Crate gene

Source

Re-exports§

pub use rules::Rule;
pub use values::FieldValue;

Modules§

rules
values

Structs§

Compiler
Rule compiler
Engine
Structure to represent an Event scanning engine. Its role being to scan any structure implementing Event trait with all the Rules loaded into the engine
ScanResult
Structure representing the result of an Event scanned by the Engine. It aggregates information about the rules matching a given event as well as some meta data about it (tags, attack ids …). A severity score (sum of all matching rules severity bounded to MAX_SEVERITY) is also part of a ScanResult. Some Rules matching an Event might be filter rules. In this case only the filtered flag is updated.
Templates
Structure holding string templates to replace in rules. Templating mechanism allow to define once complex regex and use them at multiple places in rules, making rule maintenance easier.
XPath
Cross Path allowing to recursively retrieve a FieldValue from a structure implementing FieldGetter.

Enums§

Error

Traits§

Event
Trait representing a log event
FieldGetter
Trait representing a structure we can fetch field values from a XPath