Struct HttpEnricher 

pub struct HttpEnricher { /* private fields */ }

One HTTP enricher instance.

Constructed by the daemon config loader. The Arc<reqwest::Client> is shared across all HTTP enrichers in the same daemon process so connection pooling works at the process level rather than per-config-block.

Implementations

impl HttpEnricher

pub fn new( id: String, kind: EnricherKind, inject_field: String, method: String, url: String, headers: Vec<(String, String)>, body: Option<String>, timeout: Duration, on_error: OnError, scope: Scope, extract: Option<ExtractExpr>, client: HttpEnricherClient, cache: HttpResponseCache, ) -> Self

Build a new enricher.

client is shared at the process level. cache may be a disabled cache (HttpResponseCache::new(Duration::from_secs(0))) when cache_ttl is unset; the lookup path treats that as “always miss”.

pub fn with_max_response_bytes(self, max_bytes: usize) -> Self

Override the maximum response-body size this enricher will read.

The default is DEFAULT_ENRICHER_MAX_RESPONSE_BYTES. Setting a smaller value can help when consuming many small enrichment payloads concurrently and tightening the per-call memory bound is worth the rejection risk on the occasional larger response.

pub fn with_metrics(self, metrics: Arc<dyn MetricsHook>) -> Self

Replace the metrics hook this enricher reports cache events into.

Pre-registers the three HTTP-cache counter label sets for this enricher’s id so rsigma_enrichment_http_cache_{hits,misses, expirations}_total{...} are emitted on /metrics from the first scrape, even before the enricher has run.

pub fn cache(&self) -> &HttpResponseCache

Read-only view of the response cache. Used by the metrics layer to expose cache hit/miss/expiration counters.

Trait Implementations

impl Enricher for HttpEnricher

fn kind(&self) -> EnricherKind

The kind of result this enricher applies to. Fixed at config load.

fn id(&self) -> &str

Stable identifier for this enricher instance. Used as a metric label and in structured log fields. Conventionally something like asset_lookup_det or enrich_hash_virustotal.

fn inject_field(&self) -> &str

Field name under RuleHeader::enrichments that this enricher writes to.

fn timeout(&self) -> Duration

Per-enricher timeout. The pipeline wraps each enrich() call in tokio::time::timeout using this value. Defaults to 5 seconds.

fn scope(&self) -> &Scope

Optional scope filter. Applied after the kind-vs-body filter and before enrich() runs. Default is Scope::default (always fires).

fn on_error(&self) -> OnError

Behavior when this enricher fails (timeout, fetch error, …). Defaults to OnError::Skip.

fn enrich<'life0, 'life1, 'async_trait>( &'life0 self, result: &'life1 mut EvaluationResult, ) -> Pin<Box<dyn Future<Output = Result<(), EnrichError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Run the enrichment.