Struct RuleFilter 

pub struct RuleFilter {
    pub source: RuleSource,
    pub enabled: Option<bool>,
    pub rule_type: Option<String>,
    pub severity: Option<String>,
    pub tag: Option<String>,
    pub name: Option<String>,
    pub query: Option<String>,
    pub search: Option<String>,
    pub technique: Option<String>,
    pub tactic: Option<String>,
}

Fields

source: RuleSource

enabled: Option<bool>

rule_type: Option<String>

severity: Option<String>

tag: Option<String>

name: Option<String>

Exact display name, filtered server-side. This takes one request; walking 2,066 rules took 8.8 seconds.

query: Option<String>

A raw KQL fragment, combined with the structured filters above.

search: Option<String>

Friendly name-substring plus exact-tag search (spec 4.7). Distinct from name (exact) and query (raw KQL).

technique: Option<String>

MITRE ATT&CK technique (T1059) or subtechnique (T1059.001) id.

tactic: Option<String>

MITRE ATT&CK tactic id, such as TA0002.

Implementations

impl RuleFilter

pub fn to_kql(&self) -> Option<String>

Kibana filters saved objects with KQL over alert.attributes.*.

pub fn validate_threat(&self) -> Result<()>

Check technique (T and four ASCII digits, optionally . and three more) and tactic (TA and four ASCII digits). Every read calls this before the capability probe and before any request.

Trait Implementations

impl Clone for RuleFilter

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuleFilter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RuleFilter

fn default() -> Self

Returns the “default value” for a type.