Diese Seite wurde vollständig KI-generiert auf Basis von SWS IntrusionDetectionSystemManager (R25-11) — kein offizieller AUTOSAR-Text und keine automatisch extrahierte API-Seite wie die übrigen Module. Als Interpretation gekennzeichnete Aussagen sind Schlussfolgerungen aus den Quellen.
User GuideAI-GENERATED
Provides interfaces and types to report security-relevant events to the IdsM in a standardized manner.
AI-GENERATEDunreviewedModel: gemini-3.8-flash-medium · Effort: medium · Temperature: not controllable · Prompt: 79f9927c6ea2ProvenanceOpen questions (2)
translated from the German guidegemini-3.8-flash-low · 2026-10-13 · German original
Provides interfaces and types to report security-relevant events to the IdsM in a standardized manner.
The namespace ara::idsm provides standardized interfaces and types with which adaptive applications report security events to the Intrusion Detection System Management in a structured manner ([SWS_AIDSM_10205]). Via the EventReporter and associated providers for timestamps, context data, and transmission modes, incidents can be recorded in detail or in filtered form ([SWS_AIDSM_10207]). For unknown event identifiers, the IdsmErrorDomain provides targeted error codes for further handling.
Context
The namespace ara::idsm provides the application programming interface of the AUTOSAR Adaptive Platform for Intrusion Detection System Management (IdsM). Its central task is to capture security-relevant events (security events) from application processes and platform instances in a standardized manner and forward them to the higher-level IdsM.
The primary interaction interface for reporting applications is formed by the class EventReporter. This capturing is accompanied by specialized functional interfaces: The ReportingModeProvider manages the current transmission mode ([SWS_AIDSM_10207]), the ContextDataProvider provides dynamic accompanying data ([SWS_AIDSM_10201], [SWS_AIDSM_10206]), and the TimestampProvider contributes timing information ([SWS_AIDSM_10202]). On the receiver side, the QualifiedEventsReceiver processes already qualified events. The interplay of these roles connects adaptive applications to security-oriented monitoring.
A typical sequence for signaling a security event is divided into querying the reporting state, assembling relevant context information, and transmitting it to the EventReporter.
Before reporting an event, the application queries the active reporting mode via the ReportingModeProvider ([SWS_AIDSM_10207]). The enumeration ReportingModeType distinguishes, among others, between disabled transmission (kOff), compact messages (kBrief), detailed reports (kDetailed), and modes that bypass local filter rules (kBriefBypassingFilters, kDetailedBypassingFilters). If reporting is not disabled, the application prepares the payload. An identifier of type EventIdType serves as the event ID ([SWS_AIDSM_10205]). For further analysis, the ContextDataProvider provides mutable context data as a byte span ContextDataType ([SWS_AIDSM_10201]) or as a versioned pair VersionedContextDataType including a version counter ([SWS_AIDSM_10206]). In addition, a counter of type CountType ([SWS_AIDSM_10203]) for prequalified events and a timestamp of type TimestampType ([SWS_AIDSM_10202]) via the TimestampProvider can be included. Finally, the application passes the data to the EventReporter.
Erroneous operations within namespace ara::idsm are signaled via the error domain IdsmErrorDomain and error code type IdsmErrc ([SWS_AIDSM_10204]). For standard-compliant error handling, functions GetIdsmErrorDomain ([SWS_AIDSM_10702]) and MakeErrorCode ([SWS_AIDSM_10703]) exist, which allow thread-safe construction of ara::core::ErrorCode instances.
A central error scenario occurs when an unknown event ID is used. In this case, the system reports the error IdsmErrc::kUnknownEventId ([SWS_AIDSM_10204]). This occurs when a caller passes an identifier of type EventIdType that is not known to the IdsM or not configured in the manifest. In synchronous interfaces with exception handling, this state is represented by class IdsmException. A prerequisite for every successful report is therefore that the passed EventIdType values match the IdsM configuration.
This guide is based exclusively on the specifications of AUTOSAR Release R25-11.
enum class IdsmErrc : ara::core::ErrorDomain::CodeType { kUnknownEventId = 3 };
Header
ara/idsm/idsm_error_domain.h
Upstream-Anforderung
RS_AP_00130, RS_AP_00122, RS_AP_00127
Fehlercodes der IdsmErrorDomain.
AI-GENERATEDunreviewedModel: gemini-3.8-flash-medium · Effort: medium · Temperature: not controllable · Prompt: 58b3761a5fdbProvenanceOpen questions (1)
translated from the German guidegemini-3.8-flash-low · 2026-10-13 · German original
Usage and purpose
The enumeration IdsmErrc represents the error codes of the IdsM error domain (header ara/idsm/idsm_error_domain.h) and is based on the base type ara::core::ErrorDomain::CodeType[SWS_AIDSM_10204]. For compact handling in client applications, AUTOSAR provides the type-identical alias Errc[SWS_AIDSM_10707]. The function MakeErrorCode serves for integration into the standardized error handling model of AUTOSAR Adaptive: It converts an error code together with vendor-specific supplementary data (SupportDataType) into an ara::core::ErrorCode object with noexcept [SWS_AIDSM_10703].
Error Codes and Interaction
The specification defines the concrete error value:
kUnknownEventId = 3: Signals that a passed eventId is not known to the Intrusion Detection System Manager as a configured security event [SWS_AIDSM_10204].
This code is conveyed in synchronous interfaces as an error state within the return type ara::core::Result. Both querying the reporting mode via GetReportingMode[SWS_AIDSM_10602] and updating it via SetReportingMode[SWS_AIDSM_10603] fail with IdsmErrc::kUnknownEventId if an unconfigured event is addressed. Interpretation: Due to the explicit assignment of value 3, values 1 and 2 are presumably reserved for internally or future-used error states of the domain. Question Q-374e315b0ea6d0c7 (open)
Concurrency and Limitations
The helper function MakeErrorCode for creating error objects is thread-safe and designated as constexpr[SWS_AIDSM_10703]. In contrast, the operational functions of reporting_mode_provider.h that return these error states (GetReportingMode[SWS_AIDSM_10602] and SetReportingMode[SWS_AIDSM_10603]) are explicitly declared as not thread-safe. Concurrent calls must therefore be synchronized by the caller.
This text was generated by an AI based on the specification documents.
Implementer's Guide to follow (complexity I1)
Request a governed re-review of this record. The record is not changed immediately.
gemini-3.8-flash-low· 2026-10-13 · German original