sigma-rust 0.7.0

A library for parsing and evaluating Sigma rules to create custom detection pipelines
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

use crate::basevalue::BaseValue;
use crate::field::ParserError;
use crate::wildcard::WildcardToken;
use cidr::IpCidr;
use regex::Regex;

#[derive(Debug)]
pub enum FieldValue {
    Base(BaseValue),
    WildcardPattern(Vec<WildcardToken>),
    Regex(Regex),
    Cidr(IpCidr),
}

impl<T> From<T> for FieldValue
where
    T: Into<BaseValue>,
{
    fn from(value: T) -> Self {
        Self::Base(value.into())
    }
}

impl TryFrom<serde_norway::Value> for FieldValue {
    type Error = ParserError;

    fn try_from(value: serde_norway::Value) -> Result<Self, Self::Error> {
        Ok(Self::Base(BaseValue::try_from(value)?))
    }
}

impl FieldValue {
    pub(super) fn as_string(&self) -> Result<String, ParserError> {
        if let Self::Base(BaseValue::String(s)) = self {
            Ok(s.clone())
        } else {
            Err(ParserError::NotAString(format!("{:?}", self)))
        }
    }
}