Skip to main content

SyscallAnomalyConfig

agentzero_core::security::syscall_anomaly

Struct SyscallAnomalyConfig

pub struct SyscallAnomalyConfig {
    pub enabled: bool,
    pub strict_mode: bool,
    pub alert_on_unknown_syscall: bool,
    pub max_denied_events_per_minute: u32,
    pub max_total_events_per_minute: u32,
    pub max_alerts_per_minute: u32,
    pub alert_cooldown_secs: u64,
    pub baseline_syscalls: Vec<String>,
}

Expand description

Configuration for the syscall anomaly detector.

Fields§

§enabled: bool§strict_mode: bool§alert_on_unknown_syscall: bool§max_denied_events_per_minute: u32§max_total_events_per_minute: u32§max_alerts_per_minute: u32§alert_cooldown_secs: u64§baseline_syscalls: Vec<String>

Trait Implementations§

impl Clone for SyscallAnomalyConfig

fn clone(&self) -> SyscallAnomalyConfig

Returns a duplicate of the value. Read more

1.0.0 · Source§

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more

impl Debug for SyscallAnomalyConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more

impl Default for SyscallAnomalyConfig

fn default() -> Self

Returns the “default value” for a type. Read more

Auto Trait Implementations§

impl Freeze for SyscallAnomalyConfig

impl RefUnwindSafe for SyscallAnomalyConfig

impl Send for SyscallAnomalyConfig

impl Sync for SyscallAnomalyConfig

impl Unpin for SyscallAnomalyConfig

impl UnsafeUnpin for SyscallAnomalyConfig

impl UnwindSafe for SyscallAnomalyConfig

Blanket Implementations§

impl<T> Any for T
where T: 'static + ?Sized,

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more

impl<T> Borrow<T> for T
where T: ?Sized,

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more

impl<T> BorrowMut<T> for T
where T: ?Sized,

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more

impl<T> CloneToUninit for T
where T: Clone,

unsafe fn clone_to_uninit(&self, dest: *mut u8)

🔬This is a nightly-only experimental API. (clone_to_uninit)

Performs copy-assignment from self to dest. Read more

impl<T> From<T> for T

fn from(t: T) -> T

Returns the argument unchanged.

impl<T> Instrument for T

fn instrument(self, span: Span) -> Instrumented<Self>

Instruments this type with the provided Span, returning an Instrumented wrapper. Read more

fn in_current_span(self) -> Instrumented<Self>

Instruments this type with the current Span, returning an Instrumented wrapper. Read more

impl<T, U> Into<U> for T
where U: From<T>,

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

impl<T> Same for T

type Output = T

Should always be Self

impl<T> ToOwned for T
where T: Clone,

type Owned = T

The resulting type after obtaining ownership.

fn to_owned(&self) -> T

Creates owned data from borrowed data, usually by cloning. Read more

fn clone_into(&self, target: &mut T)

Uses borrowed data to replace owned data, usually by cloning. Read more

impl<T, U> TryFrom<U> for T
where U: Into<T>,

type Error = Infallible

The type returned in the event of a conversion error.

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.

impl<T> WithSubscriber for T

fn with_subscriber<S>(self, subscriber: S) -> WithDispatch<Self>
where S: Into<Dispatch>,

Attaches the provided Subscriber to this type, returning a WithDispatch wrapper. Read more

fn with_current_subscriber(self) -> WithDispatch<Self>

Attaches the current default Subscriber to this type, returning a WithDispatch wrapper. Read more