt;span style=&quot;font-size: 18px;&quot;&gt;&lt;b&gt;Aggregate&lt;/b&gt;&lt;/span&gt;" style="rounded=0;whiteSpace=wrap;html=1;rotation=90;" vertex="1" parent="1">
-                    <mxGeometry x="640" y="440" width="210" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-9" value="&lt;font style=&quot;font-size: 24px;&quot;&gt;Do your stuff&lt;/font&gt;" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" vertex="1" parent="1">
-                    <mxGeometry x="410" y="350" width="230" height="220" as="geometry"/>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-10" value="&lt;b&gt;&lt;font style=&quot;font-size: 18px;&quot;&gt;Combine&amp;nbsp;&lt;/font&gt;&lt;/b&gt;&lt;div&gt;&lt;b&gt;&lt;font size=&quot;3&quot;&gt;(Shared memory)&lt;/font&gt;&lt;/b&gt;&lt;/div&gt;" style="rounded=0;whiteSpace=wrap;html=1;rotation=90;" vertex="1" parent="1">
-                    <mxGeometry x="210" y="440" width="210" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-11" value="" style="endArrow=classic;html=1;entryX=0.082;entryY=0.541;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1" target="2sFhYfKgsjgl_9uBMCRN-9">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="345" y="470" as="sourcePoint"/>
-                        <mxPoint x="395" y="420" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-12" value="" style="endArrow=classic;html=1;entryX=0.082;entryY=0.541;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="630" y="470.5" as="sourcePoint"/>
-                        <mxPoint x="704" y="469.5" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-13" value="" style="endArrow=classic;html=1;" edge="1" parent="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="190" y="370" as="sourcePoint"/>
-                        <mxPoint x="260" y="400" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-15" value="" style="endArrow=classic;html=1;" edge="1" parent="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="190" y="450" as="sourcePoint"/>
-                        <mxPoint x="260" y="450" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="2sFhYfKgsjgl_9uBMCRN-16" value="" style="endArrow=classic;html=1;" edge="1" parent="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="190" y="549" as="sourcePoint"/>
-                        <mxPoint x="260" y="549" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-            </root>
-        </mxGraphModel>
-    </diagram>
-    <diagram id="a43WCObT8raMKRSpJBwK" name="structure_uml">
-        <mxGraphModel dx="1440" dy="771" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
-            <root>
-                <mxCell id="0"/>
-                <mxCell id="1" parent="0"/>
-                <mxCell id="CSendNgoL9oNhC4Db3nm-1" value="&lt;b&gt;CoreComponent&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;" parent="1" vertex="1">
-                    <mxGeometry x="260" y="180" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="CSendNgoL9oNhC4Db3nm-2" value="&lt;b&gt;CoreDetector&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="150" y="480" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="CSendNgoL9oNhC4Db3nm-3" value="&lt;b&gt;CoreParser&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="365" y="310" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="qkd1A9xJ1MQAjAXrDm5J-1" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endFill=0;" parent="1" source="CSendNgoL9oNhC4Db3nm-2" target="CSendNgoL9oNhC4Db3nm-1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="120" y="330" as="sourcePoint"/>
-                        <mxPoint x="330" y="250" as="targetPoint"/>
-                        <Array as="points">
-                            <mxPoint x="210" y="280"/>
-                            <mxPoint x="320" y="280"/>
-                        </Array>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="qkd1A9xJ1MQAjAXrDm5J-2" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;endFill=0;" parent="1" source="CSendNgoL9oNhC4Db3nm-3" target="CSendNgoL9oNhC4Db3nm-1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="220" y="320" as="sourcePoint"/>
-                        <mxPoint x="330" y="250" as="targetPoint"/>
-                        <Array as="points">
-                            <mxPoint x="425" y="280"/>
-                            <mxPoint x="320" y="280"/>
-                        </Array>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="qkd1A9xJ1MQAjAXrDm5J-4" value="&lt;b&gt;Schemas&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;" parent="1" vertex="1">
-                    <mxGeometry x="260" y="70" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="prsX7LRWlVNFGYMG0skf-1" value="" style="endArrow=none;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endFill=0;startArrow=open;startFill=0;dashed=1;" parent="1" source="CSendNgoL9oNhC4Db3nm-1" target="qkd1A9xJ1MQAjAXrDm5J-4" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="209.5" y="180" as="sourcePoint"/>
-                        <mxPoint x="209.5" y="260" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="urrl5OUr-bYxvc4l3x27-1" value="&lt;b&gt;CoreConfig&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;" parent="1" vertex="1">
-                    <mxGeometry x="595" y="180" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="urrl5OUr-bYxvc4l3x27-2" value="&lt;b&gt;CoreDetectorConfig&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="485" y="480" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="urrl5OUr-bYxvc4l3x27-3" value="&lt;b&gt;CoreParserConfig&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="700" y="310" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="urrl5OUr-bYxvc4l3x27-4" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endFill=0;" parent="1" source="urrl5OUr-bYxvc4l3x27-2" target="urrl5OUr-bYxvc4l3x27-1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="455" y="330" as="sourcePoint"/>
-                        <mxPoint x="665" y="250" as="targetPoint"/>
-                        <Array as="points">
-                            <mxPoint x="545" y="280"/>
-                            <mxPoint x="655" y="280"/>
-                        </Array>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="urrl5OUr-bYxvc4l3x27-5" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;endFill=0;" parent="1" source="urrl5OUr-bYxvc4l3x27-3" target="urrl5OUr-bYxvc4l3x27-1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="555" y="320" as="sourcePoint"/>
-                        <mxPoint x="665" y="250" as="targetPoint"/>
-                        <Array as="points">
-                            <mxPoint x="760" y="280"/>
-                            <mxPoint x="655" y="280"/>
-                        </Array>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="urrl5OUr-bYxvc4l3x27-6" value="" style="endArrow=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;endFill=0;startArrow=open;startFill=0;dashed=1;" parent="1" source="CSendNgoL9oNhC4Db3nm-1" target="urrl5OUr-bYxvc4l3x27-1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="330" y="190" as="sourcePoint"/>
-                        <mxPoint x="330" y="140" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="urrl5OUr-bYxvc4l3x27-7" value="" style="endArrow=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;endFill=0;startArrow=open;startFill=0;dashed=1;exitX=1;exitY=0.5;exitDx=0;exitDy=0;" parent="1" source="CSendNgoL9oNhC4Db3nm-3" target="urrl5OUr-bYxvc4l3x27-3" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="390" y="220" as="sourcePoint"/>
-                        <mxPoint x="605" y="220" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="urrl5OUr-bYxvc4l3x27-8" value="" style="endArrow=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;endFill=0;startArrow=open;startFill=0;dashed=1;exitX=1;exitY=0.5;exitDx=0;exitDy=0;" parent="1" source="CSendNgoL9oNhC4Db3nm-2" target="urrl5OUr-bYxvc4l3x27-2" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="280" y="630" as="sourcePoint"/>
-                        <mxPoint x="495" y="630" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="QHNYLoSWuo2XXaYD8ACw-1" value="&lt;b&gt;NewDetector&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;" parent="1" vertex="1">
-                    <mxGeometry x="150" y="610" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="QHNYLoSWuo2XXaYD8ACw-2" value="&lt;b&gt;NewDetectorConfig&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;" parent="1" vertex="1">
-                    <mxGeometry x="485" y="610" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="QHNYLoSWuo2XXaYD8ACw-3" value="" style="endArrow=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;endFill=0;startArrow=open;startFill=0;dashed=1;exitX=1;exitY=0.5;exitDx=0;exitDy=0;" parent="1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="270" y="639" as="sourcePoint"/>
-                        <mxPoint x="485" y="639" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="QHNYLoSWuo2XXaYD8ACw-4" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endFill=0;" parent="1" source="QHNYLoSWuo2XXaYD8ACw-1" target="CSendNgoL9oNhC4Db3nm-2" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="400" y="470" as="sourcePoint"/>
-                        <mxPoint x="450" y="420" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="QHNYLoSWuo2XXaYD8ACw-5" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endFill=0;" parent="1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="540" y="610" as="sourcePoint"/>
-                        <mxPoint x="540" y="540" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="FRVr6QJZny3FPRJuSVea-1" value="&lt;b&gt;CoreAlertAggregatorConfig&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="572.5" y="390" width="165" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="FRVr6QJZny3FPRJuSVea-2" value="&lt;b&gt;CoreAlertAggregator&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="248.75" y="390" width="142.5" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="FRVr6QJZny3FPRJuSVea-3" value="" style="endArrow=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;endFill=0;startArrow=open;startFill=0;dashed=1;" parent="1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="400" y="420" as="sourcePoint"/>
-                        <mxPoint x="572.5" y="420" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="FRVr6QJZny3FPRJuSVea-4" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endFill=0;" parent="1" source="FRVr6QJZny3FPRJuSVea-2" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="319.5" y="310" as="sourcePoint"/>
-                        <mxPoint x="319.5" y="240" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="FRVr6QJZny3FPRJuSVea-5" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;endFill=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;" parent="1" source="FRVr6QJZny3FPRJuSVea-1" target="urrl5OUr-bYxvc4l3x27-1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="660.5" y="490" as="sourcePoint"/>
-                        <mxPoint x="655" y="230" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-            </root>
-        </mxGraphModel>
-    </diagram>
-    <diagram id="rw8FCBFgMFN-xjUkTNXH" name="schema_uml">
-        <mxGraphModel dx="1440" dy="771" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
-            <root>
-                <mxCell id="0"/>
-                <mxCell id="1" parent="0"/>
-                <mxCell id="2" value="&lt;b&gt;BaseSchema&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;" parent="1" vertex="1">
-                    <mxGeometry x="365" y="180" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="3" value="&lt;b&gt;LogSchema&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="50" y="330" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="4" value="&lt;b&gt;ParserSchema&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="260" y="330" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="d-QGhjGyQQP7pKH5EskQ-14" value="" style="edgeStyle=none;html=1;" parent="1" source="5" target="11" edge="1">
-                    <mxGeometry relative="1" as="geometry"/>
-                </mxCell>
-                <mxCell id="5" value="&lt;b&gt;DetectorSchema&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="460" y="330" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="6" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endFill=0;" parent="1" source="3" target="2" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="320" y="380" as="sourcePoint"/>
-                        <mxPoint x="370" y="330" as="targetPoint"/>
-                        <Array as="points">
-                            <mxPoint x="110" y="280"/>
-                            <mxPoint x="425" y="280"/>
-                        </Array>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="7" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endFill=0;" parent="1" target="2" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="720" y="330" as="sourcePoint"/>
-                        <mxPoint x="520" y="250" as="targetPoint"/>
-                        <Array as="points">
-                            <mxPoint x="720" y="280"/>
-                            <mxPoint x="425" y="280"/>
-                        </Array>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="9" value="&amp;lt;&amp;lt;Protobuf&amp;gt;&amp;gt;&lt;div&gt;&lt;b&gt;Log Schema&lt;/b&gt;&lt;/div&gt;" style="rounded=0;whiteSpace=wrap;html=1;" parent="1" vertex="1">
-                    <mxGeometry x="50" y="470" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="10" value="&amp;lt;&amp;lt;Protobuf&amp;gt;&amp;gt;&lt;div&gt;&lt;b&gt;Parser Schema&lt;/b&gt;&lt;/div&gt;" style="rounded=0;whiteSpace=wrap;html=1;" parent="1" vertex="1">
-                    <mxGeometry x="260" y="470" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="11" value="&amp;lt;&amp;lt;Protobuf&amp;gt;&amp;gt;&lt;div&gt;&lt;b&gt;Detector Schema&lt;/b&gt;&lt;/div&gt;" style="rounded=0;whiteSpace=wrap;html=1;" parent="1" vertex="1">
-                    <mxGeometry x="460" y="470" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="12" value="" style="endArrow=none;html=1;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;endFill=0;startArrow=open;startFill=0;dashed=1;" parent="1" source="3" target="9" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="200" y="380" as="sourcePoint"/>
-                        <mxPoint x="250" y="330" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="13" value="" style="endArrow=none;html=1;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;endFill=0;startArrow=open;startFill=0;dashed=1;" parent="1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="319.5" y="390" as="sourcePoint"/>
-                        <mxPoint x="319.5" y="470" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="14" value="" style="endArrow=none;html=1;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;endFill=0;startArrow=open;startFill=0;dashed=1;" parent="1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="519.5" y="390" as="sourcePoint"/>
-                        <mxPoint x="519.5" y="470" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="d-QGhjGyQQP7pKH5EskQ-15" value="&lt;b&gt;AggregateSchema&lt;/b&gt;" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="650" y="330" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="d-QGhjGyQQP7pKH5EskQ-16" value="&amp;lt;&amp;lt;Protobuf&amp;gt;&amp;gt;&lt;div&gt;&lt;b&gt;Aggregate Schema&lt;/b&gt;&lt;/div&gt;" style="rounded=0;whiteSpace=wrap;html=1;" parent="1" vertex="1">
-                    <mxGeometry x="650" y="470" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="d-QGhjGyQQP7pKH5EskQ-17" value="" style="endArrow=none;html=1;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;endFill=0;startArrow=open;startFill=0;dashed=1;" parent="1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="709.5" y="390" as="sourcePoint"/>
-                        <mxPoint x="709.5" y="470" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="d-QGhjGyQQP7pKH5EskQ-18" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endFill=0;" parent="1" target="2" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="320" y="330" as="sourcePoint"/>
-                        <mxPoint x="635" y="240" as="targetPoint"/>
-                        <Array as="points">
-                            <mxPoint x="320" y="280"/>
-                            <mxPoint x="425" y="280"/>
-                        </Array>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="d-QGhjGyQQP7pKH5EskQ-19" value="" style="endArrow=block;html=1;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;endFill=0;" parent="1" target="2" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="525" y="330" as="sourcePoint"/>
-                        <mxPoint x="230" y="240" as="targetPoint"/>
-                        <Array as="points">
-                            <mxPoint x="525" y="280"/>
-                            <mxPoint x="425" y="280"/>
-                        </Array>
-                    </mxGeometry>
-                </mxCell>
-            </root>
-        </mxGraphModel>
-    </diagram>
-    <diagram id="In9uUm1slfC-dMF7nGBB" name="structure_diagram">
-        <mxGraphModel dx="1440" dy="771" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
-            <root>
-                <mxCell id="0"/>
-                <mxCell id="1" parent="0"/>
-                <mxCell id="nLa3N_so0MWUvuhkkTvZ-2" value="&lt;b&gt;Parser&lt;/b&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="140" y="240" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="nLa3N_so0MWUvuhkkTvZ-3" value="&lt;b&gt;Detector&lt;/b&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="380" y="240" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="nLa3N_so0MWUvuhkkTvZ-4" value="" style="shape=flexArrow;endArrow=classic;html=1;" parent="1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="60" y="270" as="sourcePoint"/>
-                        <mxPoint x="120" y="270" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="nLa3N_so0MWUvuhkkTvZ-5" value="" style="shape=flexArrow;endArrow=classic;html=1;" parent="1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="290" y="269.5" as="sourcePoint"/>
-                        <mxPoint x="350" y="269.5" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="nLa3N_so0MWUvuhkkTvZ-6" value="" style="shape=flexArrow;endArrow=classic;html=1;" parent="1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="520" y="269.5" as="sourcePoint"/>
-                        <mxPoint x="580" y="269.5" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="nLa3N_so0MWUvuhkkTvZ-7" value="&lt;b&gt;log schema&lt;/b&gt;" style="text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;" parent="1" vertex="1">
-                    <mxGeometry x="20" y="210" width="110" height="30" as="geometry"/>
-                </mxCell>
-                <mxCell id="nLa3N_so0MWUvuhkkTvZ-8" value="&lt;b&gt;parser schema&lt;/b&gt;" style="text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;" parent="1" vertex="1">
-                    <mxGeometry x="260" y="210" width="110" height="30" as="geometry"/>
-                </mxCell>
-                <mxCell id="nLa3N_so0MWUvuhkkTvZ-9" value="&lt;b&gt;detector schema&lt;/b&gt;" style="text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;" parent="1" vertex="1">
-                    <mxGeometry x="490" y="210" width="110" height="30" as="geometry"/>
-                </mxCell>
-                <mxCell id="2KKQ6eHAdBG_vNHMuQGh-1" value="&lt;b&gt;Alert Aggregation&lt;/b&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
-                    <mxGeometry x="610" y="240" width="120" height="60" as="geometry"/>
-                </mxCell>
-                <mxCell id="2KKQ6eHAdBG_vNHMuQGh-2" value="" style="shape=flexArrow;endArrow=classic;html=1;" parent="1" edge="1">
-                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="750" y="269.5" as="sourcePoint"/>
-                        <mxPoint x="810" y="269.5" as="targetPoint"/>
-                    </mxGeometry>
-                </mxCell>
-                <mxCell id="2KKQ6eHAdBG_vNHMuQGh-3" value="&lt;b&gt;output schema&lt;/b&gt;" style="text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;" parent="1" vertex="1">
