Struct MirrorPayload 

pub struct MirrorPayload {

    pub request_id: String,
    pub timestamp: String,
    pub source_ip: String,
    pub ja4_fingerprint: Option<String>,
    pub ja4h_fingerprint: Option<String>,
    pub risk_score: f32,
    pub matched_rules: Vec<String>,
    pub campaign_id: Option<String>,
    pub method: String,
    pub uri: String,
    pub headers: HashMap<String, String>,
    pub body: Option<String>,
    pub site_name: String,
    pub sensor_id: String,
    pub protocol_version: String,
}

JSON payload sent to honeypot endpoints.

Contains all relevant request context for threat analysis:

• Client identification (IP, fingerprints)
• Risk assessment (score, matched rules, campaign correlation)
• Full request details (method, URI, headers, body)

Fields

request_id: String

Unique request identifier (UUID v4)

timestamp: String

Timestamp of original request (RFC 3339)

source_ip: String

Source IP address of the client

ja4_fingerprint: Option<String>

JA4 TLS fingerprint (if available)

ja4h_fingerprint: Option<String>

JA4H HTTP fingerprint (if available)

risk_score: f32

Risk score that triggered mirroring (0-100)

matched_rules: Vec<String>

IDs of rules that matched this request

campaign_id: Option<String>

Campaign ID if correlated to a known threat campaign

method: String

HTTP method (GET, POST, etc.)

uri: String

Request URI (path + query string)

headers: HashMap<String, String>

Request headers (filtered based on configuration)

body: Option<String>

Request body (if include_body enabled and within max size)

site_name: String

WAF site/vhost name that processed the request

sensor_id: String

Synapse sensor ID for multi-sensor deployments

protocol_version: String

Version of the mirror payload protocol

Implementations

impl MirrorPayload

pub fn new( request_id: String, source_ip: String, risk_score: f32, method: String, uri: String, site_name: String, sensor_id: String, ) -> Self

Creates a new MirrorPayload with required fields.

pub fn with_ja4(self, fingerprint: Option<String>) -> Self

Sets the JA4 TLS fingerprint.

pub fn with_ja4h(self, fingerprint: Option<String>) -> Self

Sets the JA4H HTTP fingerprint.

pub fn with_rules(self, rules: Vec<String>) -> Self

Sets the matched rules.

pub fn with_campaign(self, campaign_id: Option<String>) -> Self

Sets the campaign ID.

pub fn with_headers(self, headers: HashMap<String, String>) -> Self

Sets the request headers after sanitizing sensitive credentials.

Automatically strips Authorization, Cookie, and other credential headers to prevent leaking user credentials to honeypot systems.

pub fn with_headers_unsanitized(self, headers: HashMap<String, String>) -> Self

Sets the request headers without sanitization.

Safety

This method bypasses header sanitization. Only use this when headers have already been sanitized or when intentionally including all headers (e.g., for internal testing honeypots).

pub fn with_body(self, body: Option<String>) -> Self

Sets the request body.

pub fn to_json_bytes(&self) -> Result<Vec<u8>, Error>

Serializes the payload to JSON bytes.

pub fn to_json_string(&self) -> Result<String, Error>

Serializes the payload to a JSON string.

Trait Implementations

impl Clone for MirrorPayload

fn clone(&self) -> MirrorPayload

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MirrorPayload

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for MirrorPayload

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for MirrorPayload

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.