Struct RuntimeContextBuilder 

#[non_exhaustive]
pub struct RuntimeContextBuilder { /* private fields */ }

A builder for RuntimeContext.

Implementations

impl RuntimeContextBuilder

pub fn modifying_process(self, input: ProcessDetails) -> Self

Information about the process that modified the current process. This is available for multiple finding types.

pub fn set_modifying_process(self, input: Option<ProcessDetails>) -> Self

Information about the process that modified the current process. This is available for multiple finding types.

pub fn get_modifying_process(&self) -> &Option<ProcessDetails>

Information about the process that modified the current process. This is available for multiple finding types.

pub fn modified_at(self, input: DateTime) -> Self

The timestamp at which the process modified the current process. The timestamp is in UTC date string format.

pub fn set_modified_at(self, input: Option<DateTime>) -> Self

The timestamp at which the process modified the current process. The timestamp is in UTC date string format.

pub fn get_modified_at(&self) -> &Option<DateTime>

The timestamp at which the process modified the current process. The timestamp is in UTC date string format.

pub fn script_path(self, input: impl Into<String>) -> Self

The path to the script that was executed.

pub fn set_script_path(self, input: Option<String>) -> Self

The path to the script that was executed.

pub fn get_script_path(&self) -> &Option<String>

The path to the script that was executed.

pub fn library_path(self, input: impl Into<String>) -> Self

The path to the new library that was loaded.

pub fn set_library_path(self, input: Option<String>) -> Self

The path to the new library that was loaded.

pub fn get_library_path(&self) -> &Option<String>

The path to the new library that was loaded.

pub fn ld_preload_value(self, input: impl Into<String>) -> Self

The value of the LD_PRELOAD environment variable.

pub fn set_ld_preload_value(self, input: Option<String>) -> Self

The value of the LD_PRELOAD environment variable.

pub fn get_ld_preload_value(&self) -> &Option<String>

The value of the LD_PRELOAD environment variable.

pub fn socket_path(self, input: impl Into<String>) -> Self

The path to the docket socket that was accessed.

pub fn set_socket_path(self, input: Option<String>) -> Self

The path to the docket socket that was accessed.

pub fn get_socket_path(&self) -> &Option<String>

The path to the docket socket that was accessed.

pub fn runc_binary_path(self, input: impl Into<String>) -> Self

The path to the leveraged runc implementation.

pub fn set_runc_binary_path(self, input: Option<String>) -> Self

The path to the leveraged runc implementation.

pub fn get_runc_binary_path(&self) -> &Option<String>

The path to the leveraged runc implementation.

pub fn release_agent_path(self, input: impl Into<String>) -> Self

The path in the container that modified the release agent file.

pub fn set_release_agent_path(self, input: Option<String>) -> Self

The path in the container that modified the release agent file.

pub fn get_release_agent_path(&self) -> &Option<String>

The path in the container that modified the release agent file.

pub fn mount_source(self, input: impl Into<String>) -> Self

The path on the host that is mounted by the container.

pub fn set_mount_source(self, input: Option<String>) -> Self

The path on the host that is mounted by the container.

pub fn get_mount_source(&self) -> &Option<String>

The path on the host that is mounted by the container.

pub fn mount_target(self, input: impl Into<String>) -> Self

The path in the container that is mapped to the host directory.

pub fn set_mount_target(self, input: Option<String>) -> Self

The path in the container that is mapped to the host directory.

pub fn get_mount_target(&self) -> &Option<String>

The path in the container that is mapped to the host directory.

pub fn file_system_type(self, input: impl Into<String>) -> Self

Represents the type of mounted fileSystem.

pub fn set_file_system_type(self, input: Option<String>) -> Self

Represents the type of mounted fileSystem.

pub fn get_file_system_type(&self) -> &Option<String>

Represents the type of mounted fileSystem.

pub fn flags(self, input: impl Into<String>) -> Self

Appends an item to flags.

To override the contents of this collection use set_flags.

Represents options that control the behavior of a runtime operation or action. For example, a filesystem mount operation may contain a read-only flag.

pub fn set_flags(self, input: Option<Vec<String>>) -> Self

Represents options that control the behavior of a runtime operation or action. For example, a filesystem mount operation may contain a read-only flag.

pub fn get_flags(&self) -> &Option<Vec<String>>

Represents options that control the behavior of a runtime operation or action. For example, a filesystem mount operation may contain a read-only flag.

pub fn module_name(self, input: impl Into<String>) -> Self

The name of the module loaded into the kernel.

pub fn set_module_name(self, input: Option<String>) -> Self

The name of the module loaded into the kernel.

pub fn get_module_name(&self) -> &Option<String>

The name of the module loaded into the kernel.

