Struct RuntimePolicy 

pub struct RuntimePolicy {
    pub alert_threshold: f64,
    pub suspicious_processes: Vec<String<MAX_LABEL_LEN>, MAX_SUSPICIOUS_PROCESSES>,
    pub suspicious_patterns: Vec<String<MAX_LABEL_LEN>, MAX_SUSPICIOUS_PATTERNS>,
    pub registered_custom_conditions: Vec<String<MAX_LABEL_LEN>, MAX_CUSTOM_CONDITIONS>,
}

Stack-only runtime policy for no-allocation operation.

Fields

alert_threshold: f64

Alert threshold.

suspicious_processes: Vec<String<MAX_LABEL_LEN>, MAX_SUSPICIOUS_PROCESSES>

Suspicious process patterns.

suspicious_patterns: Vec<String<MAX_LABEL_LEN>, MAX_SUSPICIOUS_PATTERNS>

Suspicious artifact patterns.

registered_custom_conditions: Vec<String<MAX_LABEL_LEN>, MAX_CUSTOM_CONDITIONS>

Registered custom condition names.

Implementations

impl RuntimePolicy

pub fn is_suspicious_process(&self, name: &str) -> bool

Check for suspicious process name using ASCII case-insensitive substring matching.

No heap allocation occurs.

pub fn is_registered_custom_condition(&self, name: &str) -> bool

Check if a custom condition name is pre-registered.

Trait Implementations

impl Clone for RuntimePolicy

fn clone(&self) -> RuntimePolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.