-                    <mxGeometry x="720" y="210" width="110" height="30" as="geometry"/>
-                </mxCell>
-            </root>
-        </mxGraphModel>
-    </diagram>
-</mxfile>
diff --git a/docs/examples/config/update.py b/docs/examples/config/update.py
new file mode 100644
index 00000000..98639e73
--- /dev/null
+++ b/docs/examples/config/update.py
@@ -0,0 +1,175 @@
+from detectmatelibrary.detectors.random_detector import RandomDetectorConfig
+from detectmatelibrary.detectors.bigram_frequency_detector import (
+    BigramFrequencyDetectorConfig,
+)
+from detectmatelibrary.detectors.charset_detector import CharsetDetectorConfig
+from detectmatelibrary.detectors.new_value_combo_detector import (
+    NewValueComboDetectorConfig,
+)
+from detectmatelibrary.detectors.deeplog_detector import DeeplogDetectorConfig
+from detectmatelibrary.detectors.ecvc_detector import ECVCDetectorConfig
+from detectmatelibrary.detectors.logbert_detector import LogBertDetectorConfig
+from detectmatelibrary.detectors.new_event_detector import NewEventDetectorConfig
+from detectmatelibrary.detectors.new_value_detector import NewValueDetectorConfig
+from detectmatelibrary.detectors.rule_detector import RuleDetectorConfig
+from detectmatelibrary.detectors.scvs_detector import SCVSDetectorConfig
+from detectmatelibrary.detectors.value_range_detector import ValueRangeDetectorConfig
+
+from detectmatelibrary.common.core import CoreConfig
+from detectmatelibrary.common.detector import CoreDetectorConfig
+from detectmatelibrary.common.variable_detector import VariableDetectorConfig
+from detectmatelibrary.common.deeplearning_detector import DeepLearningDetectorConfig
+
+import yaml
+
+
+# %% Methods
+def append_docs(docs: list[str], start_cmd: str, end_cmd: str, add: str) -> list[str]:
+    start_idx = docs.index(start_cmd)
+    end_idx = docs.index(end_cmd)
+    if start_idx > end_idx:
+        raise Exception(f"'{start_cmd}' should be before '{end_cmd}'")
+
+    return docs[: start_idx + 1] + [add] + docs[end_idx:]
+
+
+def get_arguments(
+    config: CoreConfig, exclude_inherited_from: type[CoreConfig] | None = None
+) -> str:
+    arguments = (
+        "| Field  | Type  | Default Value| Description|\n|-------|------|-----|---|\n"
+    )
+    for arg in config.get_docs(exclude_inherited_from=exclude_inherited_from):
+        arguments += f"|{arg['Name']}|{arg['Type']}|{arg['Default value']}|{arg['Description']}|\n"
+    return arguments
+
+
+def config_yaml(config: CoreConfig) -> str:
+    pretty_yaml = yaml.dump(
+        config.to_dict("<COMPONENT_NAME>"),
+        indent=4,
+        default_flow_style=False,
+        sort_keys=False,
+    )
+    return "```yaml\n" + pretty_yaml + "```\n"
+
+
+def update_docs(
+    config: CoreConfig,
+    doc_path: str,
+    exclude_inherited_from: type[CoreConfig] | None = None,
+) -> None:
+    try:
+        with open(doc_path, "r") as f:
+            docs = f.readlines()
+
+        docs = append_docs(
+            docs=docs,
+            start_cmd="<!-- Start arguments -->\n",
+            end_cmd="<!-- End arguments -->\n",
+            add=get_arguments(config, exclude_inherited_from=exclude_inherited_from),
+        )
+
+        # The YAML example stays complete (every field, not just this
+        # detector's own ones) -- it's meant to be copy-pasted as a working
+        # config, so it can't skip fields just because they're documented
+        # elsewhere.
+        docs = append_docs(
+            docs=docs,
+            start_cmd="<!-- Start config -->\n",
+            end_cmd="<!-- End config -->\n",
+            add=config_yaml(config),
+        )
+
+        with open(doc_path, "w") as f:
+            f.writelines(docs)
+    except Exception as e:
+        raise Exception(f"While updating {doc_path} -> {str(e)}")
+
+
+def update_shared_docs(doc_path: str) -> None:
+    """Fill docs/detectors.md's tables of parameters shared across several
+    detectors: fields every detector has (CoreDetectorConfig), plus the two
+    families that add their own shared block on top (VariableDetectorConfig,
+    DeepLearningDetectorConfig)."""
+    try:
+        with open(doc_path, "r") as f:
+            docs = f.readlines()
+
+        docs = append_docs(
+            docs=docs,
+            start_cmd="<!-- Start common_arguments -->\n",
+            end_cmd="<!-- End common_arguments -->\n",
+            add=get_arguments(CoreDetectorConfig()),
+        )
+        docs = append_docs(
+            docs=docs,
+            start_cmd="<!-- Start variable_arguments -->\n",
+            end_cmd="<!-- End variable_arguments -->\n",
+            add=get_arguments(
+                VariableDetectorConfig(), exclude_inherited_from=CoreDetectorConfig
+            ),
+        )
+        docs = append_docs(
+            docs=docs,
+            start_cmd="<!-- Start deeplearning_arguments -->\n",
+            end_cmd="<!-- End deeplearning_arguments -->\n",
+            add=get_arguments(
+                DeepLearningDetectorConfig(), exclude_inherited_from=CoreDetectorConfig
+            ),
+        )
+
+        with open(doc_path, "w") as f:
+            f.writelines(docs)
+    except Exception as e:
+        raise Exception(f"While updating {doc_path} -> {str(e)}")
+
+
+# %% Documentation update
+#
+# Every detector config below drives its own doc page: whenever a Field is
+# added, removed or its description/default changes, re-running this script
+# (or `pytest`, which executes it as a doc example) regenerates the
+# "Configuration arguments" table and the "Start config"/"End config" YAML
+# block in the corresponding page, so the docs never drift from the code.
+#
+# Each entry's second element is the immediate base class whose fields that
+# detector's table should leave out -- CoreDetectorConfig for detectors with
+# no family in between, or VariableDetectorConfig/DeepLearningDetectorConfig
+# for the two families that add their own shared block on top. Either way,
+# the excluded fields are already documented once in docs/detectors.md by
+# update_shared_docs.
+DETECTOR_DOCS: list[tuple[CoreConfig, type[CoreConfig], str]] = [
+    (RandomDetectorConfig(), CoreDetectorConfig, "docs/detectors/random_detector.md"),
+    (
+        BigramFrequencyDetectorConfig(),
+        VariableDetectorConfig,
+        "docs/detectors/bigram_frequency.md",
+    ),
+    (CharsetDetectorConfig(), VariableDetectorConfig, "docs/detectors/charset.md"),
+    (
+        NewValueComboDetectorConfig(),
+        VariableDetectorConfig,
+        "docs/detectors/combo.md",
+    ),
+    (DeeplogDetectorConfig(), DeepLearningDetectorConfig, "docs/detectors/deeplog.md"),
+    (ECVCDetectorConfig(), CoreDetectorConfig, "docs/detectors/ecvc_detector.md"),
+    # event_sequence.md is fully hand-authored (two worked examples plus an
+    # `auto_config_params` sub-table) -- no Start/End markers, so it is not
+    # regenerated here.
+    (LogBertDetectorConfig(), DeepLearningDetectorConfig, "docs/detectors/logbert.md"),
+    (NewEventDetectorConfig(), CoreDetectorConfig, "docs/detectors/new_event.md"),
+    (NewValueDetectorConfig(), VariableDetectorConfig, "docs/detectors/new_value.md"),
+    (RuleDetectorConfig(), CoreDetectorConfig, "docs/detectors/rule_based.md"),
+    (SCVSDetectorConfig(), CoreDetectorConfig, "docs/detectors/scvs_detector.md"),
+    (
+        ValueRangeDetectorConfig(),
+        VariableDetectorConfig,
+        "docs/detectors/value_range.md",
+    ),
+]
+
+update_shared_docs("docs/detectors.md")
+
+for detector_config, exclude_base, doc_path in DETECTOR_DOCS:
+    update_docs(detector_config, doc_path=doc_path, exclude_inherited_from=exclude_base)
diff --git a/docs/examples/detectors/event_sequence.py b/docs/examples/detectors/event_sequence.py
new file mode 100644
index 00000000..20bb19e1
--- /dev/null
+++ b/docs/examples/detectors/event_sequence.py
@@ -0,0 +1,25 @@
+# --8<-- [start:example]
+from detectmatelibrary.detectors.event_sequence_detector import EventSequenceDetector, \
+    EventSequenceDetectorConfig
+import detectmatelibrary.schemas as schemas
+
+detector = EventSequenceDetector(
+    name="EventSequenceTest",
+    config=EventSequenceDetectorConfig(auto_config=False, fixed_window_size=3),
+)
+
+parser_data = schemas.ParserSchema({
+    "parserType": "test",
+    "EventID": 1,
+    "template": "test template",
+    "variables": ["var1"],
+    "logID": "1",
+    "parsedLogID": "1",
+    "parserID": "test_parser",
+    "log": "test log message",
+    "logFormatVariables": {"timestamp": "123456"}
+})
+
+
+alert = detector.process(parser_data)
+# --8<-- [end:example]
diff --git a/docs/examples/others/components_methods.py b/docs/examples/others/components_methods.py
new file mode 100644
index 00000000..f3c47040
--- /dev/null
+++ b/docs/examples/others/components_methods.py
@@ -0,0 +1,91 @@
+# flake8: noqa: F821
+# --8<-- [start:read]
+class ConfigComponent(CoreConfig):
+    """Contains all the arguments of the component."""
+
+
+class Component(CoreComponent):
+    def run(
+        self, input_: List[BaseSchema] | BaseSchema, output_: BaseSchema
+    ) -> bool:
+        """Run the component for a specific input."""
+        pass
+
+    def train(
+        self, input_: List[BaseSchema] | BaseSchema,
+    ) -> None:
+        """Train the component with a specific input."""
+        pass
+
+    def update_state(self, state: StatesL) -> None:
+        """Update the current state by request of the user.
+
+        states:
+        *   keep_training: force to keep training
+        *   stop_training: force to stop training
+        *   keep_configuring: force to keep configuring
+        *   stop_configuring: force to stop configuring
+        """
+        pass
+
+    def get_state(self) -> str:
+        """Return the current state of the component.
+
+        states:
+        *   Configuring: the component is doing configurations
+        *   Training: the component is training
+        *   Default: the component is just processing data
+        """
+        pass
+
+    def export_state(
+        self, path: str | None = None, storage_options: dict[str, Any] | None = None,
+    ) -> bytes | None:
+        """Export the current state if persistency class was implemented."""
+        pass
+
+    def import_state(
+        self, path: str | bytes, storage_options: dict[str, Any] | None = None
+    ) -> None:
+        """Import the current state if persistency class was implemented."""
+        pass
+
+    def process(self, data: BaseSchema | bytes) -> BaseSchema | bytes | None:
+        """Process the data in a stream fashion (Defined in the
+        CoreComponent)"""
+        pass
+
+    def get_config(self) -> Dict[str, Any]:
+        """Get the configuration of the component (Defined in the
+        CoreComponent)"""
+        pass
+
+    def update_config(self, new_config: Dict[str, Any]) -> None:
+        """Update the configuration of the component (Defined in the
+        CoreComponent)"""
+        pass
+
+    def get_window_size(self) -> int:
+        """Get window size of the data buffer."""
+        pass
+
+    def stack(self, other: object | list[object | bytes] | bytes) -> None:
+        """(Federation only) stack multiple components for federation tasks."""
+        pass
+
+    def aggregate(self, unstack: bool = False) -> None | bytes:
+        """(Federation only) aggregate multiple components."""
+        pass
+
+    def to_binary(self) -> bytes | None:
+        """(Federation only) fill it to be compatible with federation ops."""
+        pass
+
+    def from_binary(self, binary: bytes) -> object:
+        """(Federation only) fill it to be compatible with federation ops."""
+        pass
+
+    def aggregate_strategy(self, components: set["FedOperations"]) -> None:
+        """(Federation only) fill it to be compatible with federation ops."""
+        pass
+# --8<-- [end:read]
diff --git a/docs/examples/others/quickstart.py b/docs/examples/others/quickstart.py
new file mode 100644
index 00000000..7a79f30c
--- /dev/null
+++ b/docs/examples/others/quickstart.py
@@ -0,0 +1,29 @@
+# --8<-- [start:parse]
+from pathlib import Path
+from detectmatelibrary.parsers.template_matcher import MatcherParser
+from detectmatelibrary.helper.from_to import From, To
+
+ROOT = Path.cwd().resolve().parents[0]  # adjust if needed
+templates_path = str(ROOT / "tests" / "test_data" / "audit_templates.txt")
+log_path = str(ROOT / "tests" / "test_data" / "audit.log")
+log_json = str(ROOT / "local" / "audit_raw.json")
+parsed_path = str(ROOT / "local" / "audit_parsed.json")
+
+config_dict = {
+    "parsers": {
+        "MatcherParser": {
+            "auto_config": True,
+            "method_type": "matcher_parser",
+            "path_templates": templates_path,
+            "log_format": r"type=<Type> msg=audit\(<Time>:<Serial>\): <Content>",
+        }
+    }
+}
+parser = MatcherParser(name="MatcherParser", config=config_dict)
+
+raw_logs = list(From.log(parser, log_path, do_process=False))
+parsed_logs = [parser.process(log) for log in raw_logs]
+
+To.json(raw_logs, log_json)
+To.json(parsed_logs, parsed_path)
+# --8<-- [end:parse]
diff --git a/docs/examples/others/tutorial.py b/docs/examples/others/tutorial.py
new file mode 100644
index 00000000..07be93a3
--- /dev/null
+++ b/docs/examples/others/tutorial.py
@@ -0,0 +1,123 @@
+# --8<-- [start:read]
+from pathlib import Path
+from detectmatelibrary.helper.from_to import From
+
+try:
+    ROOT = Path(__file__).resolve().parents[3]
+except NameError:  # running inside a Jupyter notebook
+    ROOT = Path.cwd().resolve().parents[1]
+
+log_path = str(ROOT / "tests" / "test_data" / "logs.log")
+
+# do_process=False turns From.log into a pure reader: it yields raw
+# LogSchema objects without running them through a parser yet, so the
+# `component` argument (normally a parser) is never touched and can be
+# left as None. That's all we need to look at the data before deciding
+# how to parse it.
+raw_logs = list(From.log(None, log_path, do_process=False))
+print(f"read {len(raw_logs)} raw log lines")
+print(raw_logs[0]["log"])
+# --8<-- [end:read]
+
+# --8<-- [start:own_parser]
+from detectmatelibrary.parsers.template_matcher import MatcherParser  # noqa: E402
+
+templates_path = str(ROOT / "tests" / "test_data" / "logs_templates.txt")
+
+config_dict = {
+    "parsers": {
+        "MatcherParser": {
+            "auto_config": True,
+            "method_type": "matcher_parser",
+            "path_templates": templates_path,
+            "log_format": "type=<Type> msg=audit(<Time>:<Serial>): <Content>",
+        }
+    }
+}
+parser = MatcherParser(name="MatcherParser", config=config_dict)
+
+parsed_logs = [parser.process(raw) for raw in raw_logs]
+for plog in parsed_logs:
+    print(plog["EventID"], plog["template"])
+# --8<-- [end:own_parser]
+
+# --8<-- [start:detectors]
+from detectmatelibrary.detectors.new_value_detector import NewValueDetector  # noqa: E402
+from detectmatelibrary.detectors.event_sequence_detector import EventSequenceDetector  # noqa: E402
+
+# NewValueDetector watches two fields we picked while writing the templates
+# above: the key=value pair inside CONFIG_CHANGE (EventID 1, position 0) and
+# the process name inside SYSCALL (EventID 2, position 22, see the "comm="
+# slot in the third template line).
+new_value_detector = NewValueDetector(
+    name="NewValueDetector",
+    config={
+        "detectors": {
+            "NewValueDetector": {
+                "method_type": "new_value_detector",
+                "auto_config": False,
+                # Train on the first 3 logs (one DAEMON_START, one
+                # CONFIG_CHANGE, one SYSCALL), then detect on the rest.
+                "data_use_training": 3,
+                "params": {},
+                "events": {
+                    1: {"op_change": {"variables": [{"pos": 0, "name": "op_value"}]}},
+                    2: {"proc": {"variables": [{"pos": 22, "name": "comm"}]}},
+                },
+            }
+        }
+    },
+)
+
+# EventSequenceDetector instead watches the *order* of EventIDs, independent
+# of what's inside each log. A window of 2 means it remembers which
+# consecutive event-ID pairs occurred during training.
+event_sequence_detector = EventSequenceDetector(
+    name="EventSequenceDetector",
+    config={
+        "detectors": {
+            "EventSequenceDetector": {
+                "method_type": "event_sequence_detector",
+                "auto_config": False,
+                "data_use_training": 3,
+                "params": {"fixed_window_size": 2},
+            }
+        }
+    },
+)
+
+alerts = []
+print(f"{'#':>2}  {'EventID':>7}  {'NewValue':>8}  {'EventSequence':>13}")
+for i, plog in enumerate(parsed_logs, start=1):
+    nv_alert = new_value_detector.process(plog)
+    es_alert = event_sequence_detector.process(plog)
+    print(
+        f"{i:>2}  {plog['EventID']:>7}  {str(bool(nv_alert)):>8}  {str(bool(es_alert)):>13}"
+    )
+    if nv_alert:
+        alerts.append(nv_alert)
+    if es_alert:
+        alerts.append(es_alert)
+# --8<-- [end:detectors]
+
+# --8<-- [start:aggregate]
+from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation  # noqa: E402
+
+aggregator = BasicConcatAggregation(
+    name="BasicConcatAggregator",
+    config={
+        "alert_aggregators": {
+            "BasicConcatAggregator": {
+                "method_type": "basic_concat_aggregator",
+                "buffer_size": 2,
+                "auto_config": False,
+            }
+        }
+    },
+)
+
+for alert in alerts:
+    aggregated = aggregator.process(alert)
+    if aggregated:
+        print(aggregated["detectorIDs"], aggregated["logIDs"])
+# --8<-- [end:aggregate]
diff --git a/docs/helper/from_to.md b/docs/helper/from_to.md
index 7caacf8d..81de7c6e 100644
--- a/docs/helper/from_to.md
+++ b/docs/helper/from_to.md
@@ -42,7 +42,7 @@ class From:
         component: CoreComponent,
         df: DataFrame | LazyFrame,
         do_process: bool = True,
-        renames: dict[str, str] | None = None
+        renames: dict[str, str] | None = None,
     ) -> Iterator[BaseSchema]:
         """
         Load Polars dataframe as input schemas follow DetectMatePerformance format.
@@ -122,15 +122,21 @@ The `FromTo` class loads and saves inputs and outputs in a single operation.
 ```python
 class FromTo:
     @staticmethod
-    def log2binary_file(component: CoreComponent, in_path: str, out_path: str) -> Iterator[BaseSchema]:
+    def log2binary_file(
+        component: CoreComponent, in_path: str, out_path: str
+    ) -> Iterator[BaseSchema]:
         """Load a log file and save it to a binary file."""
 
     @staticmethod
-    def log2json(component: CoreComponent, in_path: str, out_path: str) -> Iterator[BaseSchema]:
+    def log2json(
+        component: CoreComponent, in_path: str, out_path: str
+    ) -> Iterator[BaseSchema]:
         """Load a log file and save it to a JSON file."""
 
     @staticmethod
-    def log2yaml(component: CoreComponent, in_path: str, out_path: str) -> Iterator[BaseSchema]:
+    def log2yaml(
+        component: CoreComponent, in_path: str, out_path: str
+    ) -> Iterator[BaseSchema]:
         """Load a log file and save it to a YAML file."""
 
     @staticmethod
@@ -192,7 +198,7 @@ class FromTo:
         component: CoreComponent,
         df: DataFrame | LazyFrame,
         out_path: str,
-        renames: dict[str, str] | None = None
+        renames: dict[str, str] | None = None,
     ) -> Iterator[BaseSchema]:
         """Load DetectMatePerformance Dataframe to binary file"""
 
@@ -201,7 +207,7 @@ class FromTo:
         component: CoreComponent,
         df: DataFrame | LazyFrame,
         out_path: str,
-        renames: dict[str, str] | None = None
+        renames: dict[str, str] | None = None,
     ) -> Iterator[BaseSchema]:
         """Load DetectMatePerformance Dataframe to json"""
 
@@ -210,7 +216,7 @@ class FromTo:
         component: CoreComponent,
         df: DataFrame | LazyFrame,
         out_path: str,
-        renames: dict[str, str] | None = None
+        renames: dict[str, str] | None = None,
     ) -> Iterator[BaseSchema]:
         """Load DetectMatePerformance Dataframe to yaml"""
 ```
diff --git a/docs/index.md b/docs/index.md
index f92468a5..97977898 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,39 +1,34 @@
 # DetectMate Library
 
