Struct Rule 

pub struct Rule {

    pub id: String,
    pub trigger: String,
    pub action: String,
    pub anchor_file: Option<String>,
    pub anchor_hash: Option<String>,
    pub created: String,
    pub last_hit: String,
    pub hits: u64,
    pub ttl_days: u32,
    pub superseded_by: Option<String>,
    pub status: RuleStatus,
    pub source_session: String,
    pub source_event: Option<String>,
    pub category: RuleCategory,
}

A learned rule with TTL decay.

Fields

id: String

trigger: String

action: String

anchor_file: Option<String>

anchor_hash: Option<String>

created: String

last_hit: String

hits: u64

ttl_days: u32

superseded_by: Option<String>

status: RuleStatus

source_session: String

source_event: Option<String>

category: RuleCategory

Implementations

impl Rule

pub fn is_enforceable(&self) -> bool

Check if this rule is enforceable (Active status).

pub fn is_alive(&self) -> bool

Check if this rule is alive (not Dead or Superseded).

pub fn record_hit(&mut self)

Record a trigger hit: increment counter and reset TTL.

pub fn days_since_last_hit(&self) -> Option<i64>

Compute days since last hit.

pub fn apply_time_decay(&mut self)

Apply time-based decay to this rule’s status.

Trait Implementations

impl Clone for Rule

fn clone(&self) -> Rule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Rule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Rule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Rule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.