Struct ArtifactDescriptor 

pub struct ArtifactDescriptor {

    pub id: &'static str,
    pub name: &'static str,
    pub artifact_type: ArtifactLocation,
    pub hive: Option<HiveTarget>,
    pub key_path: &'static str,
    pub value_name: Option<&'static str>,
    pub file_path: Option<&'static str>,
    pub scope: DataScope,
    pub os_scope: OsScope,
    pub decoder: Decoder,
    pub meaning: &'static str,
    pub mitre_techniques: &'static [&'static str],
    pub fields: &'static [FieldSchema],
    pub retention: Option<&'static str>,
    pub triage_priority: TriagePriority,
    pub related_artifacts: &'static [&'static str],
    pub sources: &'static [&'static str],
    pub evidence_strength: Option<EvidenceStrength>,
    pub evidence_caveats: &'static [&'static str],
    pub volatility: Option<VolatilityClass>,
    pub volatility_rationale: &'static str,
}

A single entry in the forensic artifact catalog. Fully const-constructible so it can live in a static.

Fields

id: &'static str

Short machine-readable identifier, e.g. "userassist".

name: &'static str

Human-readable display name.

artifact_type: ArtifactLocation

What kind of artifact location this is.

hive: Option<HiveTarget>

Which registry hive, or None for non-registry artifacts.

key_path: &'static str

Registry key path relative to the hive root (empty for non-registry).

value_name: Option<&'static str>

Specific registry value name, if targeting a single value.

file_path: Option<&'static str>

Filesystem path, for file/directory artifacts.

scope: DataScope

User vs System vs Mixed scope.

os_scope: OsScope

Minimum OS version required.

decoder: Decoder

How to decode the raw data.

meaning: &'static str

Forensic meaning / significance of this artifact.

mitre_techniques: &'static [&'static str]

MITRE ATT&CK technique IDs.

fields: &'static [FieldSchema]

Schema of the decoded output fields.

retention: Option<&'static str>

How long this artifact typically persists before being overwritten or rotated. None means indefinite (registry keys, most files until explicitly deleted).

triage_priority: TriagePriority

Live triage collection priority.

related_artifacts: &'static [&'static str]

IDs of related catalog descriptors useful for cross-correlation.

sources: &'static [&'static str]

Authoritative external references for this artifact (SANS, Harlan Carvey, Brian Carrier, Red Canary, Microsoft docs, MITRE ATT&CK, etc.). Every production entry should have at least one URL.

evidence_strength: Option<EvidenceStrength>

How strongly this artifact proves a fact in isolation, or None if not yet assessed.

evidence_caveats: &'static [&'static str]

Known caveats, edge cases, or false-positive scenarios for this artifact.

volatility: Option<VolatilityClass>

How quickly this artifact is overwritten or lost, or None if not yet assessed.

volatility_rationale: &'static str

One-line rationale for the volatility classification.

Trait Implementations

impl Clone for ArtifactDescriptor

fn clone(&self) -> ArtifactDescriptor

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ArtifactDescriptor

impl Debug for ArtifactDescriptor

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for ArtifactDescriptor

impl PartialEq for ArtifactDescriptor

fn eq(&self, other: &ArtifactDescriptor) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for ArtifactDescriptor