hunt-correlate 0.2.4

Correlation rules, watch mode, and IOC matching for clawdstrike hunt
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

use thiserror::Error;

#[derive(Debug, Error)]
pub enum Error {
    #[error("YAML parse error: {0}")]
    Yaml(String),
    #[error("invalid rule: {0}")]
    InvalidRule(String),
    #[error("correlation engine error: {0}")]
    EngineError(String),
    #[error("watch error: {0}")]
    WatchError(String),
    #[error("NATS error: {0}")]
    Nats(String),
    #[error("IOC parse error: {0}")]
    IocParse(String),
    #[error("IOC match error: {0}")]
    IocMatch(String),
    #[error("report generation error: {0}")]
    ReportError(String),
    #[error("I/O error: {0}")]
    Io(#[from] std::io::Error),
    #[error("JSON error: {0}")]
    Json(#[from] serde_json::Error),
    #[error("regex error: {0}")]
    Regex(String),
}

pub type Result<T> = std::result::Result<T, Error>;