-Welcome to the documentation for the DetectMate Library . DetectMate is a flexible, component-based library for parsing and log anomaly detection. It can be used flexibly in research applications, and when used with the [DetectMate Service](https://github.com/ait-detectmate/DetectMateService/tree/main), it can be easily deployed in microservice architectures.
+Welcome to the documentation for the DetectMate Library. DetectMate is a flexible,
+component-based library for parsing and log anomaly detection. It can be used in research and production,
+and together with the
+[DetectMate Service](https://github.com/ait-detectmate/DetectMateService/tree/main)
+it deploys into microservice architectures.
 
+## User Guide
 
+Start here if you are new to the library and want a quick overview of what it can do and where it fits.
 
-## Getting started
+* [What is DetectMate?](user_guide/what_is_detectmate.md)
+* [Installation](user_guide/installation.md)
+* [Basic knowledge](user_guide/basic_knowledge.md)
+* [Quickstart](user_guide/quickstart.md)
+* [Tutorial (end-to-end)](user_guide/tutorial.md)
 
-List of steps to follow for new users of the library:
+## Advanced Guide
 
-* [Installation](installation.md): steps to install all the components need it.
-* [Basic usage](basic_usage.md): create a basic script with the different components.
-* [Create new component](create_components.md): guide to use the mate commands.
+Here you can get the full scope.
 
-## Components
+* [Overall architecture](advanced/overall_architecture.md)
+* [Schemas](schemas.md)
+* [Parsers](parsers.md)
+* [Detectors](detectors.md)
+* [Alert Aggregation](alert_aggregator.md)
+* [Federation](federation.md)
 
-Documentation of the different components:
+## How to contribute
 
-* [Basic concepts](basic_idea.md): basic concepts need it to understand log anomaly detection.
-* [Overall architecture](overall_architecture.md): overall architecture of the library.
-* [Schemas](schemas.md): documentation of the different schemas in the library.
-* [Parsers](parsers.md): documentation of the different parsers.
-* [Detectors](detectors.md): documentation of the different detectors.
-
-## Utils
-
-Tools that are used in the different components:
-
-* [Data Buffer](auxiliar/input_buffer.md): it takes the stream data and formated to the specifications given.
-* [Persistency](auxiliar/persistency.md): provides event-based state management for detectors.
-
-## Helper
-Tools that their main objective is to help the developer:
-
-* [From_to](helper/from_to.md): set of methods to save and load inputs and outputs from files.
-
-## Other
-
-* [Log Formats](other/log_formats.md): reference catalog of 18 common log formats with parser configuration.
+* [Contributing](contribution.md)
+* [Development](development.md)
+* [Release Process](release.md).
diff --git a/docs/other/log_formats.md b/docs/other/log_formats.md
index 43eb1857..a4d8c4c7 100644
--- a/docs/other/log_formats.md
+++ b/docs/other/log_formats.md
@@ -2,7 +2,7 @@
 
 This catalog covers 18 common log formats and provides ready-to-use `log_format` patterns for the DetectMate parsers, such as the [MatcherParser](../parsers/template_matcher.md).
 
-**Key concept:** `log_format` splits a raw log line into structured header fields that become entries in `ParserSchema.logFormatVariables`. The special `<Content>` token captures the variable message body, which is then matched against your template file to produce `EventID` and `variables`. Formats without `<Content>` are fully structured — no template file is needed.
+**Key concept:** `log_format` splits a raw log line into structured header fields that become entries in `ParserSchema.logFormatVariables`. The special `<Content>` token captures the variable message body, which is then matched against your template file to produce `EventID` and `variables`. Formats without `<Content>` are fully structured  --  no template file is needed.
 
 **Generic configuration:**
 
@@ -77,7 +77,7 @@ Dec 10 07:07:38 LabSZ sshd[24206]: Failed password for invalid user test9 from 1
 
 ### ApacheAccess
 
-Apache httpd access log (Combined Log Format). Each line is fully structured — no template file is required.
+Apache httpd access log (Combined Log Format). Each line is fully structured  --  no template file is required.
 
 ```text
 64.242.88.10 - - [07/Mar/2004:16:10:02 -0800] "GET /twiki/bin/edit/Main/Double_bounce_sender?topicparent=Main.ConfigurationVariables HTTP/1.1" 401 12846 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2) Gecko/20021202"
@@ -237,7 +237,7 @@ Thunderbird supercomputer log. Similar to BGL but from a different cluster; incl
 
 ### Linux
 
-Linux syslog format (RFC 3164). Produced by `syslog`, `rsyslog`, and `syslog-ng` — covers auth, cron, kernel messages, and more.
+Linux syslog format (RFC 3164). Produced by `syslog`, `rsyslog`, and `syslog-ng`  --  covers auth, cron, kernel messages, and more.
 
 ```text
 Jun 14 15:16:02 combo sshd(pam_unix)[19939]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=218.188.2.4
diff --git a/docs/overall_architecture.md b/docs/overall_architecture.md
deleted file mode 100644
index 77850f6e..00000000
--- a/docs/overall_architecture.md
+++ /dev/null
@@ -1,111 +0,0 @@
-# Overall architecture
-
-This document describes the high-level design of the DetectMateLibrary, how components interact, the data contracts they use, and guidance for deploying and extending the system. The library is built around small, composable components that operate on streaming log data and exchange strongly-typed Schema objects.
-
-Key goals
-
-- Clear separation of concerns (reading, parsing, detection, output).
-- Stream-friendly processing with minimal buffering.
-- Well-defined schema contracts so components can be composed or run as microservices.
-- Easy extensibility: add new readers, parsers or detectors by subclassing core base classes.
-
-## Components flow
-
-The pipeline is strictly directional:
-
-- **Parser**: consumes raw logs and produces parsed log objects (structured fields, timestamps, variables).
-- **Detector**: consumes parsed logs and generates alerts/findings when rules or models match anomalous behavior.
-- **Alert Aggregation**: consumes alerts and aggregates them.
-
-Each arrow represents a stream of [Schema objects](schemas.md). Components are designed to run in the same process for lightweight setups or as separate services for scalable deployments.
-
-![DIAGRAM](img/diagrams_structure.png)
-
-
-## Components architecture
-
-All components inherit from a `CoreComponent` class. This class provides all the essential functionality required for DetectMate to operate (see UML diagram below). Every [Detector](detectors.md) must inherit from `CoreDetector`, every [AlertAggregator](alert_aggregator.md) must inherit from `CoreAlertAggregation` and every [Parser](parsers.md) must inherit from `CoreParser` to ensure compatibility with DetectMate.
-
-Each component’s arguments must be stored in its corresponding configuration class. These config classes follow the same design pattern as their components and must inherit from `CoreConfig`.
-
-![UML](img/uml_structure.png)
-
-
-## Components methods
-
-Each Core* base class exposes a small, stable API that implementations must implement or may override.
-
-```python
-class ConfigComponent(CoreConfig):
-    """Contains all the arguments of the component"""
-
-
-class Component(CoreComponent):
-    def run(
-        self, input_: List[BaseSchema] | BaseSchema, output_: BaseSchema
-    ) -> bool:
-    """Run the component for a specific input"""
-
-    def train(
-        self, input_: List[BaseSchema] | BaseSchema,
-    ) -> None:
-    """Train the component with a specific input"""
-
-    def update_state(self, state: StatesL) -> None:
-    """
-    Update the current state by request of the user
-    states:
-    *   keep_training: force to keep training
-    *   stop_training: force to stop training
-    *   keep_configuring: force to keep configuring
-    *   stop_configuring: force to stop configuring
-    """
-
-    def get_state(self) -> str:
-    """
-    Return the current state of the component
-    states:
-    *   Configuring: the component is doing configurations
-    *   Training: the component is training
-    *   Default: the component is just processing data
-    """
-
-    def export_state(
-        self, path: str | None = None, storage_options: dict[str, Any] | None = None,
-    ) -> bytes | None:
-    """Export the current state if persistency class was implemented"""
-
-    def import_state(
-        self, path: str | bytes, storage_options: dict[str, Any] | None = None
-    ) -> None:
-    """Import the current state if persistency class was implemented"""
-
-    def process(self, data: BaseSchema | bytes) -> BaseSchema | bytes | None:
-    """Process the data in a stream fashion (Defined in the CoreComponent)"""
-
-    def get_config(self) -> Dict[str, Any]:
-    """Get the configuration of the component (Defined in the CoreComponent)"""
-
-    def update_config(self, new_config: Dict[str, Any]) -> None:
-    """Update the configuration of the component (Defined in the CoreComponent)"""
-
-    def get_window_size(self) -> int:
-    """Get window size of the data buffer"""
-
-    def stack(self, other: object | list[object | bytes] | bytes) -> None:
-    """(Federation only) stack multiple components for federation tasks"""
-
-    def aggregate(self, unstack: bool = False) -> None | bytes:
-    """(Federation only) aggregate multiple components"""
-
-    def to_binary(self) -> bytes | None:
-    """(Federation only) fill it to be compatible with federation ops"""
-
-    def from_binary(self, binary: bytes) -> object:
-    """(Federation only) fill it to be compatible with federation ops"""
-
-    def aggregate_strategy(self, components: set["FedOperations"]) -> None:
-    """(Federation only) fill it to be compatible with federation ops"""
-```
-
-Go back [Index](index.md)
diff --git a/docs/parsers.md b/docs/parsers.md
index 96b46b1f..448a14d8 100644
--- a/docs/parsers.md
+++ b/docs/parsers.md
@@ -1,4 +1,4 @@
-# Components: Parsers
+# Parsers
 
 Parsers convert unstructured raw logs into structured ParserSchema objects that downstream detectors consume.
 
@@ -15,7 +15,7 @@ This document explains expected APIs, how to implement a parser, testing tips an
 - `CoreParser.run()` handles lifecycle and calls `parse()` for each input; implement pure parsing logic inside `parse()` where possible.
 - Use a typed `Config` class (subclass of `CoreParserConfig`) to hold runtime parameters.
 
-## CoreParser — minimal API
+## CoreParser  --  minimal API
 
 Recommended signatures and behavior:
 
@@ -36,18 +36,18 @@ class CoreParser:
         """Optional: train internal models. Can be a no-op for stateless parsers."""
 ```
 
-## ParserSchema — what to populate
+## ParserSchema  --  what to populate
 
 Minimum fields commonly expected by downstream components:
 
-- `EventID` (int) — identifier for the matched template/event
-- `template` (string) — event template text
-- `variables` (repeated string) — extracted parameters (extend the list)
-- `parsedLogID` / `logID` — identifiers linking raw and parsed records
-- `parsedTimestamp` / `receivedTimestamp` — timestamps
+- `EventID` (int)  --  identifier for the matched template/event
+- `template` (string)  --  event template text
+- `variables` (repeated string)  --  extracted parameters (extend the list)
+- `parsedLogID` / `logID`  --  identifiers linking raw and parsed records
+- `parsedTimestamp` / `receivedTimestamp`  --  timestamps
 
 
-## Creating a new parser — step by step
+## Creating a new parser  --  step by step
 
 1. Create a Config class inheriting `CoreParserConfig`.
 2. Create parser class inheriting `CoreParser`.
@@ -62,13 +62,19 @@ from detectmatelibrary.common.parser import CoreParser, CoreParserConfig
 from detectmatelibrary import schemas
 from typing import Any
 
+
 class MyParserConfig(CoreParserConfig):
     method_type: str = "my_parser"
     # add parser-specific settings here
     pattern: str | None = None
 
+
 class MyParser(CoreParser):
-    def __init__(self, name: str = "MyParser", config: MyParserConfig | dict[str, Any] = MyParserConfig()):
+    def __init__(
+        self,
+        name: str = "MyParser",
+        config: MyParserConfig | dict[str, Any] = MyParserConfig(),
+    ):
         if isinstance(config, dict):
             config = MyParserConfig.from_dict(config, name)
         super().__init__(name=name, config=config)
diff --git a/docs/parsers/json_parser.md b/docs/parsers/json_parser.md
index f65e3e94..e38cc6fd 100644
--- a/docs/parsers/json_parser.md
+++ b/docs/parsers/json_parser.md
@@ -11,7 +11,7 @@ Extracts structured information from JSON-formatted logs. Optionally delegates p
 
 Relevant config options:
 
-- `method_type` (string): parser type identifier — must be `json_parser`.
+- `method_type` (string): parser type identifier  --  must be `json_parser`.
 - `params.timestamp_name` (string): JSON key to use as the timestamp (default `"time"`).
 - `params.content_name` (string): JSON key whose value is forwarded to the content parser (default `"message"`).
 - `params.content_parser` (string): name of a **sibling** parser entry in the `parsers` section that handles the content field (default `"JsonMatcherParser"`).
@@ -27,7 +27,7 @@ parsers:
     params:
       timestamp_name: "time"
       content_name: "message"
-      content_parser: JsonMatcherParser   # optional — defaults to "JsonMatcherParser"
+      content_parser: JsonMatcherParser   # optional  --  defaults to "JsonMatcherParser"
   JsonMatcherParser:
     method_type: matcher_parser
     params:
@@ -37,13 +37,13 @@ parsers:
 
 ## Usage examples
 
-Basic usage — parse JSON and extract fields (no template matching):
+Basic usage  --  parse JSON and extract fields (no template matching):
 
 ```python
 --8<-- "docs/examples/parsers/json_parser.py:basic"
 ```
 
-Dict-based config (from YAML) — with template matching on the `message` field:
+Dict-based config (from YAML)  --  with template matching on the `message` field:
 
 ```python
 --8<-- "docs/examples/parsers/json_parser.py:dict-based"
diff --git a/docs/parsers/logbatcher_parser.md b/docs/parsers/logbatcher_parser.md
index 015384fd..bc0f8f6d 100644
--- a/docs/parsers/logbatcher_parser.md
+++ b/docs/parsers/logbatcher_parser.md
@@ -21,8 +21,8 @@ uv sync --extra llm
 
 `LogBatcherParser` wraps the [LogBatcher](https://github.com/LogIntelligence/LogBatcher) engine (MIT, LogIntelligence 2024) as a `CoreParser`. Parsing proceeds in two phases:
 
-1. **Cache lookup** — the incoming log is matched against previously seen templates using a hash-based exact match followed by a tree-based similarity check. If a match is found, no LLM call is made.
-2. **LLM query** — on a cache miss, the log is submitted to the configured model. The returned template is stored in the cache for future reuse.
+1. **Cache lookup**  --  the incoming log is matched against previously seen templates using a hash-based exact match followed by a tree-based similarity check. If a match is found, no LLM call is made.
+2. **LLM query**  --  on a cache miss, the log is submitted to the configured model. The returned template is stored in the cache for future reuse.
 
