Expand description
Offline threat-intelligence records, catalogs, and rule predicates.
§Runtime scope
- Build: opt-in via
threat-intel. - Execution: no repository runtime caller (not on any default path).
- Default
termivar scan: no. - Support: experimental data models.
This module does not fetch a feed, correlate observations, emit an alert, execute an alert action, or persist data. Catalog queries inspect only caller-supplied records. Alert rules evaluate one explicit severity predicate and return a pure evaluation record.
Structs§
- Alert
Evaluation - Pure rule-evaluation result. No alert was delivered and no action was run.
- Alert
Rule - A single implemented predicate: enabled and severity at or above threshold.
- Alert
Rule Catalog - In-memory rule catalog. It stores rules, not emitted alerts.
- CVERecord
- CveCatalog
- In-memory catalog of caller-supplied CVE records.
- Invalid
Cvss Score - A CVE record carried a non-finite score or a score outside
0..=10. - Threat
Actor Catalog - In-memory catalog of caller-supplied actor profiles.
- Threat
Actor Profile - Threat
Feed Catalog - In-memory catalog of caller-supplied feed-entry records.
- Threat
Feed Entry
Enums§
- Alert
Action - Action requested by a matching rule. Evaluation does not execute it.
- Threat
Feed Source - Threat
Severity