Enum AnomalyEvent 

pub enum AnomalyEvent {
    RateSpike {
        tenant: String,
        rate_per_sec: f64,
        baseline: f64,
        z_score: f64,
        severity: Severity,
        detected_at: String,
    },
    AuthBurst {
        user: String,
        client_ip: String,
        failures: u32,
        window_secs: u32,
        severity: Severity,
        detected_at: String,
    },
    SqlInjection {
        sql_excerpt: String,
        patterns_matched: Vec<String>,
        severity: Severity,
        detected_at: String,
    },
    NovelQuery {
        fingerprint: String,
        sql_excerpt: String,
        detected_at: String,
    },
}

One anomaly detection event.

Variants

RateSpike

Per-tenant request-rate spike against the rolling baseline.

Fields

tenant: String

rate_per_sec: f64

baseline: f64

z_score: f64

severity: Severity

detected_at: String

AuthBurst

Failed-auth burst from a single (user, ip) pair.

Fields

user: String

client_ip: String

failures: u32

window_secs: u32

severity: Severity

detected_at: String

SqlInjection

SQL-injection-shaped statement matched one or more well-known payload patterns.

Fields

sql_excerpt: String

patterns_matched: Vec<String>

severity: Severity

detected_at: String

NovelQuery

First-seen query fingerprint. Informational by default.

Fields

fingerprint: String

sql_excerpt: String

detected_at: String

Implementations

impl AnomalyEvent

pub fn severity(&self) -> Severity

Trait Implementations

impl Clone for AnomalyEvent

fn clone(&self) -> AnomalyEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AnomalyEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for AnomalyEvent

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.