Struct Finding 

pub struct Finding {

    pub line: usize,
    pub source: String,
    pub rule_id: String,
    pub description: String,
    pub techniques: Vec<Technique>,
    pub telemetry: Vec<String>,
    pub detections: Vec<Detection>,
    pub edr: Vec<EdrMapping>,
    pub observed_side_effects: Vec<SideEffect>,
    pub noise: u8,
    pub severity: Severity,
    pub matched_command: Option<Command>,
    pub observed_event: Option<Arc<HashMap<String, String>>>,
}

A single detection-coverage finding tied to a source line.

Fields

line: usize

1-based line of the input this finding came from. For ingested telemetry, the 1-based record number instead.

source: String

The source text that produced the finding — the command line as written.

rule_id: String

The KbEntry::id that matched.

description: String

What a defender would observe, from the matched entry.

techniques: Vec<Technique>

The ATT&CK technique(s) this action implements.

telemetry: Vec<String>

The concrete host events this action produces.

detections: Vec<Detection>

Detections that would fire. Authored claims from the knowledge base unless the report was enriched from a real ruleset, in which case each carries a verdict.

edr: Vec<EdrMapping>

EDR sensor-event mappings, populated only when --edr is requested.

observed_side_effects: Vec<SideEffect>

Non-execution events (network / file / registry) correlated by process id to the execution this finding came from — confirmed secondary telemetry. Populated only for ingested telemetry; empty for predictive analysis.

noise: u8

Detectability on a 0-100 scale: how strongly this action surfaces in defensive telemetry. Higher = louder. Not a severity or a risk score — a quiet action is not a safe one.

severity: Severity

The bucket noise falls in.

matched_command: Option<Command>

The command this finding was matched from, kept for rule-logic evaluation (coverage gaps). Not serialized.

observed_event: Option<Arc<HashMap<String, String>>>

The real recorded event fields when this finding came from ingested telemetry, so Sigma evaluation can consult fields a command line cannot supply (ParentImage, User, IntegrityLevel, …). None for predictive (text) analysis. Shared (Arc) so the several findings a single record produces point at one event map rather than each deep-cloning it. Not serialized.

Trait Implementations

impl Clone for Finding

fn clone(&self) -> Finding

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Finding

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Finding

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Finding

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.