class ara::idsm::EventReporter

The class EventReporter is defined in header ara/idsm/event_reporter.h and serves in the Adaptive Platform to report security events (Security Events) to the Intrusion Detection System Management (IdsM) [SWS_AIDSM_10101].

Usage and Instantiation

To use the class, an instance must be created via the parameterized constructor, which takes an identifier of type const ara::core::InstanceSpecifier& [SWS_AIDSM_10301]. This constructor initializes the reporter for the port of type SecurityEventReportInterface configured in the system model [SWS_AIDSM_10301]. Interpretation: Binding to the modeled port presumably requires that the passed InstanceSpecifier is consistently defined in the ARXML manifest and resolvable at runtime. Question Q-ed2f606f7446b4ba (open)

Error Handling and Concurrency

Regarding exception behavior, construction is specified with noexcept [SWS_AIDSM_10301]; the constructor thus throws no C++ exceptions. With respect to concurrency, the construction function is explicitly declared as thread-safe [SWS_AIDSM_10301]. Interpretation: Multiple threads should thus be able to instantiate reporter instances in parallel for their respective ports without requiring external synchronization mechanisms. Question Q-ddff9884a7b7cad8 (open)

Interaction

Interaction with the IdsM is based on mapping the instance to the respective modeling port: By being specified as EventReporter for the SecurityEventReportInterface [SWS_AIDSM_10301], the class represents the interface through which adaptive applications transmit security events to the IdsM architecture [SWS_AIDSM_10101].

use

The function ReportEvent from header ara/idsm/event_reporter.h serves to report a security event with context data [SWS_AIDSM_10304]. When called, the argument contextData of type ContextDataType is passed. In addition, the number of events can optionally be specified via count (type CountType), whose default value is set to 1 [SWS_AIDSM_10304]. The function provides no return value (void) and, as a noexcept declaration, throws no exceptions.

Concurrency and Limitations

The interface is explicitly defined as thread-safe [SWS_AIDSM_10304] and can be called concurrently from multiple threads without additional synchronization measures. Since the signature does not provide a parameter for a timestamp, recording the reporting timestamp presumably occurs internally upon event acceptance. Question Q-ab652343cc8009e9 (open)

Interaction with Related Interfaces

The specification defines several related overloads of ReportEvent for different scopes of information:

• Reporting an event without context data and timestamp [SWS_AIDSM_10302].
• Reporting with timestamp, but without context data [SWS_AIDSM_10303].
• Reporting with context data and explicit timestamp [SWS_AIDSM_10305].
• Reporting with versioned context data of type VersionedContextDataType, either without timestamp [SWS_AIDSM_10306] or with timestamp [SWS_AIDSM_10307].

use

The function [SWS_AIDSM_10305] transmits a security event with application-specific context data and an explicit timestamp. Event-related payload is passed via argument contextData of type ContextDataType, while timestamp (type const TimestampType) records the exact acquisition timestamp. The optional parameter count (type const CountType) has the default value 1 and allows reporting multiple accumulated occurrences. The function returns no value (void).

Concurrency and Error Handling

The declaration is located in header ara/idsm/event_reporter.h and is explicitly specified as thread-safe (thread-safe) [SWS_AIDSM_10305]. Calls can therefore be made from parallel threads without additional synchronization. Due to the designation with noexcept, no exceptions are propagated at API level; any errors during forwarding or buffering are therefore likely to be processed internally by the Intrusion Detection System Manager. Question Q-3b45e18c9a106a0f (open)

Interaction and Alternatives

The interface belongs to a group of overloaded reporting functions. If no context data or timestamps are required, lighter variants such as [SWS_AIDSM_10302] (counter only), [SWS_AIDSM_10303] (with timestamp), and [SWS_AIDSM_10304] (with context data only) are available. If structured or versioned data formats are required, the overloads with VersionedContextDataType according to [SWS_AIDSM_10306] and [SWS_AIDSM_10307] are to be used instead.

The function ReportEvent provides an interface in module aidsm for reporting a security event enriched with versioned context data [SWS_AIDSM_10306]. It is defined in header ara/idsm/event_reporter.h and has no return value (void).

When called, the following parameters are processed:

• contextData (type VersionedContextDataType): Passes the versioned context information of the occurred security event [SWS_AIDSM_10306].
• count (type const CountType, default value 1): Optionally determines the number of accumulated occurrences of this event [SWS_AIDSM_10306].

Regarding concurrency, the function is specified as thread-safe (thread-safe) [SWS_AIDSM_10306]. Declaration with noexcept guarantees that execution does not throw any C++ exceptions.

