Struct Anomaly 

pub struct Anomaly {
    pub severity: Severity,
    pub code: &'static str,
    pub kind: AnomalyKind,
    pub note: String,
    pub confidence: Option<f32>,
}

A SQLite forensic anomaly: an observation graded by severity, with a stable code and note derived from its AnomalyKind so they cannot drift.

Fields

severity: Severity

Severity, derived from kind.

code: &'static str

Stable machine-readable code, derived from kind.

kind: AnomalyKind

The classified anomaly.

note: String

Human-readable note, derived from kind.

confidence: Option<f32>

Heuristic confidence, present for inferential findings (e.g. a carved deleted record); None for structurally-certain header observations.

Implementations

impl Anomaly

pub fn new(kind: AnomalyKind) -> Self

Build an Anomaly, deriving severity/code/note from kind.

pub fn with_confidence(self, confidence: f32) -> Self

Attach a heuristic confidence (used for carved deleted records).

Trait Implementations

impl Clone for Anomaly

fn clone(&self) -> Anomaly

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Anomaly

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Observation for Anomaly

fn severity(&self) -> Option<Severity>

Severity, or None if the analyzer deliberately does not grade this kind.

fn code(&self) -> &'static str

Stable, scheme-prefixed machine code.

fn note(&self) -> String

Human-readable, consistent-with note.

fn confidence(&self) -> Option<Confidence>

Heuristic confidence, if inferential (default: none).

fn category(&self) -> Category

Analytical lens; defaults to Category::from_code of Observation::code. Override when a code’s keyword classification is wrong.

fn evidence(&self) -> Vec<Evidence>

Backing evidence rows (default: none).

fn subjects(&self) -> Vec<SubjectRef>

Non-disk subjects this kind is about (default: none).

fn mitre(&self) -> &'static [&'static str]

MITRE ATT&CK technique ids this kind is consistent with (default: none).

fn to_finding(&self, source: Source) -> Finding

Assemble the canonical Finding from this kind and its producing source.

impl PartialEq for Anomaly

fn eq(&self, other: &Anomaly) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Anomaly