pub fn get_item_target_map(rules: &[Vec<String>]) -> HashMap<String, String>
for DOMAIN, PROCESS-NAME etc. that matches directly