Skip to main content

AnomalyFields

Trait AnomalyFields 

Source
pub trait AnomalyFields {
    // Provided methods
    fn anomaly_type(&self) -> Option<&'static str> { ... }
    fn anomaly_event(&self) -> Option<&'static str> { ... }
}
Expand description

Anomaly classification accessor — implemented on crate::AnomalyKind in this crate. Consumers writing alert-shaped emit writers (EVE, future Suricata-shaped outputs) constrain on this trait separately from KeyFields.

Provided Methods§

Source

fn anomaly_type(&self) -> Option<&'static str>

EVE anomaly.type classification.

Suricata schema:

  • "stream" — transport-layer state / reassembly anomalies
  • "decode" — frame-integrity anomalies
  • "applayer" — parser-driven application-layer anomalies
Source

fn anomaly_event(&self) -> Option<&'static str>

EVE anomaly.event — the stable slug, e.g. "ooo_segment" or "buffer_overflow". crate::AnomalyKind implements via short_kind().

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§

Source§

impl AnomalyFields for AnomalyKind

Available on crate feature tracker only.