Struct CommandEnricher 

pub struct CommandEnricher { /* private fields */ }

One command enricher instance.

Implementations

impl CommandEnricher

pub fn new( id: String, kind: EnricherKind, inject_field: String, argv: Vec<String>, env: HashMap<String, String>, timeout: Duration, on_error: OnError, scope: Scope, output: OutputFormat, ) -> Self

Trait Implementations

impl Enricher for CommandEnricher

fn kind(&self) -> EnricherKind

The kind of result this enricher applies to. Fixed at config load.

fn id(&self) -> &str

Stable identifier for this enricher instance. Used as a metric label and in structured log fields. Conventionally something like asset_lookup_det or enrich_hash_virustotal.

fn inject_field(&self) -> &str

Field name under RuleHeader::enrichments that this enricher writes to.

fn timeout(&self) -> Duration

Per-enricher timeout. The pipeline wraps each enrich() call in tokio::time::timeout using this value. Defaults to 5 seconds.

fn scope(&self) -> &Scope

Optional scope filter. Applied after the kind-vs-body filter and before enrich() runs. Default is Scope::default (always fires).

fn on_error(&self) -> OnError

Behavior when this enricher fails (timeout, fetch error, …). Defaults to OnError::Skip.

fn enrich<'life0, 'life1, 'async_trait>( &'life0 self, result: &'life1 mut EvaluationResult, ) -> Pin<Box<dyn Future<Output = Result<(), EnrichError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Run the enrichment.