Module analysis 

Available on crate feature analysis only.

flowscope::analysis — the opt-in composition layer that turns parser output into enriched, SIEM-ready flow records.

flowscope’s detect primitives (FlowRisk, IocSet, the fingerprints) are decoupled by design — none of them are wired to the flow lifecycle. This module is the wiring: feed it the parser messages you already produce, and on flow end it hands back an AnalyzedFlow bundling the 5-tuple, the FlowStats, a curated L7Summary, the computed FlowRisk, and any threat-intel IocMatch hits — so a consumer doesn’t re-implement risk/IOC/L7 correlation for the Nth time.

It stays true to the project’s principles: runtime-free, bounded memory (FlowAnalyzer::with_capacity + TTL eviction), a pure composition layer over the existing parsers (not baked into the core tracker), and features/scores, not verdicts (AnalyzedFlow reports FlowRisk + IOC hits; the malicious/benign call stays app-side).

use std::time::Duration;
use flowscope::analysis::FlowAnalyzer;
use flowscope::detect::IocSet;
use flowscope::extract::FiveTupleKey;

let mut ioc = IocSet::new();
ioc.insert(flowscope::detect::IocKind::Domain, "evil.example", Some(90), None);

let mut analyzer =
    FlowAnalyzer::<FiveTupleKey>::with_capacity(Duration::from_secs(120), 100_000)
        .with_ioc(ioc);

// … per flow: analyzer.observe_tls(&key, &handshake, ts); …
// on the flow's Ended event:
//   let record = analyzer.finalize(&key, stats);
//   if !record.is_clean() { ship(record); }

Issue #83.

Structs

AnalyzedFlow

An enriched flow record: 5-tuple + stats + L7 summary + computed risk + IOC hits.

FlowAnalyzer

Per-flow analysis accumulator. Generic over the flow key K.

L7Summary

Curated security-relevant L7 facts observed on a flow.

Constants

MAX_DNS_QUERIES

Upper bound on stored DNS query names per flow — keeps a chatty resolver flow from growing the summary without limit (the project’s bounded-memory rule).