Struct ArtifactRecord 

#[non_exhaustive]
pub struct ArtifactRecord {
    pub uid: String,
    pub artifact_id: &'static str,
    pub artifact_name: &'static str,
    pub scope: DataScope,
    pub os_scope: OsScope,
    pub timestamp: Option<String>,
    pub fields: Vec<(&'static str, ArtifactValue)>,
    pub meaning: String,
    pub mitre_techniques: Vec<&'static str>,
    pub confidence: f32,
}

A fully decoded forensic artifact record. This is the universal output type that all consumers receive – no raw bytes, no hardcoded field names.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

uid: String

Globally unique URI, e.g. winreg://HKCU/Software/.../value_name or file:///path/to/file#line.

artifact_id: &'static str

The catalog entry id that produced this record.

artifact_name: &'static str

Human-readable artifact name.

scope: DataScope

Data scope (User/System/…).

os_scope: OsScope

OS scope.

timestamp: Option<String>

Primary timestamp in ISO 8601 UTC, if the artifact has one.

fields: Vec<(&'static str, ArtifactValue)>

Ordered decoded field name-value pairs.

meaning: String

Human-readable meaning, possibly with interpolated field values.

mitre_techniques: Vec<&'static str>

MITRE ATT&CK technique IDs applicable to this record.

confidence: f32

Confidence score 0.0-1.0, set by the decoder or classifier.

Trait Implementations

impl Clone for ArtifactRecord

fn clone(&self) -> ArtifactRecord

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ArtifactRecord

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl PartialEq for ArtifactRecord

fn eq(&self, other: &ArtifactRecord) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ArtifactRecord