Struct RiskIncidentResult 

pub struct RiskIncidentResult {

    pub risk_incident_id: String,
    pub entity_type: String,
    pub entity_value: String,
    pub trigger: &'static str,
    pub score: i64,
    pub score_threshold: Option<i64>,
    pub tactic_count: u64,
    pub tactic_count_threshold: Option<u64>,
    pub tactics: Vec<String>,
    pub sources: Vec<String>,
    pub source_count: u64,
    pub window_start: i64,
    pub window_end: i64,
    pub result_count: u64,
    pub refs: Option<Vec<RiskRef>>,
    pub results: Option<Vec<Value>>,
}

The wire shape emitted when an entity crosses a risk threshold. One flat NDJSON object, disambiguated downstream by the presence of risk_incident_id.

Fields

risk_incident_id: String

Surrogate UUIDv4 identity for this incident.

entity_type: String

The risk-object type, e.g. user.

entity_value: String

The entity value, e.g. alice.

trigger: &'static str

What crossed the threshold: score or tactic_count.

score: i64

The accumulated risk score over the window.

score_threshold: Option<i64>

The configured score threshold, when set.

tactic_count: u64

The distinct ATT&CK tactic count over the window.

tactic_count_threshold: Option<u64>

The configured tactic-count threshold, when set.

tactics: Vec<String>

The distinct ATT&CK tactics contributing over the window.

sources: Vec<String>

The distinct contributing sources (rule identities) over the window, bounded by max_sources_per_entity.

source_count: u64

The distinct contributing-source count over the window.

window_start: i64

First and last contributing-detection timestamps (unix seconds).

window_end: i64

result_count: u64

Number of contributing detections retained over the window.

refs: Option<Vec<RiskRef>>

Contributing references (include: refs), bounded by max_results_per_incident.

results: Option<Vec<Value>>

Contributing results (include: results), event payloads stripped and stored as serialized JSON values, bounded by max_results_per_incident.

Trait Implementations

impl Clone for RiskIncidentResult

fn clone(&self) -> RiskIncidentResult

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RiskIncidentResult

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for RiskIncidentResult

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.