Function scan_request 

pub fn scan_request(
    surfaces: &RequestSurfaces<'_>,
    exclusions: &ResolvedExclusions,
    config: &DetectConfig,
) -> RequestScanVerdict

The multi-surface scan (detectThreat).

Scan the request surfaces in the reference order - URL path, query params (skipping excluded names), headers (excluded names scan with their known-false-positive categories suppressed, the Cookie header one name=value pair at a time, headers in the semantic-only set skipping the semantic analyzer), then the body surface when ResolvedExclusions::scan_body is set - and return the first value that produces an enabled category.

A value none of whose threats is reportable (every category filtered out or skipped) is not a threat: the scan continues with the next value, like the reference’s _check_value_enhanced miss. Regex threats count only when their category is enabled and not skipped for the value; semantic threats are never category-filtered and report their attack type as the category (_threat_category). A threat with no threats list reports as uncategorized.