-
Notifications
You must be signed in to change notification settings - Fork 3
Add ThreatLevel enum and triage_score (Issue #77) #111
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #111 +/- ##
==========================================
+ Coverage 86.69% 86.76% +0.07%
==========================================
Files 11 11
Lines 2254 2274 +20
==========================================
+ Hits 1954 1973 +19
- Misses 300 301 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
src/types.rs
Outdated
| #[serde(with = "jiff::fmt::serde::timestamp::nanosecond::required")] | ||
| pub time: jiff::Timestamp, | ||
| pub kind: EventKind, | ||
| pub triage_score: Option<ThreatLevel>, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please delete this triage_score field as it is not needed.
|
|
||
| ### Added | ||
|
|
||
| - `ThreatLevel` enum to represent the threat level of detection events. The enum |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's only needed to add the ThreatLevel enum definition. There's no need to add the triage_score field to the EventMessage struct.
c4d5b63 to
9e63def
Compare
|
Hello Based on your clear guidance that the Following your suggestion to only include the To maintain code integrity and ensure all aspects of the change are covered, I've thoroughly updated all test files that referenced
Before finalizing, I ran All these changes have been committed and pushed to the branch. I'm confident this fully addresses your valuable feedback. Please take another look and let me know if you have any further suggestions! |
|
I reviewed the feedback and implemented the requested change. I added VeryLow as the first variant of the ThreatLevel enum to restore the intended balance of the scale. What I changed:
I ran the test suite and everything passes (60 tests passed). I also checked markdownlint for the changelog — no issues. All changes have been committed and pushed. Thanks for the pointer — this should address the balance concern. |
Closes #77
This pull request addresses issue #77 by centralizing the
ThreatLevelenum definition and integrating it into theEventMessagestructure. The goal is to enable Semi-supervised and Unsupervised engines to share a common, extended definition of threat levels, moving it from thereview-webrepository intoreview-protocol.Summary of Changes:
ThreatLevelenum: DefinedThreatLevelinsrc/types.rswithLow,Medium,High, andVeryHighvariants, aligning with the issue's requirements for extension and shared definition.triage_scoretoEventMessage: TheEventMessagestruct insrc/types.rsnow includes anOption<ThreatLevel>field namedtriage_scoreto capture the threat level of a detection event while maintaining backward compatibility.ThreatLevelvariants can be correctly serialized and deserialized using bincode.CHANGELOG.md: Documented the addition of theThreatLevelenum and thetriage_scorefield.src/client/api.rsandsrc/server.rsthat createEventMessageinstances to include the newtriage_scorefield.