Enum DetectorKind 

#[non_exhaustive]
pub enum DetectorKind {
    BeaconCv,
    BeaconRita,
    PortScanTrw,
    Dga,
    DnsTunnel,
    NewlyObservedDomain,
    ConnectionFlood,
    DataExfil,
    Other(&'static str),
    Unknown,
}

Which detector produced an anomaly.

Built-in variants cover every detector shipped in crate::detect::patterns. Downstream crates register their own kinds via Self::Other.

#[non_exhaustive] — future detectors will add variants; matching on this enum should always include a wildcard arm. Serializes as its as_str slug — a plain JSON string (e.g. "BeaconCv"), not a tagged object — so the kind field in emitted anomalies matches the pre-0.21 Cow<'static, str> wire shape byte-for-byte. Deserializes a slug back via from_slug: built-in slugs round-trip to their variant; an unrecognised slug (including a downstream Other label) deserializes to Unknown — it cannot rebuild the &'static str an Other needs.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

BeaconCv

Coefficient-of-variation beacon detector (crate::detect::patterns::BeaconDetector).

BeaconRita

RITA-style robust beacon detector (Bowley skewness + MADM; crate::detect::patterns::RitaBeaconDetector).

PortScanTrw

Threshold Random Walk port-scan detector (crate::detect::patterns::PortScanDetector).

Dga

DGA domain scorer (crate::detect::patterns::DgaScorer).

DnsTunnel

DNS tunneling detector — distinct-subdomain cardinality (DnsTunnelDetector, issue #132).

NewlyObservedDomain

Newly-observed-domain detector — bounded first-seen set (NewlyObservedDomainDetector, issue #132).

ConnectionFlood

Per-source connection-rate flood detector (ConnectionFloodDetector, issue #132).

DataExfil

EWMA-variance outbound-volume exfiltration detector (DataExfilDetector, issue #132).

Other(&'static str)

Downstream-registered detector kind. The &'static str label should be a unique stable slug — typical convention is "crate-name/detector" (e.g. "zensight/sigma").

Unknown

Detector identity unknown — the deserialization fallback for unrecognised slugs (an Other can’t be rebuilt from a runtime string). Also the Default.

Implementations

impl DetectorKind

pub fn as_str(&self) -> &'static str

Stable slug — same vocabulary the 0.20-and-earlier OwnedAnomaly::kind string carried. Use for metric labels and JSON emission (EVE anomaly.event, NDJSON kind).

Each built-in variant maps to the slug its detector historically emitted (BeaconCv → "BeaconCv", PortScanTrw → "PortScanTRW", Dga → "DgaScorer", …); the full mapping is regression-pinned by slug_vocabulary_locked. Self::Other yields its wrapped caller-supplied slug; Self::Unknown yields "unknown". from_slug is the inverse.

pub fn from_slug(s: &str) -> DetectorKind

Inverse of as_str for the built-in slugs.

A recognised built-in slug maps to its variant; any other string maps to Unknown (it can’t become an Other — that variant needs a &'static str, which a runtime string isn’t). Used by the Deserialize impl.

pub fn attack_technique(&self) -> Option<&'static str>

MITRE ATT&CK technique ID for the behaviour this detector flags, in the stable Txxxx / Txxxx.yyy form, or None when no single technique applies (Other / Unknown).

Mapping rationale:

• Beaconing → T1071 Application Layer Protocol (the C2 channel protocol is unknown at detection time, so the parent technique — not a sub-technique — applies).
• Port scan → T1046 Network Service Discovery.
• DGA → T1568.002 Dynamic Resolution: Domain Generation Algorithms.
• DNS tunnel → T1071.004 Application Layer Protocol: DNS.
• Newly-observed domain → T1568 Dynamic Resolution (NOD is the defender-observable signal of dynamic resolution infrastructure; T1583.001 covers adversary acquisition, which passive capture can’t see).
• Connection flood → T1498 Network Denial of Service (rate-shaped; scan-shaped fan-out is PortScanTrw’s T1046).
• Data exfil → T1048 Exfiltration Over Alternative Protocol (the RITA / AC-Hunter N-sigma outbound-volume precedent; T1030 Data Transfer Size Limits is the adversary’s evasion of exactly this detector — wrong axis).

Trait Implementations

impl Clone for DetectorKind

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for DetectorKind

impl Debug for DetectorKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DetectorKind

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for DetectorKind

Available on crate feature serde only.

fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error>

Deserialize this value from the given Serde deserializer.

impl Display for DetectorKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for DetectorKind

impl Hash for DetectorKind

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for DetectorKind

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for DetectorKind

Available on crate feature serde only.

fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error>

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for DetectorKind