pub fn module_file_path(self, input: impl Into<String>) -> Self

The path to the module loaded into the kernel.

pub fn set_module_file_path(self, input: Option<String>) -> Self

The path to the module loaded into the kernel.

pub fn get_module_file_path(&self) -> &Option<String>

The path to the module loaded into the kernel.

pub fn module_sha256(self, input: impl Into<String>) -> Self

The SHA256 hash of the module.

pub fn set_module_sha256(self, input: Option<String>) -> Self

The SHA256 hash of the module.

pub fn get_module_sha256(&self) -> &Option<String>

The SHA256 hash of the module.

pub fn shell_history_file_path(self, input: impl Into<String>) -> Self

The path to the modified shell history file.

pub fn set_shell_history_file_path(self, input: Option<String>) -> Self

The path to the modified shell history file.

pub fn get_shell_history_file_path(&self) -> &Option<String>

The path to the modified shell history file.

pub fn target_process(self, input: ProcessDetails) -> Self

Information about the process that had its memory overwritten by the current process.

pub fn set_target_process(self, input: Option<ProcessDetails>) -> Self

Information about the process that had its memory overwritten by the current process.

pub fn get_target_process(&self) -> &Option<ProcessDetails>

Information about the process that had its memory overwritten by the current process.

pub fn address_family(self, input: impl Into<String>) -> Self

Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP version of 4 protocol.

pub fn set_address_family(self, input: Option<String>) -> Self

Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP version of 4 protocol.

pub fn get_address_family(&self) -> &Option<String>

Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP version of 4 protocol.

pub fn iana_protocol_number(self, input: i32) -> Self

Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family AF_INET only has the IP protocol.

pub fn set_iana_protocol_number(self, input: Option<i32>) -> Self

Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family AF_INET only has the IP protocol.

pub fn get_iana_protocol_number(&self) -> &Option<i32>

Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family AF_INET only has the IP protocol.

pub fn memory_regions(self, input: impl Into<String>) -> Self

Appends an item to memory_regions.

To override the contents of this collection use set_memory_regions.

Specifies the Region of a process's address space such as stack and heap.

pub fn set_memory_regions(self, input: Option<Vec<String>>) -> Self

Specifies the Region of a process's address space such as stack and heap.

pub fn get_memory_regions(&self) -> &Option<Vec<String>>

Specifies the Region of a process's address space such as stack and heap.

pub fn tool_name(self, input: impl Into<String>) -> Self

Name of the potentially suspicious tool.

pub fn set_tool_name(self, input: Option<String>) -> Self

Name of the potentially suspicious tool.

pub fn get_tool_name(&self) -> &Option<String>

Name of the potentially suspicious tool.

pub fn tool_category(self, input: impl Into<String>) -> Self

Category that the tool belongs to. Some of the examples are Backdoor Tool, Pentest Tool, Network Scanner, and Network Sniffer.

pub fn set_tool_category(self, input: Option<String>) -> Self

Category that the tool belongs to. Some of the examples are Backdoor Tool, Pentest Tool, Network Scanner, and Network Sniffer.

pub fn get_tool_category(&self) -> &Option<String>

Category that the tool belongs to. Some of the examples are Backdoor Tool, Pentest Tool, Network Scanner, and Network Sniffer.

pub fn service_name(self, input: impl Into<String>) -> Self

Name of the security service that has been potentially disabled.

pub fn set_service_name(self, input: Option<String>) -> Self

Name of the security service that has been potentially disabled.

pub fn get_service_name(&self) -> &Option<String>

Name of the security service that has been potentially disabled.

pub fn command_line_example(self, input: impl Into<String>) -> Self

Example of the command line involved in the suspicious activity.

pub fn set_command_line_example(self, input: Option<String>) -> Self

Example of the command line involved in the suspicious activity.

pub fn get_command_line_example(&self) -> &Option<String>

Example of the command line involved in the suspicious activity.

pub fn threat_file_path(self, input: impl Into<String>) -> Self

The suspicious file path for which the threat intelligence details were found.

pub fn set_threat_file_path(self, input: Option<String>) -> Self

The suspicious file path for which the threat intelligence details were found.

pub fn get_threat_file_path(&self) -> &Option<String>

The suspicious file path for which the threat intelligence details were found.

pub fn build(self) -> RuntimeContext

Consumes the builder and constructs a RuntimeContext.

Trait Implementations

impl Clone for RuntimeContextBuilder

fn clone(&self) -> RuntimeContextBuilder

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuntimeContextBuilder

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RuntimeContextBuilder

fn default() -> RuntimeContextBuilder

Returns the “default value” for a type.

impl PartialEq for RuntimeContextBuilder

fn eq(&self, other: &RuntimeContextBuilder) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for RuntimeContextBuilder