Enum StuffingEvent 

pub enum StuffingEvent {
    SuspiciousFailureRate {
        entity_id: String,
        endpoint: String,
        failures: u32,
        window_ms: u64,
        severity: StuffingSeverity,
    },
    DistributedAttackDetected {
        fingerprint: String,
        endpoint: String,
        ip_count: usize,
        total_failures: u64,
        severity: StuffingSeverity,
    },
    UsernameTargetedAttack {
        username: String,
        endpoint: String,
        ip_count: usize,
        total_failures: u64,
        severity: StuffingSeverity,
    },
    GlobalVelocitySpike {
        failure_rate: f64,
        failure_count: usize,
        threshold_rate: f64,
        severity: StuffingSeverity,
    },
    AccountTakeover {
        entity_id: String,
        endpoint: String,
        prior_failures: u32,
        severity: StuffingSeverity,
    },
    LowAndSlow {
        entity_id: String,
        endpoint: String,
        hours_active: usize,
        total_failures: u64,
        severity: StuffingSeverity,
    },
}

Credential stuffing event types for alerting.

Variants

SuspiciousFailureRate

Suspicious failure rate from single entity

Fields

entity_id: String

endpoint: String

failures: u32

window_ms: u64

severity: StuffingSeverity

DistributedAttackDetected

Distributed attack detected (multiple IPs, same fingerprint)

Fields

fingerprint: String

endpoint: String

ip_count: usize

total_failures: u64

severity: StuffingSeverity

UsernameTargetedAttack

Username-targeted attack detected (multiple IPs targeting same username)

SECURITY: This indicates a botnet specifically targeting a username, possibly a high-value account or known credential from a breach.

Fields

username: String

endpoint: String

ip_count: usize

total_failures: u64

severity: StuffingSeverity

GlobalVelocitySpike

Global velocity spike detected (abnormal auth failure rate)

SECURITY: A sudden spike in global auth failures may indicate a coordinated credential stuffing attack across many targets.

Fields

failure_rate: f64

failure_count: usize

threshold_rate: f64

severity: StuffingSeverity

AccountTakeover

Account takeover (success after many failures)

Fields

entity_id: String

endpoint: String

prior_failures: u32

severity: StuffingSeverity

LowAndSlow

Low-and-slow attack pattern detected

Fields

entity_id: String

endpoint: String

hours_active: usize

total_failures: u64

severity: StuffingSeverity

Implementations

impl StuffingEvent

pub fn severity(&self) -> StuffingSeverity

Get the severity of this event.

pub fn entity_id(&self) -> Option<&str>

Get the entity ID if applicable.

Trait Implementations

impl Clone for StuffingEvent

fn clone(&self) -> StuffingEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for StuffingEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for StuffingEvent

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for StuffingEvent

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.