 Variable slots in templates use the `<*>` wildcard notation (e.g. `User <*> logged in from <*>`). Extracted variables are written to `output_["variables"]` in order of appearance.
 
@@ -63,7 +63,7 @@ parsers:
 
 ## Usage examples
 
-Basic usage — set up the parser (parsing requires a valid API key):
+Basic usage  --  set up the parser (parsing requires a valid API key):
 
 ```python
 --8<-- "docs/examples/parsers/logbatcher_parser.py:basic"
diff --git a/docs/parsers/template_matcher.md b/docs/parsers/template_matcher.md
index ab9b957e..48388829 100644
--- a/docs/parsers/template_matcher.md
+++ b/docs/parsers/template_matcher.md
@@ -68,7 +68,7 @@ parsers:
 
 ## Usage examples
 
-Simple usage — load templates and match a log:
+Simple usage  --  load templates and match a log:
 
 ```python
 --8<-- "docs/examples/parsers/template_matcher.py:example"
diff --git a/docs/parsers/template_tree_matcher.md b/docs/parsers/template_tree_matcher.md
index 4e7448b3..f17facdc 100644
--- a/docs/parsers/template_tree_matcher.md
+++ b/docs/parsers/template_tree_matcher.md
@@ -44,7 +44,7 @@ parsers:
 
 ## Usage example
 
-Simple usage — load templates and match a log:
+Simple usage  --  load templates and match a log:
 
 ```python
 --8<-- "docs/examples/parsers/template_tree_matcher.py"
diff --git a/docs/user_guide/basic_knowledge.md b/docs/user_guide/basic_knowledge.md
new file mode 100644
index 00000000..ab096de2
--- /dev/null
+++ b/docs/user_guide/basic_knowledge.md
@@ -0,0 +1,102 @@
+# Basic knowledge
+
+Before you continue we have to give some insights on the rudimental topics of log anomaly detection.
+
+## What is a log?
+
+Logs are messages produced by logging statements in code that describe events or
+states during execution. For example:
+
+```python
+import logging
+
+var1 = "DetectMate getting started"
+var2 = "what is a log"
+logging.info(f"hello I am a log about {var1} and about {var2}")
+```
+
+produces the message:
+
+```text
+hello I am a log about DetectMate getting started and about what is a log
+```
+
+A log message can be split into two parts: a **static part** that stays the same
+every time the message is logged, and a **variable part** that changes from one
+log to the next.
+
+Take this log line (from now on we refer to log messages as *lines*):
+
+```text
+User alice logged in from 192.168.0.5
+```
+
+The static parts here are `User` and `logged in from`, because they don't change across logging statements.
+`alice` and `192.168.0.5` do change, as you can see in the next one:
+
+```text
+User bob logged in from 10.0.0.2
+```
+
+Now the name `alice` changed to `bob` for example.
+
+In DetectMate the static part is called the **template**, and the placeholders
+are marked with `<*>`. The variable parts are extracted into a separate list of
+**variables**.
+
+Logs often include a prefix with metadata, such as a timestamp, log level, or
+hostname.
+
+In plain terms: the **prefix** is just the part that comes first, before the
+real message. The **metadata** is extra information *about* the log (when it
+happened, how important it is, which machine sent it) rather than the message
+itself. Think of it like the sender and date stamped on an envelope: useful to
+know, but not the letter inside.
+For example:
+
+```text
+INFO [18-05-2005] hello I am a log about DetectMate getting started
+```
+
+This line has three parts:
+
+- **`INFO` -- the category of the message (the "log level").** Some other
+messages from the programm could be for example `DEBUG` (fine-grained detail for developers) or `WARNING` (something looks off, but it´s not a failure yet). So this part just gives you a hint how important this logging statement is.
+
+- **`[18-05-2005]` -- the timestamp:** when the message was written.
+
+- **`hello I am a log...` -- the actual text:** what the program wants to tell you.
+
+The log level sits at the very front because it acts as a filter: in real systems thousands of lines pile up every second, so you can say e.g. "only show me `WARNING` and worse." That way both humans and machines can instantly decide whether a line is relevant.
+
+## What is a parsed log?
+
+A parsed log is a raw log that has been decomposed into structured fields: the
+log is split at the right points and each part is labelled with what it is
+(template, variables, timestamp, and so on).
+
+The pattern that tells the parser how to split a line is called the
+**`log_format`**. It names the fields in the order they appear in the raw line,
+so the parser knows which chunk is the log level, which is the timestamp, and
+which is the actual message content.
+
+The term `log_format`is regularly used in the literature. Such as in the
+**Drain-Parser**, **LogParser**, and many more use it frequently.
+
+Based on the example above:
+
+    log_format: <Level> [<Time>] <Content>
+    template:   hello I am a log about <*> and about <*>
+
+A parsed log would contain fields like:
+
+| Field              | Value                                                  |
+|--------------------|--------------------------------------------------------|
+| Template           | `hello I am a log about <*> and about <*>`              |
+| Variables          | `["DetectMate getting started", "what is a log"]`      |
+| LogFormatVariables | `{"Level": "INFO", "Time": "18-05-2005"}`              |
+
+Parsed logs expose structured data that downstream detection components use for
+anomaly detection.
+
+Go back [Index](../index.md)
diff --git a/docs/installation.md b/docs/user_guide/installation.md
similarity index 55%
rename from docs/installation.md
rename to docs/user_guide/installation.md
index 1461f00a..830a20bc 100644
--- a/docs/installation.md
+++ b/docs/user_guide/installation.md
@@ -1,31 +1,25 @@
-# Getting started: Installation
+# Installation
 
-This document explains how to set up and run DetectMateLibrary for users and developers.
-
-## User setup
-
-**Purpose**: install the library so you can import and use DetectMate in your projects.
-
-**Recommended**: use the provided `uv` helper (bundled Python environment manager used in this repo). If you prefer pip/venv, create a virtualenv first.
-
-Install the package in editable mode:
+It is recommended to use [uv](https://docs.astral.sh/uv/) for installation. From
+the project root:
 
 ```bash
 uv sync
 ```
 
-**Result**: the package is installed into the active Python environment and changes to the source tree are reflected immediately.
+(If you prefer pip/venv, create a virtualenv first.)
 
-To install it in a different venv as a library:
+Changes to the source tree are then reflected immediately. To install DetectMate
+as a library into a different environment instead:
 
 ```bash
 uv pip install --no-cache-dir <directory_detectmatelibrary>
 ```
 
-### Optional dependencies
+## Optional dependencies
 
-Not all features require the same dependencies. DetectMateLibrary uses optional extras so you only install what you need:
-Optional Dependency Groups https://pydevtools.com/handbook/explanation/what-are-optional-dependencies-and-dependency-groups/
+Not every feature needs the same dependencies, so DetectMate uses optional
+extras --> you install only what you need.
 
 | Extra | Installs | When you need it |
 |---|---|---|
@@ -34,13 +28,15 @@ Optional Dependency Groups https://pydevtools.com/handbook/explanation/what-are-
 | `polars-rtcompat` | `polars[rtcompat]` | Running on older CPUs without AVX2 support (e.g. some VMs or embedded hardware); not needed for standard deployments |
 | `full` | `llm` + `dataframes` + `polars-rtcompat` | Installing every optional extra at once |
 
+To have a closer look at all the dependencies, see [Optional dependencies](https://pydevtools.com/handbook/explanation/what-are-optional-dependencies-and-dependency-groups/).
+
 Install an extra with `uv sync`:
 
 ```bash
 uv sync --extra dataframes
 ```
 
-Or with `uv pip install` / pip when installing as a library:
+Or with `uv pip install` / `pip` when installing as a library:
 
 ```bash
 uv pip install "detectmatelibrary[dataframes]"
@@ -64,32 +60,30 @@ uv pip install "detectmatelibrary[full]"
 
 ## Developer setup
 
-**Purpose**: prepare a development environment with test and lint tooling.
-
 ### Step 1: Install Python development dependencies & pre-commit hooks
 
-- Install dev dependencies (testing, linters, formatters). The `dev` group also pulls in the `full` extra, so every optional dependency (LLM, dataframes, polars-rtcompat) is installed too:
+* Install dev dependencies (testing, linters, formatters). The `dev` group also pulls in the `full` extra, so every optional dependency (LLM, dataframes, polars-rtcompat) is installed too:
 
 ```bash
 uv sync --dev
 ```
 
-- Install pre-commit hooks (this repository uses `prek` to run pre-commit tooling):
+* Install pre-commit hooks (this repository uses `prek` to run pre-commit tooling):
 
 ```bash
 uv run --dev prek install
 ```
 
-**Notes**:
+**Notes:**
 
-- Ensure `uv` is available in PATH. If not, use your system Python + virtualenv and then `uv sync --dev`.
-- Run the pre-commit hooks locally with `uv run --dev prek run -a` before committing to catch style/typing issues early.
+* Ensure `uv` is available in PATH. If not, use your system Python + virtualenv and then `uv sync --dev`.
+* Run the pre-commit hooks locally with `uv run --dev prek run -a` before committing to catch style/typing issues early.
 
 ### Step 2: Install Protobuf toolchain (only if you change proto files)
 
-**Purpose**: compile .proto definitions into Python code.
+**Purpose:** compile `.proto` definitions into Python code.
 
-Install protoc on Debian/Ubuntu:
+* Install `protoc` on Debian/Ubuntu:
 
 ```bash
 sudo apt-get update
@@ -97,7 +91,7 @@ sudo apt-get install -y protobuf-compiler
 protoc --version
 ```
 
-Compile the project proto:
+* Compile the project proto:
 
 ```bash
 protoc \
@@ -106,7 +100,7 @@ protoc \
   src/detectmatelibrary/schemas/schemas.proto
 ```
 
-**Result**: generated Python modules appear under `src/detectmatelibrary/schemas/`. If you edit proto files, re-run this command and commit generated code if required by your workflow.
+**Result:** generated Python modules appear under `src/detectmatelibrary/schemas/`. If you edit proto files, re-run this command and commit generated code if required by your workflow.
 
