Struct SecurityAlert 

pub struct SecurityAlert {

    pub schema: String,
    pub ts_ms: i64,
    pub sequence_id: u64,
    pub extension_id: String,
    pub category: SecurityAlertCategory,
    pub severity: SecurityAlertSeverity,
    pub capability: String,
    pub method: String,
    pub reason_codes: Vec<String>,
    pub summary: String,
    pub policy_source: String,
    pub action: SecurityAlertAction,
    pub remediation: String,
    pub risk_score: f64,
    pub risk_state: Option<RuntimeRiskStateLabelValue>,
    pub context_hash: String,
}

A structured security alert with who/what/why/action fields.

Designed for both interactive display and downstream integrations (RPC, SIEM, structured logging).

Fields

schema: String

Schema version tag for stable deserialization.

ts_ms: i64

Unix epoch milliseconds when the alert was generated.

sequence_id: u64

Monotonically increasing alert sequence number.

extension_id: String

Extension that triggered the alert (empty for global events).

category: SecurityAlertCategory

Alert category for quick classification.

severity: SecurityAlertSeverity

Severity level.

capability: String

Capability involved (e.g. “exec”, “env”, “http”).

method: String

Method or sub-operation (e.g. “spawn”, “get”, “set”).

reason_codes: Vec<String>

Structured reason codes (machine-readable).

summary: String

Human-readable summary of why the alert was raised.

policy_source: String

Policy source that caused the decision (e.g. “deny_caps”, “exec_mediation”, “risk_scorer”, “quota”).

action: SecurityAlertAction

Enforcement action taken.

remediation: String

Suggested remediation for the user.

risk_score: f64

Risk score at the time of the alert (0.0 if not applicable).

risk_state: Option<RuntimeRiskStateLabelValue>

Derived risk state label (if from risk scorer).

context_hash: String

Hash of the related command or params (redacted).

Implementations

impl SecurityAlert

pub fn from_policy_denial( extension_id: &str, capability: &str, method: &str, reason: &str, policy_source: &str, ) -> Self

Create a policy-denial alert.

pub fn from_exec_mediation( extension_id: &str, command: &str, class_label: Option<&str>, reason: &str, ) -> Self

Create an exec-mediation alert.

pub fn from_secret_redaction(extension_id: &str, var_name: &str) -> Self

Create a secret-broker redaction alert.

pub fn from_anomaly_detection( extension_id: &str, capability: &str, method: &str, risk_score: f64, risk_state: RuntimeRiskStateLabelValue, enforcement_action: SecurityAlertAction, reason_codes: Vec<String>, summary: String, ) -> Self

Create a risk-scorer anomaly alert.

pub fn from_quarantine( extension_id: &str, reason: &str, risk_score: f64, ) -> Self

Create a quarantine alert.

pub fn from_enforcement_transition( extension_id: &str, transition: &EnforcementTransition, ) -> Self

Create an enforcement state transition alert.

Trait Implementations

impl Clone for SecurityAlert

fn clone(&self) -> SecurityAlert

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityAlert

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecurityAlert

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for SecurityAlert

fn eq(&self, other: &SecurityAlert) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SecurityAlert

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SecurityAlert