Struct HuntQuery 

pub struct HuntQuery {
    pub sources: Vec<EventSource>,
    pub verdict: Option<QueryVerdict>,
    pub start: Option<DateTime<Utc>>,
    pub end: Option<DateTime<Utc>>,
    pub action_type: Option<String>,
    pub process: Option<String>,
    pub namespace: Option<String>,
    pub pod: Option<String>,
    pub limit: usize,
    pub entity: Option<String>,
}

Structured query over historical events.

Fields

sources: Vec<EventSource>

verdict: Option<QueryVerdict>

start: Option<DateTime<Utc>>

end: Option<DateTime<Utc>>

action_type: Option<String>

process: Option<String>

namespace: Option<String>

pod: Option<String>

limit: usize

entity: Option<String>

Implementations

impl HuntQuery

pub fn effective_sources(&self) -> Vec<EventSource>

Returns the effective sources: the configured list, or all sources if empty.

pub fn matches(&self, event: &TimelineEvent) -> bool

Returns true if the event matches ALL active predicates.

Trait Implementations

impl Clone for HuntQuery

fn clone(&self) -> HuntQuery

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HuntQuery

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for HuntQuery

fn default() -> Self

Returns the “default value” for a type.