elasticctl-api 0.9.0

Typed detection-rule model and endpoint wrappers for Elastic Security.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

//! Rule state re-checks.

use super::*;
use crate::observe::{Observed, Preconditions};

/// Read each rule by ID, returning absent state for missing rules.
pub async fn observe_rules(t: &Transport, rule_ids: &[String]) -> Result<Preconditions> {
    let mut entries = Vec::with_capacity(rule_ids.len());
    for id in rule_ids {
        let state = match rules::get(t, id).await {
            Ok(rule) => Some(normalize::canonical(&rule).into_value()),
            Err(err) if err.kind == ErrorKind::NotFound => None,
            Err(err) => return Err(err),
        };
        entries.push(Observed {
            object: "rule",
            id: id.clone(),
            state,
        });
    }
    Ok(Preconditions(entries))
}