 ### Step 3: Run unit tests
 
@@ -116,20 +110,20 @@ The full test suite covers dataframe and LLM-parser code, so all extras must be
 uv run --dev pytest -s
 ```
 
-Run tests with coverage (terminal summary):
+* Run tests with coverage (terminal summary):
 
-```bash
+````bash
 uv run --dev pytest --cov=. --cov-report=term-missing
-```
+````
 
-**Tips**:
+**Tips:**
 
-- Run a single test or directory to speed iteration: `uv run --dev pytest tests/some_test.py::test_name -q`
+* Run a single test or directory to speed iteration: `uv run --dev pytest tests/some_test.py::test_name -q`
 
-## Troubleshooting
+### Troubleshooting
 
-- If `uv` is unavailable, use a Python virtualenv and the `pip`/`pytest` commands directly.
-- If `protoc` is missing, install the system package or download a prebuilt binary for your OS.
-- Always run commands from the project root so file paths (pyproject.toml, src/) resolve correctly.
+* If `uv` is unavailable, use a Python virtualenv and the `pip`/`pytest` commands directly.
+* If `protoc` is missing, install the system package or download a prebuilt binary for your OS.
+* Always run commands from the project root so file paths (`pyproject.toml`, `src/`) resolve correctly.
 
-Go back to [Index](index.md) or proceed to [Basic usage](basic_usage.md).
+Go back [Index](../index.md)
diff --git a/docs/user_guide/quickstart.md b/docs/user_guide/quickstart.md
new file mode 100644
index 00000000..db57e1f8
--- /dev/null
+++ b/docs/user_guide/quickstart.md
@@ -0,0 +1,24 @@
+# Quickstart
+
+This quickstart shows how to parse a log dataset (we use data from the
+[AIT Log Data Set V2.0](https://zenodo.org/records/5789064)) and then run a
+detector to check whether the dataset contains anomalies. We use the
+`MatcherParser` and the `RandomDetector`.
+
+## 1. Parse the logs
+
+```python
+--8<-- "docs/examples/others/quickstart.py:parse"
+```
+
+## 2. Run the detector
+
+```python
+--8<-- "docs/examples/detectors/random_detector.py"
+```
+## Common pitfalls
+
+* When re-running the parser code, delete `audit_raw.json` and `audit_parsed.json`
+  first if you want to execute it again --> otherwise output is appended to stale files.
+
+Go back [Index](../index.md)
diff --git a/docs/user_guide/tutorial.md b/docs/user_guide/tutorial.md
new file mode 100644
index 00000000..5e8a266a
--- /dev/null
+++ b/docs/user_guide/tutorial.md
@@ -0,0 +1,246 @@
+# Tutorial (end-to-end)
+
+A complete walkthrough of using DetectMate  --  more detailed than the
+[Quickstart](quickstart.md). The Quickstart parses a ready-made dataset with a
+ready-made template file and runs one detector. This tutorial goes one level
+deeper:
+
+- you parse a dataset that has no template file yet, so you write the templates
+  yourself
+- you run two detectors that look for different kinds of anomalies and compare
+  what each one finds
+- you combine their alerts with an alert aggregator
+
+By the end you should have seen most of what the library can do and, more
+importantly, understand *why* each piece behaves the way it does.
+
+## 1. Read a different dataset from scratch
+
+The Quickstart uses the `audit.log` dataset, which already ships with a
+matching `audit_templates.txt`. To actually practice building
+something, this tutorial uses a different file instead:
+`tests/test_data/logs.log`. It is still Linux `auditd` output  --  same overall
+shape as the Quickstart's dataset  --  but recorded on a different machine, and
+it comes with **no template file**. That is the point: before you can parse
+it, you have to look at it.
+
+> Note: you likely have to edit your Path to your project root. In this code snippet we assume, that your
+> notebook lives two folders below the project root. If it sits somewhere else, adjust `parents[...]` (for a
+> script) or the `Path.cwd()` line (for a notebook) accordingly.
+
+```python
+--8<-- "docs/examples/others/tutorial.py:read"
+```
+
+`From.log` is the same helper used in the Quickstart (see the
+[From helper](../helper/from.md) docs). Passing `do_process=False`
+turns it into a plain file reader that hands back [`LogSchema`](../schemas.md)
+objects instead of running them through a parser  --  exactly what you want
+before you've decided how to parse the data.
+
+The file only has 9 lines, small enough to read in full:
+
+```text
+type=DAEMON_START msg=audit(1757673850.240:4506): op=start ver=3.0.9 format=enriched kernel=6.6.62+rpt-rpi-2712 auid=4294967295 pid=691 uid=0 ses=4294967295 res=success...
+type=CONFIG_CHANGE msg=audit(1757673850.283:3): op=set audit_backlog_limit=8192 old=64 auid=4294967295 ses=4294967295 res=1...
+type=SYSCALL msg=audit(1757673850.283:3): arch=c00000b7 syscall=206 success=yes exit=60 a0=3 a1=7fffc27ad8f0 a2=3c a3=0 items=0 ppid=696 pid=710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" key=(null)...
+type=PROCTITLE msg=audit(1757673850.283:3): proctitle=2F7362696E2F617564697463746C002D52002F6574632F61756469742F61756469742E72756C6573
+type=CONFIG_CHANGE msg=audit(1757673850.283:4): op=set audit_failure=1 old=1 auid=4294967295 ses=4294967295 res=1...
+type=SYSCALL msg=audit(1757673850.283:4): arch=c00000b7 syscall=206 success=yes exit=60 a0=3 a1=7fffc27ad8f0 a2=3c a3=0 items=0 ppid=696 pid=710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" key=(null)...
+type=PROCTITLE msg=audit(1757673850.283:4): proctitle=2F7362696E2F617564697463746C002D52002F6574632F61756469742F61756469742E72756C6573
+type=CONFIG_CHANGE msg=audit(1757673850.283:5): op=set audit_backlog_wait_time=60000 old=15000 auid=4294967295 ses=4294967295 res=1...
+type=SYSCALL msg=audit(1757673850.283:5): arch=c00000b7 syscall=206 success=yes exit=60 a0=3 a1=7fffc27ad8f0 a2=3c a3=0 items=0 ppid=696 pid=710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" key=(null)...
+```
+
+Every line starts with the same prefix shape, `type=<Type> msg=audit(<Time>:<Serial>):
+<Content>`, and there are only four distinct *event types*  --  `DAEMON_START`,
+`CONFIG_CHANGE`, `SYSCALL`, and `PROCTITLE`  --  each with its own static
+template hiding behind the variable parts.
+
+## 2. Build and configure your own parser
+
+We reuse `MatcherParser` (the same parser class as the Quickstart, see
+[Template Matcher](../parsers/template_matcher.md)), but this time we supply
+our own `log_format` and write our own template file instead of a ready-made
+one.
+
+**Splitting off the prefix.** The `log_format` string tells the parser how to
+carve off the `type=`/`msg=audit(...)` prefix into
+`logFormatVariables` and hand the parser only the `<Content>` part to match
+against templates:
+
+```text
+type=<Type> msg=audit(<Time>:<Serial>): <Content>
+```
+
+**Writing the templates.** **MatcherParser** needs a template file as an input. For each of the four content shapes above, we
+replace the parts that change between log lines with `<*>`, following the
+[template format](../parsers/template_matcher.md#template-format) rules  --  save the results in
+`tests/test_data/logs_templates.txt`:
+
+```text
+op=start ver=<*> format=<*> kernel=<*> auid=<*> pid=<*> uid=<*> ses=<*> res=<*>
+op=set <*> old=<*> auid=<*> ses=<*> res=<*>
+arch=<*> syscall=<*> success=<*> exit=<*> a0=<*> a1=<*> a2=<*> a3=<*> items=<*> ppid=<*> pid=<*> auid=<*> uid=<*> gid=<*> euid=<*> suid=<*> fsuid=<*> egid=<*> sgid=<*> fsgid=<*> tty=<*> ses=<*> comm=<*> exe=<*> key=<*>
+proctitle=<*>
+```
+
+A few things worth noticing while writing templates like these:
+
+- The line number is the `EventID`  --  line 1 (0-indexed: `0`) matches
+  `DAEMON_START`, line 2 (`1`) matches `CONFIG_CHANGE`, and so on, exactly as
+  described in [EventID assignment](../parsers/template_matcher.md#eventid-assignment-preliminary).
+- The second template's `op=set <*> old=<*> ...` has only one wildcard where
+  the raw text has an `audit_backlog_limit=8192`, `audit_failure=1`, or
+  `audit_backlog_wait_time=60000` key/value pair. A single `<*>` is not
+  limited to one word  --  it happily captures the whole `key=value` chunk, so
+  there's no need for a wildcard per key name even though the key itself
+  varies between log lines.
+- None of the templates need to account for the trailing `AUID="unset"
+  UID="root"` fragment glued onto the end of each line (visible as `...` in
+  the excerpt above). Because every template's last field is a `<*>`, that
+  wildcard simply absorbs whatever comes after it.
+
+**Configuring the parser:**
+
+```python
+--8<-- "docs/examples/others/tutorial.py:own_parser"
+```
+
+> **Common pitfall: don't escape `log_format` yourself.** The Quickstart's
+> `log_format` string escapes the parentheses by hand:
+> `r"...audit\(<Time>:<Serial>\):..."`. Don't copy that  --  it's wrong.
+> `generate_logformat_regex()` (used internally by every parser that accepts
+> `log_format`) already escapes every literal character outside the
+> `<Placeholder>` tokens, parentheses included. Escaping them yourself asks it
+> to match a **literal backslash** followed by `(`, which never occurs in
+> real log data  --  the regex then silently fails to match anything, and every
+> log falls back to `<Not Found>`. Write `log_format` as plain text; only the
+> `<Placeholder>` tokens are special.
+
+Running this prints, for each of the 9 logs, the `EventID` and the matched
+template  --  all four templates get used, and every line matches (nothing
+comes back as `<Not Found>`).
+
+## 3. Run several detectors and compare their alerts
+
+Different detectors look for different *kinds* of anomalies. To make that
+concrete, this tutorial runs two of them side by side on the same parsed
+stream:
+
+- [**NewValueDetector**](../detectors/new_value.md) watches the *content* of
+  specific fields and alerts when a value it hasn't been trained on shows up.
+- [**EventSequenceDetector**](../detectors/event_sequence.md) ignores field
+  content entirely and instead watches the *order* of `EventID`s, alerting
+  when a sequence of consecutive events wasn't part of what it was trained
+  on.
+
+```python
+--8<-- "docs/examples/others/tutorial.py:detectors"
+```
+
+Both detectors are configured with `data_use_training: 3`: the first 3 logs
+(`DAEMON_START`, `CONFIG_CHANGE`, `SYSCALL`) are used to train, and detection
+runs on the remaining 6  --  see [Configuration](../detectors.md#configuration)
+for how `data_use_training` and `events` interact. `NewValueDetector` is
+pointed at the two fields we identified while writing the templates in step
+2: the `key=value` pair inside `CONFIG_CHANGE` (`EventID: 1`, `pos: 0`) and
+the process name inside `SYSCALL` (`EventID: 2`, `pos: 22`, the `comm=` slot
+counting `<*>` positions left to right in the third template line).
+
+Running the loop prints one row per log line:
+
+```text
+ #  EventID  NewValue  EventSequence
+ 1        0     False          False
+ 2        1     False          False
+ 3        2     False          False
+ 4        3     False           True
+ 5        1      True           True
+ 6        2     False          False
+ 7        3     False           True
+ 8        1      True           True
+ 9        2     False          False
+```
+
+In the table above, **`True` means that detector raised an alert** for that log
+(it found something anomalous), and **`False` means no alert**. With that in mind:
+Reading the table alongside the raw data explains why each detector fires
+when it does:
+
+- **`NewValueDetector`** only fires on logs `#5` and `#8`  --  the second and
+  third `CONFIG_CHANGE` events, whose `audit_failure=1` and
+  `audit_backlog_wait_time=60000` values were never seen during training
+  (only `audit_backlog_limit=8192`, from log `#2`, was). It stays silent on
+  every `SYSCALL` after log `#3`, because `comm="auditctl"` is identical
+  every time  --  there is nothing *new* about it once it's been trained once.
+- **`EventSequenceDetector`** fires starting at log `#4`, and on every log
+  after that except the `SYSCALL`s. With `fixed_window_size: 2`, training on
+  the first 3 logs only teaches it the transitions `(DAEMON_START →
+  CONFIG_CHANGE)` and `(CONFIG_CHANGE → SYSCALL)`. The transition `(SYSCALL →
+  PROCTITLE)` at log `#4` was never trained, so it alerts  --  and keeps
+  alerting every time that same transition recurs (`#7`), because alerts
+  don't teach the detector anything; only `train()` does. `(PROCTITLE →
+  CONFIG_CHANGE)` at log `#5` is equally untrained and alerts too, while
+  `(CONFIG_CHANGE → SYSCALL)` at logs `#6` and `#9` was trained at log `#3`
+  and stays quiet.
+
+Note that both detectors agree on logs `#5` and `#8`  --  the same underlying
+event looks anomalous from two independent angles: an unfamiliar value *and*
+an unfamiliar position in the sequence. That overlap is what an alert
+aggregator is for.
+
+## 4. Add an alert aggregator
+
+[Alert aggregation](../alert_aggregator.md) takes the stream of alerts coming
+out of one or more detectors and combines them into
+[`AggregateSchema`](../schemas.md) records. Here we feed every alert produced
+in step 3  --  from either detector, in the order they were emitted  --  into
+[`BasicConcatAggregation`](../alert_aggregators/basic_concatenation.md), the
+simplest aggregation strategy available:
+
+```python
+--8<-- "docs/examples/others/tutorial.py:aggregate"
+```
+
+```text
+['EventSequenceDetector', 'NewValueDetector'] ['3', '4']
+['NewValueDetector', 'EventSequenceDetector'] ['4', '4']
+['EventSequenceDetector', 'EventSequenceDetector'] ['4', '6']
+['EventSequenceDetector', 'NewValueDetector'] ['6', '7']
+['NewValueDetector', 'EventSequenceDetector'] ['7', '7']
+```
+
+Two details are easy to miss here, and both matter for production configs:
+
+- **The buffer is a sliding window, not a batch.** `buffer_size: 2` does not
+  mean "group alerts two at a time and clear." Alert aggregators use a
+  [`WINDOW` buffer](../auxiliar/input_buffer.md) internally, so once 2 alerts
+  have arrived, `aggregate_alerts()` fires again on *every* new alert,
+  each time over the 2 most recently seen ones. Six alerts in therefore
+  produce five overlapping aggregate outputs, not three separate batches.
+- **`BasicConcatAggregation` does not correlate by log line.** It concatenates
+  whatever alerts happen to be in the window, regardless of which log they
+  refer to  --  that's why most rows above pair up alerts from *different*
+  underlying logs. The two rows where both `logIDs` are identical
+  (`['4', '4']` and `['7', '7']`) are the exception, and not a coincidence:
+  those are exactly the log `#5` and `#8` cases from step 3, where
+  `NewValueDetector` and `EventSequenceDetector` both alerted on the same
+  event back to back, so the window happened to contain only that pair. A
+  real deployment that wants alerts grouped *by log* rather than by arrival
+  order needs a smarter aggregation strategy than basic concatenation.
+
+## Common pitfalls
+
+* Manually escaping regex characters (like `(` and `)`) inside a
+  `log_format` string breaks matching
+  `generate_logformat_regex()` already escapes literal text for you.
+* A detector's `detect()` only checks `EventID`s it has already seen through
+  `train()` at least once. If you configure a detector for an `EventID` that
+  never appears in the training window (`data_use_training`), it will stay
+  silent for that event type  --  not alert on everything, and not error either.
+* Calling `.process()` on a detector or aggregator returns `None` when
+  nothing fires, and the actual output schema (truthy) when it does  --  check
+  with `if result:` rather than assuming a boolean.
+
+Go back [Index](../index.md)
diff --git a/docs/user_guide/what_is_detectmate.md b/docs/user_guide/what_is_detectmate.md
new file mode 100644
index 00000000..3c9f3d88
--- /dev/null
+++ b/docs/user_guide/what_is_detectmate.md
@@ -0,0 +1,15 @@
+# What is DetectMate?
+
+Welcome to the documentation for the DetectMate Library. DetectMate is a library for anomaly detection in log data.
+It is built from ready-made building blocks (parsers, detectors and aggregators) that you combine into a detection pipeline.
+
+## Why use DetectMate?
+
+* **Stream-friendly:** components process logs as they arrive, so DetectMate
+  works for online, real-time anomaly detection, not just offline batch runs.
+* **A broad catalogue out of the box:** 6 parsers and 13 detectors
+  ship ready to use, from simple rule-based checks to deep-learning sequence models.
+* **Need something specific to your data?** Inherit from the respective core class to build a parser or detector for your own use case. The core classes provide all the essentials, so creating a fully custom component for your use case takes very little code.
+
+
+Go back [Index](../index.md)
diff --git a/mkdocs.yml b/mkdocs.yml
index 6e953a76..ea0c99a4 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -2,56 +2,61 @@ site_name: DetectMate Library
 site_url: https://ait-detectmate.github.io/DetectMateLibrary/
 
 theme:
-  name: readthedocs
+  name: material # windmill is auch cool
 
 nav:
   - Home: index.md
-  - Getting Started:
-    - Installation: installation.md
-    - Basic usage: basic_usage.md
-    - Create new component: create_components.md
-  - Components:
-    - Basic concepts: basic_idea.md
-    - Overall architecture: overall_architecture.md
-    - Schemas: schemas.md
-    - Federation: federation.md
-    - Parsers: parsers.md
-    - Detectors: detectors.md
-    - Alert Aggregation: alert_aggregator.md
-  - Parsers Methods:
-    - Template Matcher: parsers/template_matcher.md
-    - Template Tree Matcher: parsers/template_tree_matcher.md
-    - Json Parser: parsers/json_parser.md
-    - LogBatcher Parser: parsers/logbatcher_parser.md
-    - Auto Parser: parsers/auto_parser.md
-    - Drain Parser: parsers/drain_parser.md
-  - Detectors Methods:
-    - Random Detector: detectors/random_detector.md
-    - New Value: detectors/new_value.md
-    - Combo Detector: detectors/combo.md
-    - New Event: detectors/new_event.md
-    - Event Sequence: detectors/event_sequence.md
-    - Rule Based: detectors/rule_based.md
-    - BiGram Frequency: detectors/bigram_frequency.md
-    - CharSet: detectors/charset.md
-    - Value Range: detectors/value_range.md
-    - Deeplog Detector: detectors/deeplog.md
-    - LogBert Detector: detectors/logbert.md
-    - SCVS Detector: detectors/scvs_detector.md
-    - ECVC Detector: detectors/ecvc_detector.md
-  - Alert Aggregation Methods:
-    - Basic Concat: alert_aggregators/basic_concatenation.md
-  - Auxiliar:
-    - Persistency: auxiliar/persistency.md
-    - Data buffer: auxiliar/input_buffer.md
-  - Helpers:
-    - From to: helper/from_to.md
-  - Contribution:
+
+  - User Guide:
+    - What is DetectMate?: user_guide/what_is_detectmate.md
+    - Installation: user_guide/installation.md
+    - Basic knowledge: user_guide/basic_knowledge.md
+    - Quickstart: user_guide/quickstart.md
+    - Tutorial (end-to-end): user_guide/tutorial.md
+
+  - Advanced Guide:
+    - Overall architecture: advanced/overall_architecture.md
+    - Components:
+      - Schemas: schemas.md
+      - Federation: federation.md
+      - Parsers: parsers.md
+      - Detectors: detectors.md
+      - Alert Aggregation: alert_aggregator.md
+    - Parser types:
+      - Auto Parser: parsers/auto_parser.md
+      - Drain Parser: parsers/drain_parser.md
+      - Json Parser: parsers/json_parser.md
