pub struct Rule { /* private fields */ }Expand description
Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.
Implementations§
Source§impl Rule
impl Rule
Sourcepub fn get_id(&self) -> Option<&String>
pub fn get_id(&self) -> Option<&String>
A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.
Sourcepub fn set_id(&mut self, id_arg: String)
pub fn set_id(&mut self, id_arg: String)
A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.
§Example
101
Sourcepub fn get_uuid(&self) -> Option<&String>
pub fn get_uuid(&self) -> Option<&String>
A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.
Sourcepub fn set_uuid(&mut self, uuid_arg: String)
pub fn set_uuid(&mut self, uuid_arg: String)
A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.
§Example
1100110011
Sourcepub fn get_version(&self) -> Option<&String>
pub fn get_version(&self) -> Option<&String>
The version / revision of the rule being used for analysis.
Sourcepub fn set_version(&mut self, version_arg: String)
pub fn set_version(&mut self, version_arg: String)
Sourcepub fn get_name(&self) -> Option<&String>
pub fn get_name(&self) -> Option<&String>
The name of the rule or signature generating the event.
Sourcepub fn get_description(&self) -> Option<&String>
pub fn get_description(&self) -> Option<&String>
The description of the rule generating the event.
Sourcepub fn set_description(&mut self, description_arg: String)
pub fn set_description(&mut self, description_arg: String)
The description of the rule generating the event.
§Example
Block requests to public DNS over HTTPS / TLS protocols
Sourcepub fn get_category(&self) -> Option<&String>
pub fn get_category(&self) -> Option<&String>
A categorization value keyword used by the entity using the rule for detection of this event.
Sourcepub fn set_category(&mut self, category_arg: String)
pub fn set_category(&mut self, category_arg: String)
A categorization value keyword used by the entity using the rule for detection of this event.
§Example
Attempted Information Leak
Sourcepub fn get_ruleset(&self) -> Option<&String>
pub fn get_ruleset(&self) -> Option<&String>
Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.
Sourcepub fn set_ruleset(&mut self, ruleset_arg: String)
pub fn set_ruleset(&mut self, ruleset_arg: String)
Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.
§Example
Standard_Protocol_Filters
Sourcepub fn get_reference(&self) -> Option<&String>
pub fn get_reference(&self) -> Option<&String>
Reference URL to additional information about the rule used to generate this event.
The URL can point to the vendor’s documentation about the rule. If that’s not available, it can also be a link to a more general page describing this type of alert.
Sourcepub fn set_reference(&mut self, reference_arg: String)
pub fn set_reference(&mut self, reference_arg: String)
Reference URL to additional information about the rule used to generate this event.
The URL can point to the vendor’s documentation about the rule. If that’s not available, it can also be a link to a more general page describing this type of alert.
§Example
https://en.wikipedia.org/wiki/DNS_over_TLS
Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.
Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.
§Example
["Star-Lord"]
Sourcepub fn get_license(&self) -> Option<&String>
pub fn get_license(&self) -> Option<&String>
Name of the license under which the rule used to generate this event is made available.
Sourcepub fn set_license(&mut self, license_arg: String)
pub fn set_license(&mut self, license_arg: String)
Name of the license under which the rule used to generate this event is made available.
§Example
Apache 2.0