security_client_rs/
lib.rs

1//! An async client for Kibana security operations and Fleet management.
2//!
3//! The layout follows the official Elasticsearch Rust client: a [`Transport`]
4//! owns the connection, credentials and limits; [`Kibana`] groups the API into
5//! namespaces; every endpoint is a builder that is configured and then `send`s.
6//!
7//! ```no_run
8//! use security_client_rs::{Kibana, http::{Credentials, Transport, TransportBuilder, Url}};
9//! use security_client_rs::security::{QueryRule, Severity};
10//!
11//! # async fn run() -> security_client_rs::Result<()> {
12//! let transport = TransportBuilder::new(Url::parse("https://kibana.example:5601").unwrap())
13//!     .auth(Credentials::EncodedApiKey("base64-key".into()))
14//!     .build()?;
15//! let client = Kibana::new(transport).space("soc")?;
16//!
17//! let page = client.security().find_rules().per_page(100).send().await?.json().await?;
18//! println!("{} rules", page.total);
19//!
20//! let rule = QueryRule::new("Failed logins", "Repeated failures", "event.outcome: failure")
21//!     .severity(Severity::High);
22//! let created = client.security().create_rule(&rule).send().await?.json().await?;
23//! assert!(!created.enabled);
24//! # Ok(())
25//! # }
26//! ```
27//!
28//! Space-scoped routes use the client's selected space ([`Kibana::space`]);
29//! space administration, roles and status are always global. Requests are
30//! never retried and redirects are never followed. Non-success statuses become
31//! [`Error::Api`]. Routes without a named builder are available through
32//! [`Kibana::request`].
33//!
34//! Module documentation covers the workflows: [`security`] for rule selectors
35//! and imports, [`exceptions`] and [`cases`] for edits with concurrency tokens,
36//! [`fleet`] for integration formats and asynchronous actions, and [`pagination`]
37//! and [`poll`] for bounded traversal and waiting.
38//!
39//! # Errors and retries
40//!
41//! The client never retries, because whether a retry is safe depends on the
42//! request:
43//!
44//! - Reads can be retried on 429, 502, 503 and transport failures, honoring
45//!   [`Error::retry_after`], with backoff and an overall deadline.
46//! - A mutation interrupted by a timeout or dropped connection, including while
47//!   its response body is read, may or may not have been applied. Read the
48//!   resource back by a stable identifier, such as a rule's `rule_id`, before
49//!   trying again. A successful status on [`Error::Body`], [`Error::Decode`] or
50//!   [`Error::ResponseTooLarge`] shows that Kibana answered, not what it did.
51//! - On HTTP 409, read the resource again for its current version and reapply
52//!   the change.
53//!
54//! The `recovery` example in the repository implements these patterns.
55
56pub mod cases;
57mod client;
58mod error;
59pub mod exceptions;
60pub mod fleet;
61pub mod http;
62pub mod pagination;
63pub mod poll;
64mod request;
65pub mod roles;
66pub mod security;
67pub mod spaces;
68
69pub use client::{Kibana, Scope, SortOrder, Status};
70pub use error::{DecodeError, Error, ImportError, ImportFailure, Result, TransportError};
71pub use http::Transport;
72pub use request::Request;
security_client_rs/lib.rs

security_client_rs/
lib.rs
