Struct StringEntry 

pub struct StringEntry {
    pub value: String,
    pub first_seen: DateTime<Utc>,
    pub last_seen: DateTime<Utc>,
    pub total_occurrences: u64,
    pub unique_file_identities: BTreeSet<FileIdentity>,
    pub occurrences: VecDeque<StringOccurrence>,
    pub categories: BTreeSet<String>,
    pub is_suspicious: bool,
    pub entropy: f64,
    pub suspicious_indicators: Vec<SuspiciousIndicator>,
    pub indicators_truncated: bool,
}

Aggregate information retained for one distinct string value.

Fields

value: String

Actual string value.

first_seen: DateTime<Utc>

Earliest caller-supplied event timestamp.

last_seen: DateTime<Utc>

Latest caller-supplied event timestamp.

total_occurrences: u64

Saturating total observation count, including evicted occurrence details.

unique_file_identities: BTreeSet<FileIdentity>

Bounded, ordered set of distinct source identities.

occurrences: VecDeque<StringOccurrence>

Bounded occurrence details in ingestion order, oldest retained first.

categories: BTreeSet<String>

Bounded, deterministically ordered aggregate category names.

is_suspicious: bool

Whether the analyzer reported a suspicious signal.

entropy: f64

Shannon entropy calculated over UTF-8 bytes.

suspicious_indicators: Vec<SuspiciousIndicator>

Bounded explainable evidence retained from initial analysis.

indicators_truncated: bool

Whether analyzer evidence was omitted or unavailable as retained detail.

Trait Implementations

impl Clone for StringEntry

fn clone(&self) -> StringEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for StringEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for StringEntry

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for StringEntry

fn eq(&self, other: &StringEntry) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for StringEntry

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for StringEntry