Struct RuleFieldSet 

pub struct RuleFieldSet { /* private fields */ }

Set of field names referenced by a loaded SigmaCollection, optionally after applying processing pipelines.

Built via RuleFieldSet::collect and queried via contains, iter, and len. Cheap to clone for sharing across threads behind an Arc.

Implementations

impl RuleFieldSet

pub fn collect( collection: &SigmaCollection, pipelines: &[Pipeline], include_filters: bool, ) -> Self

Walk a rule collection (and any pipelines) and return the resulting field set. When pipelines is non-empty, each rule is cloned and transformed before its fields are collected so the recorded names match what the engine evaluates against. Rules whose pipeline application fails fall back to the untransformed names so the set stays observable even when a pipeline misfires on one rule.

include_filters controls whether filter-rule detection blocks contribute to the set; mirrors the existing --no-filters flag on rsigma rule fields.

pub fn contains(&self, field: &str) -> bool

True if any rule references this field name.

pub fn origin(&self, field: &str) -> Option<&FieldOrigin>

Look up provenance for a single field name.

pub fn iter(&self) -> impl Iterator<Item = (&str, &FieldOrigin)>

Iterate field names and their provenance in sorted order.

pub fn names(&self) -> impl Iterator<Item = &str>

Iterate just the field names in sorted order.

pub fn len(&self) -> usize

Number of distinct fields in the set.

pub fn is_empty(&self) -> bool

True when no fields were collected.

Trait Implementations

impl Clone for RuleFieldSet

fn clone(&self) -> RuleFieldSet

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuleFieldSet

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RuleFieldSet

fn default() -> RuleFieldSet

Returns the “default value” for a type.

impl PartialEq for RuleFieldSet

fn eq(&self, other: &RuleFieldSet) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for RuleFieldSet

impl StructuralPartialEq for RuleFieldSet