+      - LogBatcher Parser: parsers/logbatcher_parser.md
+      - Template Matcher: parsers/template_matcher.md
+      - Template Tree Matcher: parsers/template_tree_matcher.md
+    - Detector types:
+      - BiGram Frequency: detectors/bigram_frequency.md
+      - CharSet: detectors/charset.md
+      - Deeplog Detector: detectors/deeplog.md
+      - ECVC Detector: detectors/ecvc_detector.md
+      - Event Sequence: detectors/event_sequence.md
+      - LogBert Detector: detectors/logbert.md
+      - New Event: detectors/new_event.md
+      - New Value: detectors/new_value.md
+      - New Value Combo Detector: detectors/combo.md
+      - Random Detector: detectors/random_detector.md
+      - Rule Based: detectors/rule_based.md
+      - SCVS Detector: detectors/scvs_detector.md
+      - Value Range: detectors/value_range.md
+    - Alert Aggregation methods:
+      - Basic Concat: alert_aggregators/basic_concatenation.md
+    - Helpers:
+      - FromTo: helper/from_to.md
+    - Auxiliary:
+      - Persistency: auxiliar/persistency.md
+      - Data buffer: auxiliar/input_buffer.md
+    - Other:
+      - Log Formats: other/log_formats.md
+
+  - How to contribute:
     - Contributing: contribution.md
     - Development: development.md
     - Release Process: release.md
-  - Other:
-    - Log Formats: other/log_formats.md
 
 markdown_extensions:
   - pymdownx.snippets:
diff --git a/src/detectmatelibrary/common/_config/__init__.py b/src/detectmatelibrary/common/_config/__init__.py
index f7b7d60e..2e3fc532 100644
--- a/src/detectmatelibrary/common/_config/__init__.py
+++ b/src/detectmatelibrary/common/_config/__init__.py
@@ -10,7 +10,7 @@
     "AutoConfigParams",
 ]
 
-from pydantic import BaseModel, ConfigDict
+from pydantic import BaseModel, ConfigDict, Field
 
 from typing_extensions import Self
 from typing import Any, Dict
@@ -49,11 +49,76 @@ class BasicConfig(BaseModel):
 
     model_config = ConfigDict(extra="forbid")
 
-    method_type: str = "default_method_type"
-    component_type: str = "default_type"
+    method_type: str = Field(
+        default="default_method_type", description="Indicates what type of method is."
+    )
+    component_type: str = Field(
+        default="default_type",
+        description="Component type that the class inherent from.",
+    )
 
-    auto_config: bool = False
-    auto_config_params: AutoConfigParams = AutoConfigParams()
+    auto_config: bool = Field(
+        default=False,
+        description="Runs the configuration step before the training process.",
+    )
+
+    auto_config_params: AutoConfigParams = Field(
+        default=AutoConfigParams(), description="<$IGNORE$>"
+    )
+
+    def get_docs(
+        self, exclude_inherited_from: "type[BasicConfig] | None" = None
+    ) -> list[dict[str, str]]:
+        """List this config's fields as doc rows.
+
+        Args:
+            exclude_inherited_from: if given, fields also declared on this
+                base class are left out *unless this subclass overrides
+                their default* -- so a subclass's doc table can show only
+                what it adds or changes itself, while still surfacing a
+                changed default (e.g. ``method_type``, or a subclass that
+                narrows an inherited field like ``use_static_vars``).
+        """
+        exclude: set[str] = set()
+        if exclude_inherited_from is not None:
+            base_fields = exclude_inherited_from.model_fields
+            own_fields = type(self).model_fields
+            exclude = {
+                name
+                for name, base_field in base_fields.items()
+                if name in own_fields and own_fields[name].default == base_field.default
+            }
+        docs = []
+        for field_na, field_info in (
+            self.model_json_schema().get("properties", {}).items()
+        ):
+            if field_na in exclude:
+                continue
+            # Documented in its own dedicated section wherever a component
+            # declares it (see docs/detectors.md) -- a subclass narrowing its
+            # type (e.g. VariableDetectorConfig -> VariableAutoConfigParams)
+            # redeclares the field without carrying over the base class's
+            # <$IGNORE$> marker, so the description-based skip below would
+            # miss it.
+            if field_na == "auto_config_params":
+                continue
+            desc = field_info.get("description", "No description provided.")
+            if "<$IGNORE$>" in desc:
+                continue
+            type_ = field_info.get("type", "unknown")
+            if "anyOf" in field_info:
+                types = [item["type"] for item in field_info["anyOf"] if "type" in item]
+                type_ = ", ".join(types)
+
+            docs.append(
+                {
+                    "Name": field_na,
+                    "Type": type_,
+                    "Default value": getattr(self, field_na),
+                    "Description": desc,
+                }
+            )
+        return docs
 
     def get_config(self) -> Dict[str, Any]:
         """Return the configuration as a dictionary."""
@@ -120,8 +185,7 @@ def to_dict(self, method_id: str = random_id()) -> Dict[str, Any]:
             # Serialized as "global" in YAML (Python field is "global_instances")
             elif field_name == "global_instances" and field_value:
                 instances_data = {
-                    name: inst.to_dict()
-                    for name, inst in field_value.items()
+                    name: inst.to_dict() for name, inst in field_value.items()
                 }
             elif field_name == "persist":
                 if field_value is not None:
@@ -149,8 +213,4 @@ def to_dict(self, method_id: str = random_id()) -> Dict[str, Any]:
             result["persist"] = persist_data
 
         # Wrap in the component_type and method_id structure
-        return {
-            self.component_type: {
-                method_id: result
-            }
-        }
+        return {self.component_type: {method_id: result}}
diff --git a/src/detectmatelibrary/common/_core_op/_basic_component.py b/src/detectmatelibrary/common/_core_op/_basic_component.py
index 143a8e99..407b558f 100644
--- a/src/detectmatelibrary/common/_core_op/_basic_component.py
+++ b/src/detectmatelibrary/common/_core_op/_basic_component.py
@@ -3,10 +3,14 @@
 
 from detectmatelibrary.common._config import BasicConfig
 
-from typing import Any, Dict, List
+from typing import Any, Dict, Generic, List
+from typing_extensions import TypeVar
 
+TInput = TypeVar("TInput", bound=BaseSchema, default=BaseSchema)
+TOutput = TypeVar("TOutput", bound=BaseSchema, default=BaseSchema)
 
-class Component:
+
+class Component(Generic[TInput, TOutput]):
     """Empty methods."""
     def __init__(
         self,
@@ -21,17 +25,17 @@ def __repr__(self) -> str:
         return f"<{self.type_}> {self.name}: {self.config}"
 
     def run(
-        self, input_: List[BaseSchema] | BaseSchema, output_: BaseSchema
+        self, input_: List[TInput] | TInput, output_: TOutput
     ) -> bool:
         return False
 
     def train(
-        self, input_: List[BaseSchema] | BaseSchema,
+        self, input_: List[TInput] | TInput,
     ) -> None:
         pass
 
     def configure(
-        self, input_: List[BaseSchema] | BaseSchema,
+        self, input_: List[TInput] | TInput,
     ) -> None:
         pass
 
@@ -47,7 +51,7 @@ def get_config(self) -> Dict[str, Any]:
     def update_config(self, new_config: Dict[str, Any]) -> None:
         self.config.update_config(new_config)
 
-    def __enter__(self) -> "Component":
+    def __enter__(self) -> "Component[TInput, TOutput]":
         return self
 
     def __exit__(self, *_: Any) -> None:
diff --git a/src/detectmatelibrary/common/core.py b/src/detectmatelibrary/common/core.py
index 75a3c645..facd9997 100644
--- a/src/detectmatelibrary/common/core.py
+++ b/src/detectmatelibrary/common/core.py
@@ -1,7 +1,11 @@
 from detectmatelibrary.common._core_op._fit_logic import FitLogicState, StatesL
 from detectmatelibrary.common._core_op._schema_pipeline import SchemaPipeline
 from detectmatelibrary.common._core_op._fed_component import FedOperations
-from detectmatelibrary.common._core_op._basic_component import Component
+from detectmatelibrary.common._core_op._basic_component import (
+    Component,
+    TInput,
+    TOutput,
+)
 from detectmatelibrary.common._core_op._fit_logic import FitLogic
 
 from detectmatelibrary.utils.data_buffer import DataBuffer, ArgsBuffer, BufferMode
@@ -15,6 +19,7 @@
 
 
 from typing import Any
+from pydantic import Field
 
 from detectmatelibrary.utils.persistency.component_interfaces import PersistencyOp
 
@@ -46,15 +51,28 @@ def __iter__(self) -> "TrainBuffer":
 
 # Core component ################################################
 
-class CoreConfig(BasicConfig):
-    start_id: int = 10
-    data_use_training: int | None = None
-    data_use_configure: int | None = None
-    use_config_data_as_training: bool = True
-
 
-class CoreComponent(Component, FedOperations):
+class CoreConfig(BasicConfig):
+    start_id: int = Field(
+        default=10, description="Number used to start the unique ID generator."
+    )
+    data_use_training: int | None = Field(
+        default=None,
+        description="Data used for training, if None, training is not done.",
+    )
+    data_use_configure: int | None = Field(
+        default=None,
+        description="Data used for configuration, if None, configuration is not done.",
+    )
+    use_config_data_as_training: bool = Field(
+        default=True,
+        description="Combine the configured data in the training process if True.",
+    )
+
+
+class CoreComponent(Component[TInput, TOutput], FedOperations):
     """Base class for all components in the system."""
+
     def __init__(
         self,
         name: str,
@@ -62,7 +80,7 @@ def __init__(
         config: CoreConfig = CoreConfig(),
         args_buffer: ArgsBuffer = ArgsBuffer(BufferMode.NO_BUF),
         input_schema: type[BaseSchema] = BaseSchema,
-        output_schema: type[BaseSchema] = BaseSchema
+        output_schema: type[BaseSchema] = BaseSchema,
     ) -> None:
         Component.__init__(self, name=name, type_=type_, config=config)
         FedOperations.__init__(self)
@@ -78,7 +96,9 @@ def __init__(
         self.buffer_train = TrainBuffer()
 
     def export_state(
-        self, path: str | None = None, storage_options: dict[str, Any] | None = None,
+        self,
+        path: str | None = None,
+        storage_options: dict[str, Any] | None = None,
     ) -> bytes | None:
         return PersistencyOp.save(
             instance=self, path=path, storage_options=storage_options
diff --git a/src/detectmatelibrary/common/deeplearning_detector.py b/src/detectmatelibrary/common/deeplearning_detector.py
index 25a88b58..14229b87 100644
--- a/src/detectmatelibrary/common/deeplearning_detector.py
+++ b/src/detectmatelibrary/common/deeplearning_detector.py
@@ -7,23 +7,39 @@
 from detectmatelibrary import schemas
 
 from typing import Any
+from pydantic import Field
 import logging
 
 
 class DeepLearningDetectorConfig(CoreDetectorConfig):
-    window_size: int = 10
-    validation_per: float = 0.2
-    finetune_epochs: int = 2
-
-    hyperparameters: dict[str, Any] = {
-        "Model": {
-
-        },
-        "Train": {
-
+    window_size: int = Field(
+        default=10,
+        description="Number of consecutive events used as one training/detection sequence.",
+    )
+    validation_per: float = Field(
+        default=0.2,
+        description="Fraction of data held out for validation during (fine)training.",
+    )
+    finetune_epochs: int = Field(
+        default=2,
+        description="Number of epochs used when finetuning during the configuration phase.",
+    )
+
+    hyperparameters: dict[str, Any] = Field(
+        default={
+            "Model": {
+
+            },
+            "Train": {
+
+            },
+            "Finetune": [],
         },
-        "Finetune": [],
-    }
+        description=(
+            "Model, training and hyperparameter-search settings passed to "
+            "the underlying deep learning model."
+        ),
+    )
 
 
 def build_seq(input_: list[schemas.ParserSchema]) -> tuple[int]:
diff --git a/src/detectmatelibrary/common/detector.py b/src/detectmatelibrary/common/detector.py
index 0efc2c99..2fe399ac 100644
--- a/src/detectmatelibrary/common/detector.py
+++ b/src/detectmatelibrary/common/detector.py
@@ -10,6 +10,7 @@
 
 from typing_extensions import override
 from typing import Dict, List, Optional, Any, cast
+from pydantic import Field
 
 from detectmatelibrary.utils.persistency.component_interfaces import PersistConfig
 from detectmatelibrary.utils.time_format_handler import TimeFormatHandler
@@ -18,17 +19,16 @@
 _time_handler = TimeFormatHandler()
 
 
-def _extract_timestamp(
-    input_: List[ParserSchema] | ParserSchema
-) -> List[int]:
+def _extract_timestamp(input_: List[ParserSchema] | ParserSchema) -> List[int]:
     if not isinstance(input_, list):
         input_ = [input_]
-    return [int(_time_handler.parse_timestamp(i["logFormatVariables"]["Time"])) for i in input_]
+    return [
+        int(_time_handler.parse_timestamp(i["logFormatVariables"]["Time"]))
+        for i in input_
+    ]
 
 
-def _extract_logIDs(
-    input_: List[ParserSchema] | ParserSchema
-) -> List[str]:
+def _extract_logIDs(input_: List[ParserSchema] | ParserSchema) -> List[str]:
     if not isinstance(input_, list):
         input_ = [input_]
 
@@ -36,17 +36,25 @@ def _extract_logIDs(
 
 
 class CoreDetectorConfig(CoreConfig):
-    component_type: str = "detectors"
-    method_type: str = "core_detector"
-    parser: str = "<PLACEHOLDER>"
-
-    auto_config: bool = True
-    events: EventsConfig | dict[str, Any] = {}
-    global_instances: Dict[str, _EventInstance] = {}
-    persist: PersistConfig | None = None
-
-
-class CoreDetector(CoreComponent):
+    component_type: str = Field(default="detectors", description="<$IGNORE$>")
+    method_type: str = Field(default="core_detector", description="<$IGNORE$>")
+    parser: str = Field(default="PARSER", description="Name of the parser used.")
+
+    auto_config: bool = Field(
+        default=True,
+        description="Runs the configuration step before the training process.",
+    )
+    events: EventsConfig | dict[str, Any] = Field(
+        default={},
+        description=EventsConfig.__doc__,
+    )
+    global_instances: Dict[str, _EventInstance] = Field(
+        default={}, description=_EventInstance.__doc__
+    )
+    persist: PersistConfig | None = Field(default=None, description="<$IGNORE$>")
+
+
+class CoreDetector(CoreComponent[ParserSchema, DetectorSchema]):
     def __init__(
         self,
         name: str = "CoreDetector",
@@ -66,14 +74,18 @@ def __init__(
             output_schema=DetectorSchema,
         )
 
-    def _register_persistency(self, event_persistency: persistency.EventPersistency) -> None:
+    def _register_persistency(
+        self, event_persistency: persistency.EventPersistency
+    ) -> None:
         self.saver = init_persistency(
             self.name, cast(CoreDetectorConfig, self.config), event_persistency
         )
 
     @override
     def run(
-        self, input_: List[ParserSchema] | ParserSchema, output_: DetectorSchema  # type: ignore
+        self,
+        input_: List[ParserSchema] | ParserSchema,
+        output_: DetectorSchema,
     ) -> bool:
 
         output_["detectorID"] = self.name
@@ -82,7 +94,7 @@ def run(
         output_["extractedTimestamps"] = _extract_timestamp(input_)
         output_["receivedTimestamp"] = get_timestamp()
 
-        if (anomaly_detected := self.detect(input_=input_, output_=output_)):
+        if anomaly_detected := self.detect(input_=input_, output_=output_):
             output_["alertID"] = str(self.id_generator())
             output_["detectionTimestamp"] = get_timestamp()
 
@@ -97,13 +109,15 @@ def detect(
 
     @override
     def train(
-        self, input_: ParserSchema | list[ParserSchema]  # type: ignore
+        self,
+        input_: ParserSchema | list[ParserSchema],
     ) -> None:
         pass
 
     @override
     def configure(
-        self, input_: ParserSchema | list[ParserSchema]  # type: ignore
+        self,
+        input_: ParserSchema | list[ParserSchema],
     ) -> None:
         pass
 
diff --git a/src/detectmatelibrary/detectors/bigram_frequency_detector.py b/src/detectmatelibrary/detectors/bigram_frequency_detector.py
index f6bd9837..f36fc10d 100644
--- a/src/detectmatelibrary/detectors/bigram_frequency_detector.py
+++ b/src/detectmatelibrary/detectors/bigram_frequency_detector.py
@@ -1,5 +1,7 @@
 from typing import Any, Dict, Optional, cast
 
+from pydantic import Field
+
 from detectmatelibrary.common.variable_detector import VariableDetector, VariableDetectorConfig
 from detectmatelibrary.common._other_op._variable_hooks import get_global_variables
 from detectmatelibrary.common._config._compile import get_configured_variables
@@ -38,18 +40,31 @@ def _default_freq_tables() -> tuple[dict[str, dict[str, int]], dict[str, int]]:
 
 
 class BigramFrequencyDetectorConfig(VariableDetectorConfig):
-    """
-    @param prob_thresh limit for the average probability of character pairs for which anomalies are reported.
-    @param default_freqs initializes the probabilities with default values from
-           https://github.com/markbaggett/freq.
-    @param skip_repetitions boolean that determines whether only distinct values are used for character pair
-           counting. This counteracts the problem of imbalanced word frequencies that distort the frequency
-           table generated in a single run.
-    """
-    method_type: str = "bigram_frequency_detector"
-    prob_thresh: float = 0.05
-    default_freqs: bool = False
-    skip_repetitions: bool = True
+    method_type: str = Field(
+        default="bigram_frequency_detector", description="Indicates what type of method it is."
+    )
+    prob_thresh: float = Field(
+        default=0.05,
+        description=(
+            "Limit for the average probability of character pairs below "
+            "which anomalies are reported."
+        ),
+    )
+    default_freqs: bool = Field(
+        default=False,
+        description=(
+            "Initialize the probabilities with default values from "
+            "https://github.com/markbaggett/freq."
+        ),
+    )
+    skip_repetitions: bool = Field(
+        default=True,
+        description=(
+            "Only use distinct values for character-pair counting. This "
+            "counteracts the problem of imbalanced word frequencies that "
+            "distort the frequency table generated in a single run."
+        ),
+    )
 
 
 class BigramFrequencyDetector(VariableDetector):
diff --git a/src/detectmatelibrary/detectors/charset_detector.py b/src/detectmatelibrary/detectors/charset_detector.py
index c2356b5a..739964f7 100644
--- a/src/detectmatelibrary/detectors/charset_detector.py
+++ b/src/detectmatelibrary/detectors/charset_detector.py
@@ -5,9 +5,13 @@
 
 from typing import Any, Dict, Optional
 
+from pydantic import Field
+
 
 class CharsetDetectorConfig(VariableDetectorConfig):
