rsigma-convert 0.10.0

Sigma rule conversion engine — convert rules to backend-native query strings
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

use thiserror::Error;

#[derive(Debug, Error)]
#[non_exhaustive]
pub enum ConvertError {
    #[error("backend does not support modifier: {0}")]
    UnsupportedModifier(String),

    #[error("backend does not support keyword/unbound detection")]
    UnsupportedKeyword,

    #[error("backend does not support correlation type: {0}")]
    UnsupportedCorrelation(String),

    #[error("backend requires a processing pipeline")]
    PipelineRequired,

    #[error("field name is required but missing")]
    MissingFieldName,

    #[error("unsupported value type: {0}")]
    UnsupportedValue(String),

    #[error("CIDR parse error: {0}")]
    CidrParse(String),

    #[error("regex error: {0}")]
    Regex(String),

    #[error("rule conversion failed: {0}")]
    RuleConversion(String),

    #[error("invalid SQL identifier: {0}")]
    InvalidIdentifier(String),

    #[error("pipeline error: {0}")]
    Pipeline(#[from] rsigma_eval::error::EvalError),
}

pub type Result<T> = std::result::Result<T, ConvertError>;