Struct Disposition 

pub struct Disposition {
    pub rule_id: Option<String>,
    pub verdict: Verdict,
    pub scope: DispositionScope,
    pub fingerprint: Option<String>,
    pub incident_id: Option<String>,
    pub timestamp: i64,
    pub analyst: Option<String>,
    pub note: Option<String>,
}

A validated, normalized disposition ready for the store.

rule_id is None only for an incident-scoped record that the daemon has not yet resolved to its contributing rules; the store rejects such a record until a rule_id is supplied.

Fields

rule_id: Option<String>

The rule identity the verdict accounts against (the rule’s id, with the title as the fallback the per-rule metrics already use).

verdict: Verdict

The analyst verdict.

scope: DispositionScope

Detection- or incident-scoped.

fingerprint: Option<String>

The alert-pipeline dedup fingerprint, when carried.

incident_id: Option<String>

The alert-pipeline incident id, required for incident scope.

timestamp: i64

Epoch seconds for rolling-window placement (defaults to ingest time).

analyst: Option<String>

Optional analyst identity, recorded for traceability.

note: Option<String>

Optional bounded free-text note, recorded for traceability.

Implementations

impl Disposition

pub fn from_raw(raw: RawDisposition, now: i64) -> Result<Self, DispositionError>

Validate and normalize a RawDisposition, using now (epoch seconds) as the default timestamp when none is supplied.

pub fn dedup_key(&self) -> String

The idempotency key for redelivery dedup: (fingerprint or incident_id, verdict, rule_id) when an alert identity is present, otherwise (rule_id, timestamp, analyst).

The rule_id is always part of the key. It is redundant for a fingerprint (which already identifies a single rule’s alert) but essential for an incident_id, which fans out to every contributing rule: without it, the per-rule records an incident expands into would collapse to one and only the first rule would be counted.

Trait Implementations

impl Clone for Disposition

fn clone(&self) -> Disposition

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Disposition

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Disposition

fn eq(&self, other: &Disposition) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Disposition