-    method_type: str = "charset_detector"
+    method_type: str = Field(
+        default="charset_detector", description="Indicates what type of method it is."
+    )
 
 
 class CharsetDetector(VariableDetector):
diff --git a/src/detectmatelibrary/detectors/deeplog_detector.py b/src/detectmatelibrary/detectors/deeplog_detector.py
index f575887f..121d6cd3 100644
--- a/src/detectmatelibrary/detectors/deeplog_detector.py
+++ b/src/detectmatelibrary/detectors/deeplog_detector.py
@@ -6,29 +6,35 @@
 
 
 from typing import Any
+from pydantic import Field
 
 
 class DeeplogDetectorConfig(DeepLearningDetectorConfig):
-    method_type: str = "deeplog_detector"
-
-    hyperparameters: dict[str, Any] = {  # type: ignore
-        "Model": {
-            "hidden_dim": 64,
-            "n_layers": 2,
-        },
-        "Train": {
-            "seed": 0,
-            "batch_size": 2048,
-            "learning_rate": 0.01,
-            "epochs": 10,
-            "patience": 3,
+    method_type: str = Field(
+        default="deeplog_detector", description="Indicates what type of method it is."
+    )
+
+    hyperparameters: dict[str, Any] = Field(
+        default={
+            "Model": {
+                "hidden_dim": 64,
+                "n_layers": 2,
+            },
+            "Train": {
+                "seed": 0,
+                "batch_size": 2048,
+                "learning_rate": 0.01,
+                "epochs": 10,
+                "patience": 3,
+            },
+            "Finetune": [
+                ["Model", "hidden_dim", [128, 256, 512]],
+                ["Model", "n_layers", [1, 2, 3]],
+                ["Train", "learning_rate", [0.01, 0.02, 0.03]],
+            ],
         },
-        "Finetune": [
-            ["Model", "hidden_dim", [128, 256, 512]],
-            ["Model", "n_layers", [1, 2, 3]],
-            ["Train", "learning_rate", [0.01, 0.02, 0.03]],
-        ],
-    }
+        description="Model, training and hyperparameter-search settings for the DeepLog model.",
+    )
 
 
 class DeeplogDetector(DeepLearningDetector):
diff --git a/src/detectmatelibrary/detectors/ecvc_detector.py b/src/detectmatelibrary/detectors/ecvc_detector.py
index 9e96ea14..89703e14 100644
--- a/src/detectmatelibrary/detectors/ecvc_detector.py
+++ b/src/detectmatelibrary/detectors/ecvc_detector.py
@@ -14,6 +14,7 @@
 
 from math import ceil
 import numpy as np
+from pydantic import Field
 
 
 class ECVCOp:
@@ -64,11 +65,32 @@ def threshold_cal(y_s: np.ndarray, matrix: np.ndarray, method: str) -> float:
 
 
 class ECVCDetectorConfig(CoreDetectorConfig):
-    method_type: str = "ecvc_detector_detector"
-    window_size: int = 10
-    validation_per: float = 0.2
-    seed: int = 0
-    threshold_method: str = "mean"
+    method_type: str = Field(
+        default="ecvc_detector_detector", description="Indicates what type of method it is."
+    )
+    window_size: int = Field(
+        default=10,
+        description="Length of the event-ID window a count vector is built over.",
+    )
+    validation_per: float = Field(
+        default=0.2,
+        description=(
+            "Fraction of the learned count vectors held out as a validation "
+            "split and used to derive the anomaly threshold."
+        ),
+    )
+    seed: int = Field(
+        default=0,
+        description="Random seed used to shuffle count vectors into train/validation splits.",
+    )
+    threshold_method: str = Field(
+        default="mean",
+        description=(
+            "Method used to derive the anomaly threshold from the validation "
+            "split: 'mean' averages the distance scores, 'default' uses a "
+            "fixed threshold of 0."
+        ),
+    )
 
 
 class ECVCDetector(CoreDetector, VariablesLogic):
diff --git a/src/detectmatelibrary/detectors/event_sequence_detector.py b/src/detectmatelibrary/detectors/event_sequence_detector.py
index f49717b3..48eefcc0 100644
--- a/src/detectmatelibrary/detectors/event_sequence_detector.py
+++ b/src/detectmatelibrary/detectors/event_sequence_detector.py
@@ -38,15 +38,23 @@ def _validate_window_range(self) -> "SequenceAutoConfigParams":
 
 
 class EventSequenceDetectorConfig(CoreDetectorConfig):
-    """
-    @param fixed_window_size length of the sliding EventID window. A window whose exact
-           EventID sequence was not seen during training is reported as an anomaly. When
-           set it overrides the `auto_config_params` window range and skips
-           auto-configuration; auto-configuration writes its own choice here. While it is
-           None the detector is unconfigured and neither trains nor alerts.
-    """
-    method_type: str = "event_sequence_detector"
-    fixed_window_size: int | None = Field(default=None, ge=1)
+    method_type: str = Field(
+        default="event_sequence_detector",
+        description="Indicates what type of method it is.",
+    )
+    fixed_window_size: int | None = Field(
+        default=None,
+        ge=1,
+        description=(
+            "Length of the sliding EventID window. A window whose exact "
+            "EventID sequence was not seen during training is reported as an "
+            "anomaly. When set it overrides the `auto_config_params` window "
+            "range and skips auto-configuration; auto-configuration writes "
+            "its own choice here. While it is None the detector is "
+            "unconfigured and neither trains nor alerts."
+        ),
+    )
+
     auto_config_params: SequenceAutoConfigParams = SequenceAutoConfigParams()
 
 
@@ -54,14 +62,16 @@ class EventSequenceDetector(CoreDetector, VariablesLogic):
     """Detect EventID sequences not encountered in training as anomalies."""
 
     def __init__(
-            self,
-            name: str = "EventSequenceDetector",
-            config: EventSequenceDetectorConfig = EventSequenceDetectorConfig()
+        self,
+        name: str = "EventSequenceDetector",
+        config: EventSequenceDetectorConfig = EventSequenceDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = EventSequenceDetectorConfig.from_dict(config, name)
 
-        CoreDetector.__init__(self, name=name, buffer_mode=BufferMode.NO_BUF, config=config)
+        CoreDetector.__init__(
+            self, name=name, buffer_mode=BufferMode.NO_BUF, config=config
+        )
         self.config: EventSequenceDetectorConfig
         self._train_window: deque[int] = deque(maxlen=self.config.fixed_window_size)
         self._detect_window: deque[int] = deque(maxlen=self.config.fixed_window_size)
@@ -131,7 +141,7 @@ def train(self, input_: ParserSchema) -> None:  # type: ignore
             return
         self.persistency.ingest_event(
             event_id=encode_sequence(self._train_window),
-            event_template=input_["template"]
+            event_template=input_["template"],
         )
 
     def detect(self, input_: ParserSchema, output_: DetectorSchema) -> bool:  # type: ignore
@@ -152,13 +162,17 @@ def detect(self, input_: ParserSchema, output_: DetectorSchema) -> bool:  # type
 
         sequence = tuple(self._detect_window)
         output_["score"] = 1.0
-        output_["description"] = f"{self.name} detects unknown EventID sequences as anomalies."
-        output_["alertsObtain"].update({
-            f"Sequence {sequence}": (
-                f"EventID sequence of length {len(sequence)} ending at logID "
-                f"{input_['logID']} was not seen during training."
-            )
-        })
+        output_["description"] = (
+            f"{self.name} detects unknown EventID sequences as anomalies."
+        )
+        output_["alertsObtain"].update(
+            {
+                f"Sequence {sequence}": (
+                    f"EventID sequence of length {len(sequence)} ending at logID "
+                    f"{input_['logID']} was not seen during training."
+                )
+            }
+        )
         return True
 
     def configure(self, input_: ParserSchema) -> None:  # type: ignore
@@ -193,7 +207,8 @@ def set_configuration(self) -> None:
         """
         if (fixed := self.config.fixed_window_size) is not None:
             reason = (
-                "persisted state was restored" if self._restored_length is not None
+                "persisted state was restored"
+                if self._restored_length is not None
                 else "fixed_window_size is set"
             )
             logger.warning(
@@ -204,7 +219,10 @@ def set_configuration(self) -> None:
             return
 
         stable = []
-        for length, event_tracker in self.auto_conf_persistency.get_events_data().items():
+        for (
+            length,
+            event_tracker,
+        ) in self.auto_conf_persistency.get_events_data().items():
             tracker = event_tracker.get_data()["seq"]
             if len(tracker.change_series) < tracker.min_samples:
                 continue
diff --git a/src/detectmatelibrary/detectors/logbert_detector.py b/src/detectmatelibrary/detectors/logbert_detector.py
index d9a0e5e5..b90f5b6a 100644
--- a/src/detectmatelibrary/detectors/logbert_detector.py
+++ b/src/detectmatelibrary/detectors/logbert_detector.py
@@ -6,35 +6,41 @@
 
 
 from typing import Any
+from pydantic import Field
 
 
 class LogBertDetectorConfig(DeepLearningDetectorConfig):
-    method_type: str = "logbert_detector"
-
-    hyperparameters: dict[str, Any] = {  # type: ignore
-        "Model": {
-            "n_embed": 10,
-            "hidden": 32,
-            "num_heads": 2,
-            "n_layers": 1,
-            "dropout": 0.0,
-            "max_len": 1000,
+    method_type: str = Field(
+        default="logbert_detector", description="Indicates what type of method it is."
+    )
+
+    hyperparameters: dict[str, Any] = Field(
+        default={
+            "Model": {
+                "n_embed": 10,
+                "hidden": 32,
+                "num_heads": 2,
+                "n_layers": 1,
+                "dropout": 0.0,
+                "max_len": 1000,
+            },
+            "Train": {
+                "seed": 0,
+                "batch_size": 256,
+                "learning_rate": 0.01,
+                "epochs": 10,
+                "mask_per": 0.4,
+                "alpha": 0.0,
+                "patience": 3,
+            },
+            "Finetune": [
+                ["Model", "hidden", [64, 128, 256]],
+                ["Model", "n_layers", [1, 2, 3]],
+                ["Train", "learning_rate", [0.002, 0.001, 0.005]],
+            ],
         },
-        "Train": {
-            "seed": 0,
-            "batch_size": 256,
-            "learning_rate": 0.01,
-            "epochs": 10,
-            "mask_per": 0.4,
-            "alpha": 0.0,
-            "patience": 3,
-        },
-        "Finetune": [
-            ["Model", "hidden", [64, 128, 256]],
-            ["Model", "n_layers", [1, 2, 3]],
-            ["Train", "learning_rate", [0.002, 0.001, 0.005]],
-        ]
-    }
+        description="Model, training and hyperparameter-search settings for the LogBERT model.",
+    )
 
 
 class LogBertDetector(DeepLearningDetector):
diff --git a/src/detectmatelibrary/detectors/new_event_detector.py b/src/detectmatelibrary/detectors/new_event_detector.py
index 8048d92c..907b6950 100644
--- a/src/detectmatelibrary/detectors/new_event_detector.py
+++ b/src/detectmatelibrary/detectors/new_event_detector.py
@@ -11,9 +11,13 @@
 from detectmatelibrary.utils.data_buffer import BufferMode
 from detectmatelibrary.schemas import ParserSchema, DetectorSchema
 
+from pydantic import Field
+
 
 class NewEventDetectorConfig(CoreDetectorConfig):
-    method_type: str = "new_event_detector"
+    method_type: str = Field(
+        default="new_event_detector", description="Indicates what type of method it is."
+    )
 
 
 class NewEventDetector(CoreDetector, VariablesLogic):
diff --git a/src/detectmatelibrary/detectors/new_value_combo_detector.py b/src/detectmatelibrary/detectors/new_value_combo_detector.py
index 5a9575ec..29b7d6f3 100644
--- a/src/detectmatelibrary/detectors/new_value_combo_detector.py
+++ b/src/detectmatelibrary/detectors/new_value_combo_detector.py
@@ -16,6 +16,8 @@
 from typing import Any, Dict, Optional, Sequence, Tuple, cast
 from itertools import combinations
 
+from pydantic import Field
+
 from detectmatelibrary.tools.logging import logger
 
 
@@ -24,7 +26,9 @@ def get_combo(variables: Dict[str, Any]) -> Dict[Tuple[str, ...], Tuple[Any, ...
     return {tuple(variables.keys()): tuple(variables.values())}
 
 
-def _combine(iterable: Sequence[str], max_combo_length: int = 2) -> list[Tuple[str, ...]]:
+def _combine(
+    iterable: Sequence[str], max_combo_length: int = 2
+) -> list[Tuple[str, ...]]:
     """Get all possible combinations of an iterable."""
     combos: list[Tuple[str, ...]] = []
     for i in range(2, min(len(iterable), max_combo_length, 5) + 1):
@@ -52,7 +56,10 @@ class ComboAutoConfigParams(VariableAutoConfigParams):
 
 
 class NewValueComboDetectorConfig(VariableDetectorConfig):
-    method_type: str = "new_value_combo_detector"
+    method_type: str = Field(
+        default="new_value_combo_detector",
+        description="Indicates what type of method it is.",
+    )
 
     auto_config_params: ComboAutoConfigParams = ComboAutoConfigParams()
 
@@ -82,7 +89,9 @@ def _event_data_kwargs(self) -> Optional[Dict[str, Any]]:
     def _auto_conf_kwargs(self) -> Optional[Dict[str, Any]]:
         return None  # first-pass auto-config tracks individual variables
 
-    def _prepare_variables(self, variables: Dict[str, Any], stage: str) -> Dict[str, Any]:
+    def _prepare_variables(
+        self, variables: Dict[str, Any], stage: str
+    ) -> Dict[str, Any]:
         if stage == "detection":
             return cast(Dict[str, Any], get_combo(variables))
         return variables
@@ -137,7 +146,10 @@ def set_configuration(self, max_combo_size: int | None = None) -> None:
         # pass 2: stable/static combos -> final config
         combo_selection = {}
         auto = self.config.auto_config_params
-        for event_id, tracker in self.auto_conf_persistency_combos.get_events_data().items():
+        for (
+            event_id,
+            tracker,
+        ) in self.auto_conf_persistency_combos.get_events_data().items():
             stable_combos = (
                 tracker.get_features_by_classification("STABLE")  # type: ignore
                 if auto.use_stable_vars
diff --git a/src/detectmatelibrary/detectors/new_value_detector.py b/src/detectmatelibrary/detectors/new_value_detector.py
index b704a7d2..b11dbc0d 100644
--- a/src/detectmatelibrary/detectors/new_value_detector.py
+++ b/src/detectmatelibrary/detectors/new_value_detector.py
@@ -5,9 +5,13 @@
 
 from typing import Any, Optional
 
+from pydantic import Field
+
 
 class NewValueDetectorConfig(VariableDetectorConfig):
-    method_type: str = "new_value_detector"
+    method_type: str = Field(
+        default="new_value_detector", description="Indicates what type of method it is."
+    )
 
 
 class NewValueDetector(VariableDetector):
diff --git a/src/detectmatelibrary/detectors/random_detector.py b/src/detectmatelibrary/detectors/random_detector.py
index 6e2f2aa8..dd3bac81 100644
--- a/src/detectmatelibrary/detectors/random_detector.py
+++ b/src/detectmatelibrary/detectors/random_detector.py
@@ -1,4 +1,4 @@
-from detectmatelibrary.common._config._formats import EventsConfig, Variable
+from detectmatelibrary.common._config._formats import Variable
 
 from detectmatelibrary.common.detector import CoreDetector, CoreDetectorConfig
 
@@ -7,14 +7,16 @@
 import detectmatelibrary.schemas as schemas
 
 from typing_extensions import override
-from typing import List, Any
+from typing import List
+
+from pydantic import Field
 import numpy as np
 
 
 class RandomDetectorConfig(CoreDetectorConfig):
-    method_type: str = "random_detector"
-
-    events: EventsConfig | dict[str, Any] = {}
+    method_type: str = Field(
+        default="random_detector", description="Indicates what type of method it is."
+    )
 
 
 class RandomDetector(CoreDetector):
@@ -22,7 +24,9 @@ class RandomDetector(CoreDetector):
     data."""
 
     def __init__(
-        self, name: str = "RandomDetector", config: RandomDetectorConfig = RandomDetectorConfig()
+        self,
+        name: str = "RandomDetector",
+        config: RandomDetectorConfig = RandomDetectorConfig(),
     ) -> None:
         if isinstance(config, dict):
             config = RandomDetectorConfig.from_dict(config, name)
@@ -30,13 +34,15 @@ def __init__(
         self.config: RandomDetectorConfig
 
     @override
-    def train(self, input_: List[schemas.ParserSchema] | schemas.ParserSchema) -> None:  # type: ignore
+    def train(self, input_: List[schemas.ParserSchema] | schemas.ParserSchema) -> None:
         """Training is not applicable for RandomDetector."""
         return
 
     @override
     def detect(
-        self, input_: schemas.ParserSchema, output_: schemas.DetectorSchema  # type: ignore
+        self,
+        input_: schemas.ParserSchema,  # type: ignore
+        output_: schemas.DetectorSchema,
     ) -> bool:
         """Detect anomalies randomly in the input data."""
         overall_score = 0.0
@@ -53,7 +59,11 @@ def detect(
             if random > log_variable.params["threshold"]:
                 score = 1.0
                 # Variable has .name, Header has .pos (str)
-                var_name = log_variable.name if isinstance(log_variable, Variable) else log_variable.pos
+                var_name = (
+                    log_variable.name
+                    if isinstance(log_variable, Variable)
+                    else log_variable.pos
+                )
                 alerts.update({var_name: str(score)})
             overall_score += score
 
diff --git a/src/detectmatelibrary/detectors/rule_detector.py b/src/detectmatelibrary/detectors/rule_detector.py
index 06292645..3056fe97 100644
--- a/src/detectmatelibrary/detectors/rule_detector.py
+++ b/src/detectmatelibrary/detectors/rule_detector.py
@@ -16,6 +16,8 @@ def template_rule(
 
 from typing import Any, Callable
 
+from pydantic import Field
+
 
 def template_not_found(input_: schemas.ParserSchema, *args: list[Any]) -> tuple[bool, str]:
     raise_alert = input_["EventID"] == -1
@@ -58,12 +60,17 @@ def __init__(self, rule: str) -> None:
 
 
 class RuleDetectorConfig(CoreDetectorConfig):
-    method_type: str = "rule_detector"
-    rules: list[dict[str, list[str] | str]] = [
-        {"rule": "R001 - TemplateNotFound"},
-        {"rule": "R003 - CheckForExceptions"},
-        {"rule": "R004 - ErrorLevelFound"},
-    ]
+    method_type: str = Field(
+        default="rule_detector", description="Indicates what type of method it is."
+    )
+    rules: list[dict[str, list[str] | str]] = Field(
+        default=[
+            {"rule": "R001 - TemplateNotFound"},
+            {"rule": "R003 - CheckForExceptions"},
+            {"rule": "R004 - ErrorLevelFound"},
+        ],
+        description="List of rules to evaluate, each a dict with a 'rule' name and an optional 'args' list.",
+    )
 
 
 class RuleDetector(CoreDetector):
diff --git a/src/detectmatelibrary/detectors/scvs_detector.py b/src/detectmatelibrary/detectors/scvs_detector.py
index 949cdcd8..d0ad0e87 100644
--- a/src/detectmatelibrary/detectors/scvs_detector.py
