Struct CorrelationEngine 

pub struct CorrelationEngine { /* private fields */ }

The correlation engine evaluates events against loaded rules using sliding windows.

Implementations

impl CorrelationEngine

pub fn new(rules: Vec<CorrelationRule>) -> Result<Self>

Create a new correlation engine, pre-compiling all regex patterns.

pub fn process_event(&mut self, event: &TimelineEvent) -> Vec<Alert>

Process a single event against all loaded rules. Evicts expired windows first, then evaluates conditions. Returns any alerts that were generated.

pub fn evict_expired_at(&mut self, now: DateTime<Utc>)

Remove window states that have exceeded their rule’s window duration, using the given reference time (typically the current event’s timestamp).

pub fn evict_expired(&mut self)

Remove window states that have exceeded their rule’s window duration using wall-clock time.

pub fn evict_expired_capped(&mut self, max_window: Duration)

Remove window states that have exceeded the shorter of the rule’s own window duration and the provided max_window cap, using wall-clock time.

pub fn rules(&self) -> &[CorrelationRule]

Return a reference to the loaded rules.

pub fn flush(&mut self) -> Vec<Alert>

Flush all windows and return alerts for any fully-matched sequences.

Trait Implementations

impl Debug for CorrelationEngine

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.