Module compose 

Bounded shared reads for cross-vertical reports.

Re-exports

pub use alert_context::*;

pub use coverage::*;

pub use rule_health::*;

Modules

alert_context

Triage context for one alert: the alert, the rule that fired it, the rule’s exception lists, the cases that contain the alert, and the rule’s alert volume in a window.

coverage

Detection coverage: the rules matching a filter, grouped by MITRE ATT&CK technique, tactic, index pattern, or integration package, with enabled and disabled counts per group.

readiness

Data readiness of one rule: whether its index patterns resolve, whether its data view exists, and whether its related Fleet packages are installed and used. Reads run one at a time in a fixed order with fixed caps.

rule_health

Health of one rule: its last execution, alert volume in a window, and the exception lists that narrow it.

Structs

AlertActivity

ExceptionCoverage

ExecutionMetrics

LastExecution

ListCoverage

ListFacts

RuleSnapshot

Enums

Part

SkipReason

Constants

MAX_EXCEPTION_LISTS

MAX_PACKAGES

MAX_PATTERNS

MAX_RELATED_CASES

MESSAGE_BYTES

RECENT_ALERTS

Functions

alert_activity

degrade

exception_coverage

is_fatal

is_path_segment

require_path_segment

Refuse an id read from a response or a local file before it becomes one URL path segment. URL parsing removes . and .. segments, so either would move the request to a parent route.

snapshot_by_id

snapshot_by_selector

validate_since