+++ b/src/detectmatelibrary/detectors/scvs_detector.py
@@ -13,10 +13,17 @@
 )
 from detectmatelibrary import schemas
 
+from pydantic import Field
+
 
 class SCVSDetectorConfig(CoreDetectorConfig):
-    method_type: str = "scvs_detector"
-    window_size: int = 10
+    method_type: str = Field(
+        default="scvs_detector", description="Indicates what type of method it is."
+    )
+    window_size: int = Field(
+        default=10,
+        description="Length of the event-ID window a count vector is built over.",
+    )
 
 
 class SCVSDetector(CoreDetector, VariablesLogic):
diff --git a/src/detectmatelibrary/detectors/value_range_detector.py b/src/detectmatelibrary/detectors/value_range_detector.py
index 444663e1..449d0550 100644
--- a/src/detectmatelibrary/detectors/value_range_detector.py
+++ b/src/detectmatelibrary/detectors/value_range_detector.py
@@ -1,5 +1,7 @@
 from typing import Any, Dict, Optional
 
+from pydantic import Field
+
 from detectmatelibrary.common.variable_detector import VariableDetector, VariableDetectorConfig
 from detectmatelibrary.utils.persistency.event_data_structures.trackers.stability.stability_tracker import (
     SingleStabilityTracker,
@@ -8,9 +10,17 @@
 
 
 class ValueRangeDetectorConfig(VariableDetectorConfig):
-    method_type: str = "value_range_detector"
+    method_type: str = Field(
+        default="value_range_detector", description="Indicates what type of method it is."
+    )
 
-    ignore_non_numerical_val: bool = True
+    ignore_non_numerical_val: bool = Field(
+        default=True,
+        description=(
+            "Drop non-numeric values instead of raising when a configured "
+            "variable cannot be cast to a number."
+        ),
+    )
 
 
 class ValueRangeDetector(VariableDetector):
diff --git a/src/detectmatelibrary/helper/from_to.py b/src/detectmatelibrary/helper/from_to.py
index a4d361a7..6ce39c22 100644
--- a/src/detectmatelibrary/helper/from_to.py
+++ b/src/detectmatelibrary/helper/from_to.py
@@ -1,4 +1,5 @@
 from detectmatelibrary.common.core import CoreComponent
+from detectmatelibrary.common._core_op._basic_component import TInput, TOutput
 from detectmatelibrary.schemas import BaseSchema, LogSchema
 from detectmatelibrary.utils.id_generator import SimpleIDGenerator
 
@@ -135,7 +136,7 @@ def yaml(
 class _Polars:
     @staticmethod
     def with_dataframe(
-        component: CoreComponent,
+        component: CoreComponent[TInput, TOutput],
         df: pl.DataFrame,
         renames: dict[str, str],
         do_process: bool = True,
@@ -158,7 +159,7 @@ def __generator():  # type: ignore
 
     @staticmethod
     def with_lazyframe(
-        component: CoreComponent,
+        component: CoreComponent[TInput, TOutput],
         df: pl.LazyFrame,
         renames: dict[str, str],
         do_process: bool = True,
@@ -193,7 +194,7 @@ def __generator():  # type: ignore
 class From:
     @staticmethod
     def _yield(
-        component: CoreComponent, in_: Iterator[BaseSchema], do_process: bool = True
+        component: CoreComponent[TInput, TOutput], in_: Iterator[BaseSchema], do_process: bool = True
     ) -> Iterator[BaseSchema]:
         for in_schema in in_:
             if do_process:
@@ -203,7 +204,7 @@ def _yield(
 
     @staticmethod
     def log(
-        component: CoreComponent, in_path: str, do_process: bool = True
+        component: CoreComponent[TInput, TOutput], in_path: str, do_process: bool = True
     ) -> Iterator[BaseSchema]:
         def __generator():  # type: ignore
             id_generator = SimpleIDGenerator(start_id=0)
@@ -219,7 +220,7 @@ def __generator():  # type: ignore
 
     @staticmethod
     def binary_file(
-        component: CoreComponent, in_path: str, do_process: bool = True
+        component: CoreComponent[TInput, TOutput], in_path: str, do_process: bool = True
     ) -> Iterator[BaseSchema]:
         def __generator():  # type: ignore
             with open(in_path, "r") as f:
@@ -232,7 +233,7 @@ def __generator():  # type: ignore
 
     @staticmethod
     def json(
-        component: CoreComponent, in_path: str, do_process: bool = True
+        component: CoreComponent[TInput, TOutput], in_path: str, do_process: bool = True
     ) -> Iterator[BaseSchema]:
         def __generator():  # type: ignore
             with open(in_path, "r") as f:
@@ -245,7 +246,7 @@ def __generator():  # type: ignore
 
     @staticmethod
     def yaml(
-        component: CoreComponent, in_path: str, do_process: bool = True
+        component: CoreComponent[TInput, TOutput], in_path: str, do_process: bool = True
     ) -> Iterator[BaseSchema]:
         def __generator():  # type: ignore
             with open(in_path, "r") as f:
@@ -258,7 +259,7 @@ def __generator():  # type: ignore
 
     @staticmethod
     def polars(
-        component: CoreComponent,
+        component: CoreComponent[TInput, TOutput],
         df: pl.DataFrame | pl.LazyFrame,
         do_process: bool = True,
         renames: dict[str, str] | None = None
@@ -282,7 +283,9 @@ def polars(
 
 class FromTo:
     @staticmethod
-    def log2binary_file(component: CoreComponent, in_path: str, out_path: str) -> Iterator[BaseSchema]:
+    def log2binary_file(
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
+    ) -> Iterator[BaseSchema]:
         gen = From.log(component, in_path=in_path, do_process=True)
 
         for log in gen:
@@ -290,14 +293,18 @@ def log2binary_file(component: CoreComponent, in_path: str, out_path: str) -> It
             yield log
 
     @staticmethod
-    def log2json(component: CoreComponent, in_path: str, out_path: str) -> Iterator[BaseSchema]:
+    def log2json(
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
+    ) -> Iterator[BaseSchema]:
         gen = From.log(component, in_path=in_path, do_process=True)
 
         for log in gen:
             yield To.json(log, out_path=out_path)  # type: ignore
 
     @staticmethod
-    def log2yaml(component: CoreComponent, in_path: str, out_path: str) -> Iterator[BaseSchema]:
+    def log2yaml(
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
+    ) -> Iterator[BaseSchema]:
         gen = From.log(component, in_path=in_path, do_process=True)
 
         for log in gen:
@@ -305,7 +312,7 @@ def log2yaml(component: CoreComponent, in_path: str, out_path: str) -> Iterator[
 
     @staticmethod
     def binary_file2binary_file(
-        component: CoreComponent, in_path: str, out_path: str
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
     ) -> Iterator[BaseSchema]:
 
         gen = From.binary_file(component, in_path=in_path, do_process=True)
@@ -316,7 +323,7 @@ def binary_file2binary_file(
 
     @staticmethod
     def binary_file2json(
-        component: CoreComponent, in_path: str, out_path: str
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
     ) -> Iterator[BaseSchema]:
         gen = From.binary_file(component, in_path=in_path, do_process=True)
 
@@ -325,7 +332,7 @@ def binary_file2json(
 
     @staticmethod
     def binary_file2yaml(
-        component: CoreComponent, in_path: str, out_path: str
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
     ) -> Iterator[BaseSchema]:
         gen = From.binary_file(component, in_path=in_path, do_process=True)
 
@@ -334,7 +341,7 @@ def binary_file2yaml(
 
     @staticmethod
     def json2binary_file(
-        component: CoreComponent, in_path: str, out_path: str
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
     ) -> Iterator[BaseSchema]:
         gen = From.json(component, in_path=in_path, do_process=True)
 
@@ -344,7 +351,7 @@ def json2binary_file(
 
     @staticmethod
     def json2json(
-        component: CoreComponent, in_path: str, out_path: str
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
     ) -> Iterator[BaseSchema]:
         gen = From.json(component, in_path=in_path, do_process=True)
 
@@ -353,7 +360,7 @@ def json2json(
 
     @staticmethod
     def json2yaml(
-        component: CoreComponent, in_path: str, out_path: str
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
     ) -> Iterator[BaseSchema]:
         gen = From.json(component, in_path=in_path, do_process=True)
 
@@ -362,7 +369,7 @@ def json2yaml(
 
     @staticmethod
     def yaml2binary_file(
-        component: CoreComponent, in_path: str, out_path: str
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
     ) -> Iterator[BaseSchema]:
         gen = From.yaml(component, in_path=in_path, do_process=True)
 
@@ -372,7 +379,7 @@ def yaml2binary_file(
 
     @staticmethod
     def yaml2json(
-        component: CoreComponent, in_path: str, out_path: str
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
     ) -> Iterator[BaseSchema]:
         gen = From.yaml(component, in_path=in_path, do_process=True)
 
@@ -381,7 +388,7 @@ def yaml2json(
 
     @staticmethod
     def yaml2yaml(
-        component: CoreComponent, in_path: str, out_path: str
+        component: CoreComponent[TInput, TOutput], in_path: str, out_path: str
     ) -> Iterator[BaseSchema]:
         gen = From.yaml(component, in_path=in_path, do_process=True)
 
@@ -390,7 +397,7 @@ def yaml2yaml(
 
     @staticmethod
     def polars2binary_file(
-        component: CoreComponent,
+        component: CoreComponent[TInput, TOutput],
         df: pl.DataFrame | pl.LazyFrame,
         out_path: str,
         renames: dict[str, str] | None = None
@@ -402,7 +409,7 @@ def polars2binary_file(
 
     @staticmethod
     def polars2json(
-        component: CoreComponent,
+        component: CoreComponent[TInput, TOutput],
         df: pl.DataFrame | pl.LazyFrame,
         out_path: str,
         renames: dict[str, str] | None = None
@@ -414,7 +421,7 @@ def polars2json(
 
     @staticmethod
     def polars2yaml(
-        component: CoreComponent,
+        component: CoreComponent[TInput, TOutput],
         df: pl.DataFrame | pl.LazyFrame,
         out_path: str,
         renames: dict[str, str] | None = None
diff --git a/tests/test_common/test_config.py b/tests/test_common/test_config.py
index 45ee65ab..f31fed46 100644
--- a/tests/test_common/test_config.py
+++ b/tests/test_common/test_config.py
@@ -7,7 +7,7 @@
 )
 from detectmatelibrary.common._config._formats import EventsConfig, _EventConfig
 from detectmatelibrary.common._config import BasicConfig
-from pydantic import ValidationError
+from pydantic import ValidationError, Field
 from tests.test_data import TEST_CONFIG
 import pytest
 import warnings
@@ -15,13 +15,64 @@
 
 
 def load_test_config() -> dict:
-    with open(TEST_CONFIG, 'r') as file:
+    with open(TEST_CONFIG, "r") as file:
         return yaml.safe_load(file)
 
 
 config_test = load_test_config()
 
 
+class DummyConfigDoc(BasicConfig):
+    hello: str | None = Field(default="Hello", description="a way to salute people")
+    dont_show: str = Field(default="a", description="<$IGNORE$> dont show stuff")
+    auto_config: bool = Field(
+        default=True,
+        description="Runs the configuration step before the training process.",
+    )
+
+
+class TestConfigDocs:
+    def test_get_configs(self):
+        docs = BasicConfig().get_docs()
+
+        assert len(docs) == 3
+        assert {
+            "Name": "method_type",
+            "Type": "string",
+            "Default value": "default_method_type",
+            "Description": "Indicates what type of method is.",
+        } in docs
+        assert {
+            "Name": "component_type",
+            "Type": "string",
+            "Default value": "default_type",
+            "Description": "Component type that the class inherent from.",
+        } in docs
+        assert {
+            "Name": "auto_config",
+            "Type": "boolean",
+            "Default value": False,
+            "Description": "Runs the configuration step before the training process.",
+        } in docs
+
+    def test_inherent_class_docs(self):
+        docs = DummyConfigDoc().get_docs()
+
+        assert len(docs) == 4
+        assert {
+            "Name": "auto_config",
+            "Type": "boolean",
+            "Default value": True,
+            "Description": "Runs the configuration step before the training process.",
+        } in docs
+        assert {
+            "Name": "hello",
+            "Type": "string, null",
+            "Default value": "Hello",
+            "Description": "a way to salute people",
+        } in docs
+
+
 class TestConfigMethods:
     def test_get_method(self):
         config = ConfigMethods.get_method(
@@ -30,7 +81,8 @@ def test_get_method(self):
         assert config["method_type"] == "ExampleParser"
         assert not config["auto_config"]
         assert config["params"] == {
-            "log_format": "[<Time>] [<Level>] <Content>", "depth": 4
+            "log_format": "[<Time>] [<Level>] <Content>",
+            "depth": 4,
         }
 
     def test_method_not_found(self):
@@ -42,7 +94,9 @@ def test_method_not_found(self):
     def test_type_not_found(self):
         with pytest.raises(TypeNotFoundError):
             ConfigMethods.get_method(
-                config_test, method_id="example_parser", component_type="non_existent_type"
+                config_test,
+                method_id="example_parser",
+                component_type="non_existent_type",
             )
 
     def test_check_type(self):
@@ -55,9 +109,11 @@ def test_check_type(self):
             ConfigMethods.check_type(config, method_type="IncorrectOne")
 
     def test_process_simple(self):
-        config = ConfigMethods.process(ConfigMethods.get_method(
-            config_test, method_id="example_parser", component_type="parsers"
-        ))
+        config = ConfigMethods.process(
+            ConfigMethods.get_method(
+                config_test, method_id="example_parser", component_type="parsers"
+            )
+        )
 
         assert config["method_type"] == "ExampleParser"
         assert not config["auto_config"]
@@ -66,9 +122,11 @@ def test_process_simple(self):
         assert "params" not in config
 
     def test_process_auto_config(self):
-        config = ConfigMethods.process(ConfigMethods.get_method(
-            config_test, method_id="detector_auto", component_type="detectors"
-        ))
+        config = ConfigMethods.process(
+            ConfigMethods.get_method(
+                config_test, method_id="detector_auto", component_type="detectors"
+            )
+        )
 
         assert config["method_type"] == "ExampleDetector"
         assert config["auto_config"]
@@ -77,18 +135,22 @@ def test_process_auto_config(self):
 
     def test_process_auto_config_false(self):
         with pytest.warns(MissingParamsWarning):
-            ConfigMethods.process(ConfigMethods.get_method(
-                config_test, method_id="detector_wrong", component_type="detectors"
-            ))
+            ConfigMethods.process(
+                ConfigMethods.get_method(
+                    config_test, method_id="detector_wrong", component_type="detectors"
+                )
+            )
 
     def test_process_keeps_params_under_auto_config(self):
         """params are operational and survive the configure phase, so
         auto_config: True alongside params is no longer suspicious."""
         with warnings.catch_warnings():
             warnings.simplefilter("error")
-            config = ConfigMethods.process(ConfigMethods.get_method(
-                config_test, method_id="detector_weird", component_type="detectors"
-            ))
+            config = ConfigMethods.process(
+                ConfigMethods.get_method(
+                    config_test, method_id="detector_weird", component_type="detectors"
+                )
+            )
         assert config["auto_config"] is True
         assert config["hello"] == "a"
 
@@ -96,9 +158,11 @@ def test_process_keeps_params_under_auto_config(self):
 class TestParamsFormat:
     def test_correct_format(self):
         config_test = load_test_config()
-        config = ConfigMethods.process(ConfigMethods.get_method(
-            config_test, method_id="detector_variables", component_type="detectors"
-        ))
+        config = ConfigMethods.process(
+            ConfigMethods.get_method(
+                config_test, method_id="detector_variables", component_type="detectors"
+            )
+        )
 
         assert config["method_type"] == "ExampleDetector"
         assert config["parser"] == "example_parser_1"
@@ -118,9 +182,11 @@ def test_correct_format(self):
         assert event_config.header_variables["Level"].params == {"threshold": 0.2}
 
     def test_correct_format2(self):
-        config = ConfigMethods.process(ConfigMethods.get_method(
-            config_test, method_id="detector_variables2", component_type="detectors"
-        ))
+        config = ConfigMethods.process(
+            ConfigMethods.get_method(
+                config_test, method_id="detector_variables2", component_type="detectors"
+            )
+        )
 
         assert config["method_type"] == "ExampleDetector"
         assert config["parser"] == "example_parser_1"
@@ -138,27 +204,35 @@ def test_correct_format2(self):
 
     def test_return_none_if_not_found(self):
         config_test = load_test_config()
-        config = ConfigMethods.process(ConfigMethods.get_method(
-            config_test, method_id="detector_variables", component_type="detectors"
-        ))
+        config = ConfigMethods.process(
+            ConfigMethods.get_method(
+                config_test, method_id="detector_variables", component_type="detectors"
+            )
+        )
 
         assert isinstance(config["events"][1], _EventConfig)
         assert config["events"]["NotExisting"] is None
 
     def test_get_dict(self):
         config_test = load_test_config()
-        config = ConfigMethods.process(ConfigMethods.get_method(
-            config_test, method_id="detector_variables", component_type="detectors"
-        ))
+        config = ConfigMethods.process(
+            ConfigMethods.get_method(
+                config_test, method_id="detector_variables", component_type="detectors"
+            )
+        )
         variables = config["events"][1].get_all()
 
         assert len(variables) == 4
 
     def test_incorrect_format(self):
         with pytest.raises(ValidationError):
-            ConfigMethods.process(ConfigMethods.get_method(
-                config_test, method_id="detector_incorrect_format1", component_type="detectors"
-            ))
+            ConfigMethods.process(
+                ConfigMethods.get_method(
+                    config_test,
+                    method_id="detector_incorrect_format1",
+                    component_type="detectors",
+                )
+            )
 
 
 class MockupParserConfig(BasicConfig):
diff --git a/tests/test_data/logs_templates.txt b/tests/test_data/logs_templates.txt
new file mode 100644
index 00000000..55f2f311
--- /dev/null
+++ b/tests/test_data/logs_templates.txt
@@ -0,0 +1,4 @@
+op=start ver=<*> format=<*> kernel=<*> auid=<*> pid=<*> uid=<*> ses=<*> res=<*>
+op=set <*> old=<*> auid=<*> ses=<*> res=<*>
+arch=<*> syscall=<*> success=<*> exit=<*> a0=<*> a1=<*> a2=<*> a3=<*> items=<*> ppid=<*> pid=<*> auid=<*> uid=<*> gid=<*> euid=<*> suid=<*> fsuid=<*> egid=<*> sgid=<*> fsgid=<*> tty=<*> ses=<*> comm=<*> exe=<*> key=<*>
+proctitle=<*>