Struct RuntimeEngine 

pub struct RuntimeEngine { /* private fields */ }

Wraps a CorrelationEngine (or a plain Engine) and provides the interface the runtime needs: process events, reload rules, and query state.

Implementations

impl RuntimeEngine

pub fn new( rules_path: PathBuf, pipelines: Vec<Pipeline>, corr_config: CorrelationConfig, include_event: bool, ) -> Self

pub fn load_rules(&mut self) -> Result<EngineStats, String>

Load (or reload) rules from the configured path.

On reload, correlation state is exported before replacing the engine and re-imported after, so in-flight windows and suppression state survive rule changes (entries for removed correlations are dropped).

pub fn process_batch<E: Event + Sync>( &mut self, events: &[&E], ) -> Vec<ProcessResult>

Process a batch of events using parallel detection + sequential correlation.

Delegates to Engine::evaluate_batch or CorrelationEngine::process_batch depending on whether correlation rules are loaded.

pub fn stats(&self) -> EngineStats

Return summary statistics about the current engine state.

pub fn rules_path(&self) -> &Path

Return the path from which rules are loaded.

pub fn pipelines(&self) -> &[Pipeline]

Return the configured processing pipelines.

pub fn corr_config(&self) -> &CorrelationConfig

Return the correlation configuration.

pub fn include_event(&self) -> bool

Whether detection results include the matched event.

pub fn export_state(&self) -> Option<CorrelationSnapshot>

Export correlation state as a serializable snapshot. Returns None if the engine is detection-only (no correlation state to persist).

pub fn import_state(&mut self, snapshot: &CorrelationSnapshot) -> bool

Import previously exported correlation state. Returns true if the import succeeded, false if the snapshot version is incompatible. No-op (returns true) if the engine is detection-only.