Struct RuntimeContext 

#[non_exhaustive]
pub struct RuntimeContext {

    pub modifying_process: Option<ProcessDetails>,
    pub modified_at: Option<DateTime>,
    pub script_path: Option<String>,
    pub library_path: Option<String>,
    pub ld_preload_value: Option<String>,
    pub socket_path: Option<String>,
    pub runc_binary_path: Option<String>,
    pub release_agent_path: Option<String>,
    pub mount_source: Option<String>,
    pub mount_target: Option<String>,
    pub file_system_type: Option<String>,
    pub flags: Option<Vec<String>>,
    pub module_name: Option<String>,
    pub module_file_path: Option<String>,
    pub module_sha256: Option<String>,
    pub shell_history_file_path: Option<String>,
    pub target_process: Option<ProcessDetails>,
    pub address_family: Option<String>,
    pub iana_protocol_number: Option<i32>,
    pub memory_regions: Option<Vec<String>>,
    pub tool_name: Option<String>,
    pub tool_category: Option<String>,
    pub service_name: Option<String>,
    pub command_line_example: Option<String>,
    pub threat_file_path: Option<String>,
}

Additional information about the suspicious activity.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

modifying_process: Option<ProcessDetails>

Information about the process that modified the current process. This is available for multiple finding types.

modified_at: Option<DateTime>

The timestamp at which the process modified the current process. The timestamp is in UTC date string format.

script_path: Option<String>

The path to the script that was executed.

library_path: Option<String>

The path to the new library that was loaded.

ld_preload_value: Option<String>

The value of the LD_PRELOAD environment variable.

socket_path: Option<String>

The path to the docket socket that was accessed.

runc_binary_path: Option<String>

The path to the leveraged runc implementation.

release_agent_path: Option<String>

The path in the container that modified the release agent file.

mount_source: Option<String>

The path on the host that is mounted by the container.

mount_target: Option<String>

The path in the container that is mapped to the host directory.

file_system_type: Option<String>

Represents the type of mounted fileSystem.

flags: Option<Vec<String>>

Represents options that control the behavior of a runtime operation or action. For example, a filesystem mount operation may contain a read-only flag.

module_name: Option<String>

The name of the module loaded into the kernel.

module_file_path: Option<String>

The path to the module loaded into the kernel.

module_sha256: Option<String>

The SHA256 hash of the module.

shell_history_file_path: Option<String>

The path to the modified shell history file.

target_process: Option<ProcessDetails>

Information about the process that had its memory overwritten by the current process.

address_family: Option<String>

Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP version of 4 protocol.

iana_protocol_number: Option<i32>

Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family AF_INET only has the IP protocol.

memory_regions: Option<Vec<String>>

Specifies the Region of a process's address space such as stack and heap.

tool_name: Option<String>

Name of the potentially suspicious tool.

tool_category: Option<String>

Category that the tool belongs to. Some of the examples are Backdoor Tool, Pentest Tool, Network Scanner, and Network Sniffer.

service_name: Option<String>

Name of the security service that has been potentially disabled.

command_line_example: Option<String>

Example of the command line involved in the suspicious activity.

threat_file_path: Option<String>

The suspicious file path for which the threat intelligence details were found.

Implementations

impl RuntimeContext

pub fn modifying_process(&self) -> Option<&ProcessDetails>

Information about the process that modified the current process. This is available for multiple finding types.

pub fn modified_at(&self) -> Option<&DateTime>

The timestamp at which the process modified the current process. The timestamp is in UTC date string format.

pub fn script_path(&self) -> Option<&str>

The path to the script that was executed.

pub fn library_path(&self) -> Option<&str>

The path to the new library that was loaded.

pub fn ld_preload_value(&self) -> Option<&str>

The value of the LD_PRELOAD environment variable.

pub fn socket_path(&self) -> Option<&str>

The path to the docket socket that was accessed.

pub fn runc_binary_path(&self) -> Option<&str>

The path to the leveraged runc implementation.

pub fn release_agent_path(&self) -> Option<&str>

The path in the container that modified the release agent file.

pub fn mount_source(&self) -> Option<&str>

The path on the host that is mounted by the container.

pub fn mount_target(&self) -> Option<&str>

The path in the container that is mapped to the host directory.

pub fn file_system_type(&self) -> Option<&str>

Represents the type of mounted fileSystem.

pub fn flags(&self) -> &[String]

Represents options that control the behavior of a runtime operation or action. For example, a filesystem mount operation may contain a read-only flag.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .flags.is_none().

pub fn module_name(&self) -> Option<&str>

The name of the module loaded into the kernel.

pub fn module_file_path(&self) -> Option<&str>

The path to the module loaded into the kernel.

pub fn module_sha256(&self) -> Option<&str>

The SHA256 hash of the module.

pub fn shell_history_file_path(&self) -> Option<&str>

The path to the modified shell history file.

pub fn target_process(&self) -> Option<&ProcessDetails>

Information about the process that had its memory overwritten by the current process.

pub fn address_family(&self) -> Option<&str>

Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP version of 4 protocol.

pub fn iana_protocol_number(&self) -> Option<i32>

Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family AF_INET only has the IP protocol.

pub fn memory_regions(&self) -> &[String]

Specifies the Region of a process's address space such as stack and heap.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .memory_regions.is_none().

pub fn tool_name(&self) -> Option<&str>

Name of the potentially suspicious tool.

pub fn tool_category(&self) -> Option<&str>

Category that the tool belongs to. Some of the examples are Backdoor Tool, Pentest Tool, Network Scanner, and Network Sniffer.

pub fn service_name(&self) -> Option<&str>

Name of the security service that has been potentially disabled.

pub fn command_line_example(&self) -> Option<&str>

Example of the command line involved in the suspicious activity.

pub fn threat_file_path(&self) -> Option<&str>

The suspicious file path for which the threat intelligence details were found.

impl RuntimeContext

pub fn builder() -> RuntimeContextBuilder

Creates a new builder-style object to manufacture RuntimeContext.

Trait Implementations

impl Clone for RuntimeContext

fn clone(&self) -> RuntimeContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuntimeContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for RuntimeContext

fn eq(&self, other: &RuntimeContext) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for RuntimeContext