Struct ForensicQueryExecution 

pub struct ForensicQueryExecution { /* private fields */ }

Forensic query execution kernel.

Executes forensic queries against historical event data for investigation and analysis purposes.

Implementations

impl ForensicQueryExecution

pub fn new() -> Self

Create a new forensic query execution kernel.

pub fn compute(query: &ForensicQuery, events: &[UserEvent]) -> ForensicResult

Execute a forensic query against events.

Arguments

• query - The forensic query to execute
• events - Events to search

pub fn compute_batch( queries: &[ForensicQuery], events: &[UserEvent], ) -> Vec<ForensicResult>

Execute multiple queries in batch.

pub fn pattern_search_query( id: u64, start_time: u64, end_time: u64, pattern: &str, ) -> ForensicQuery

Create a pattern search query.

pub fn timeline_query( id: u64, start_time: u64, end_time: u64, user_ids: Option<Vec<u64>>, ) -> ForensicQuery

Create a timeline query.

Trait Implementations

impl Clone for ForensicQueryExecution

fn clone(&self) -> ForensicQueryExecution

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ForensicQueryExecution

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ForensicQueryExecution

fn default() -> Self

Returns the “default value” for a type.

impl GpuKernel for ForensicQueryExecution

fn metadata(&self) -> &KernelMetadata

Returns the kernel metadata.

fn validate(&self) -> Result<(), KernelError>

Validate kernel configuration.

fn id(&self) -> &str

Returns the kernel ID.

fn requires_gpu_native(&self) -> bool

Returns true if this kernel requires GPU-native execution.

fn health_check(&self) -> HealthStatus

Perform a health check on this kernel.

fn shutdown(&self) -> Result<(), KernelError>

Graceful shutdown of the kernel.

fn refresh_config(&mut self, _config: &KernelConfig) -> Result<(), KernelError>

Refresh kernel configuration at runtime.