rsigma 0.6.0

CLI for parsing, validating, linting and evaluating Sigma detection rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

use std::io::Write;

use rsigma_eval::ProcessResult;

use super::StreamingError;

/// Serializes ProcessResult to NDJSON and writes to stdout.
pub struct StdoutSink {
    pretty: bool,
}

impl StdoutSink {
    pub fn new(pretty: bool) -> Self {
        StdoutSink { pretty }
    }

    /// Serialize and write a ProcessResult to stdout.
    pub fn send(&self, result: &ProcessResult) -> Result<(), StreamingError> {
        if result.detections.is_empty() && result.correlations.is_empty() {
            return Ok(());
        }

        let stdout = std::io::stdout();
        let mut out = stdout.lock();

        for m in &result.detections {
            let json = if self.pretty {
                serde_json::to_string_pretty(m)?
            } else {
                serde_json::to_string(m)?
            };
            writeln!(out, "{json}")?;
        }

        for m in &result.correlations {
            let json = if self.pretty {
                serde_json::to_string_pretty(m)?
            } else {
                serde_json::to_string(m)?
            };
            writeln!(out, "{json}")?;
        }

        Ok(())
    }
}