Struct FindingContext 

#[non_exhaustive]
pub struct FindingContext {
    pub confidence: Option<Confidence>,
    pub occurrences: Option<NonZeroU64>,
    pub timestamps: Vec<Timestamp>,
    pub external_refs: Vec<ExternalRef>,
    pub tags: Vec<Cow<'static, str>>,
}

Optional behavioral / aggregation context for a finding. Disk findings leave this at its default; behavioral analyzers (memory, winevt, srum) populate it.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

confidence: Option<Confidence>

Heuristic confidence, when the finding is inferential rather than structural.

occurrences: Option<NonZeroU64>

Number of underlying occurrences this finding aggregates (default 1).

timestamps: Vec<Timestamp>

Timestamps anchoring the finding in time.

external_refs: Vec<ExternalRef>

External references the finding is consistent with (MITRE ATT&CK, CVE …).

tags: Vec<Cow<'static, str>>

Analyzer-specific labels (filter flags, sub-classifications) without schema churn.

Trait Implementations

impl Clone for FindingContext

fn clone(&self) -> FindingContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FindingContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for FindingContext

fn default() -> FindingContext

Returns the “default value” for a type.

impl PartialEq for FindingContext

fn eq(&self, other: &FindingContext) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for FindingContext