Struct IncidentEvidenceBundle 

pub struct IncidentEvidenceBundle {

    pub schema: String,
    pub generated_at_ms: i64,
    pub bundle_hash: String,
    pub filter: IncidentBundleFilter,
    pub redaction: IncidentBundleRedactionPolicy,
    pub risk_ledger: RuntimeRiskLedgerArtifact,
    pub security_alerts: SecurityAlertArtifact,
    pub hostcall_telemetry: RuntimeHostcallTelemetryArtifact,
    pub exec_mediation: ExecMediationArtifact,
    pub secret_broker: SecretBrokerArtifact,
    pub quota_breaches: Vec<QuotaBreachEvent>,
    pub risk_replay: Option<RuntimeRiskReplayArtifact>,
    pub summary: IncidentBundleSummary,
}

A self-contained incident evidence bundle containing all security artifacts for a filtered scope. Deterministic for the same scope and data.

Fields

schema: String

Schema version tag.

generated_at_ms: i64

Unix epoch milliseconds when the bundle was generated.

bundle_hash: String

SHA-256 hash of the serialised content sections (integrity seal).

filter: IncidentBundleFilter

Filter that was applied to produce this bundle.

redaction: IncidentBundleRedactionPolicy

Redaction policy that was applied.

risk_ledger: RuntimeRiskLedgerArtifact

Runtime risk decision ledger (hash-chained).

security_alerts: SecurityAlertArtifact

Security alerts matching the filter.

hostcall_telemetry: RuntimeHostcallTelemetryArtifact

Hostcall telemetry events matching the filter.

exec_mediation: ExecMediationArtifact

Exec mediation decisions matching the filter.

secret_broker: SecretBrokerArtifact

Secret broker decisions matching the filter.

quota_breaches: Vec<QuotaBreachEvent>

Quota breach events matching the filter.

risk_replay: Option<RuntimeRiskReplayArtifact>

Forensic replay steps derived from the filtered ledger.

summary: IncidentBundleSummary

Summary statistics for quick triage.

Trait Implementations

impl Clone for IncidentEvidenceBundle

fn clone(&self) -> IncidentEvidenceBundle

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IncidentEvidenceBundle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for IncidentEvidenceBundle

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for IncidentEvidenceBundle

fn eq(&self, other: &IncidentEvidenceBundle) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for IncidentEvidenceBundle

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for IncidentEvidenceBundle