Expand description
The source-agnostic domain model: atomic claims a source adapter emits, which the correlation core groups and grades.
Enum variants are intentionally minimal and #[non_exhaustive] — each new source
adds the variant it needs (additive, non-breaking). The full planned set is the
docs/feature-parity.md checklist.
Structs§
- Claim
- One atomic extracted fact about one device, from one source.
- Device
Key - Cross-source identity of a device — typically the device/instance serial number
that appears across
USBSTOR,MountedDevices,setupapi, and the event log. - Provenance
- Where a value came from: the source plus a locator (registry key path, log line, event record id). The reproducibility chain (raw bytes → decoding rule) extends this.
Enums§
- Artifact
Container - The physical storage container an artifact lives in — the tamper surface.
- Attribute
- Which device attribute a claim describes.
- Source
Kind - Which artifact a claim was extracted from.
- Value
- A comparable claim value, normalized by the source adapter.