In interaction with the other reporting functions, this overload covers a specific use case:

• For reporting without context data, variants without timestamp [SWS_AIDSM_10302] or with timestamp [SWS_AIDSM_10303] are available.
• For unversioned context data (ContextDataType), overloads exist without timestamp [SWS_AIDSM_10304] and with timestamp [SWS_AIDSM_10305].
• If versioned context data is to be transmitted together with an explicit timestamp, [SWS_AIDSM_10307] must be used instead. Interpretation: Since [SWS_AIDSM_10306] has no timestamp parameter, the acquisition timestamp is presumably generated internally upon call execution. Question Q-23e60086ab409b24 (open)

Usage and Call Context

The function ReportEvent from header ara/idsm/event_reporter.h serves to report a security event with explicit versioned context data and a timestamp [SWS_AIDSM_10307]. It accepts the versioned data contextData of type VersionedContextDataType, a timestamp timestamp of type TimestampType, and optionally the event count count of type CountType, which is defaulted to the value 1 [SWS_AIDSM_10307].

Concurrency and Error Handling

The function is explicitly specified as thread-safe [SWS_AIDSM_10307] and can thus be safely called concurrently from multiple threads. Since the signature does not provide a return value (void) and is declared with noexcept [SWS_AIDSM_10307], errors are signaled neither via C++ exceptions nor via status codes; Interpretation: Error situations during event transmission are presumably handled or logged internally by module aidsm. Question Q-002c5fbc3202bcc2 (open)

Interaction of Overloads

The function represents the specialized variant for events where both a timestamp and versioned additional data occur [SWS_AIDSM_10307]. It complements the other overloads of ReportEvent within the reporter:

• Reporting without context data and timestamp [SWS_AIDSM_10302] or purely with timestamp [SWS_AIDSM_10303].
• Reporting with unversioned context data without timestamp [SWS_AIDSM_10304] as well as with timestamp [SWS_AIDSM_10305].
• Reporting with versioned context data without timestamp [SWS_AIDSM_10306].

use

The function ReportEvent is provided via header ara/idsm/event_reporter.h and serves to report security events without context data and timestamp [SWS_AIDSM_10302]. As a parameter, it accepts the event count count of type CountType, which is defaulted to the value 1 [SWS_AIDSM_10302]. The function has no return value (void) and guarantees via the noexcept designation that no exceptions are thrown [SWS_AIDSM_10302]. Regarding execution semantics, processing is presumably non-blocking internally, since neither a synchronous status nor an asynchronous future return type is specified. Question Q-6e240ebde61d8a83 (open)

Concurrency and Error Handling

According to the specification, the call is classified as thread-safe and can therefore be safely invoked from concurrent threads [SWS_AIDSM_10302]. Specific error codes do not exist, as the signature is fixed to void and noexcept [SWS_AIDSM_10302].

Interaction and Alternatives

The function represents the simplest overload for event reporting. If extended information is to be transmitted, related overloads are available:

• Reporting with timestamp via TimestampType [SWS_AIDSM_10303].
• Reporting with regular context data via ContextDataType [SWS_AIDSM_10304] as well as combined with a timestamp [SWS_AIDSM_10305].
• Reporting with versioned context data via VersionedContextDataType [SWS_AIDSM_10306] as well as combined with a timestamp [SWS_AIDSM_10307].

The function ReportEvent serves to report a security event specifying an explicit timestamp [SWS_AIDSM_10303]. It is declared in header ara/idsm/event_reporter.h [SWS_AIDSM_10303].

use

The call is made with the mandatory parameter timestamp of type TimestampType and the optional counter count of type CountType, which is initialized with the default value 1 [SWS_AIDSM_10303]. The function has no return value (void) [SWS_AIDSM_10303].

Error Handling and Concurrency

The function is declared as noexcept, which is why no C++ exceptions occur [SWS_AIDSM_10303]. Since the return type is void, no error codes are transmitted; occurring errors are therefore presumably discarded internally or logged asynchronously [SWS_AIDSM_10303]. Question Q-2d3cd862f6867ba9 (open) In terms of concurrency, the function is classified as thread-safe and can be safely called from concurrent threads [SWS_AIDSM_10303].

Interaction

The function is part of a family of overloaded ReportEvent interfaces in the aidsm module:

• The base function is available without timestamp and without context data [SWS_AIDSM_10302].
• With regular context data of type ContextDataType, overloads exist without timestamp [SWS_AIDSM_10304] and with timestamp [SWS_AIDSM_10305].
• With versioned context data of type VersionedContextDataType, corresponding signatures are available without timestamp [SWS_AIDSM_10306] and with timestamp [SWS_AIDSM_10307].