Struct KbEntry 

pub struct KbEntry {
    pub id: String,
    pub matcher: Matcher,
    pub example: Option<String>,
    pub description: String,
    pub techniques: Vec<Technique>,
    pub telemetry: Vec<String>,
    pub detections: Vec<Detection>,
    pub noise: u8,
}

One entry in the knowledge base: a rule that maps a shell action to the techniques it implements, the telemetry it emits, and the detections that would fire.

Matching is driven by the structured Matcher under the required match key. (The legacy substring fields command / args_contains / raw_contains were removed once every knowledge base finished migrating.)

Fields

id: String

Stable kebab-case identifier, unique within its knowledge base. Surfaces as a finding’s rule_id.

matcher: Matcher

The structured matcher that decides whether this entry applies to a line.

example: Option<String>

A representative command line this entry should match, used to synthesize an example event for --verify-detections / --scaffold and to drive the self-consistency guard. Required for entries whose matcher uses a regex leaf (a pattern cannot be reversed into a literal); optional otherwise, where it overrides the literal-derived representative.

description: String

One line describing what a defender would observe — written from the defender’s side, not the operator’s.

techniques: Vec<Technique>

The ATT&CK technique(s) this action implements.

telemetry: Vec<String>

The concrete host events this action produces, in the platform’s own vocabulary (Sysmon EID 1, auditd execve, ESF NOTIFY_EXEC, …).

detections: Vec<Detection>

Representative detections that would fire. Authored claims — run --verify-detections against a real ruleset to find out which hold.

noise: u8

Detectability on a 0-100 scale: how likely this action is to surface in defensive telemetry. Higher = louder.

Implementations

impl KbEntry

pub fn representative_line(&self) -> Option<String>

A representative command line this entry matches: the author-supplied example when present, otherwise one derived from the matcher’s literals. None only for a bare matcher with neither — which the self-consistency guard rejects.

Trait Implementations

impl Clone for KbEntry

fn clone(&self) -> KbEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KbEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for KbEntry

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.