Struct RuleCondition 

pub struct RuleCondition {
    pub source: Vec<String>,
    pub action_type: Option<String>,
    pub verdict: Option<String>,
    pub target_pattern: Option<String>,
    pub not_target_pattern: Option<String>,
    pub after: Option<String>,
    pub within: Option<Duration>,
    pub bind: String,
}

A single condition within a correlation rule.

Fields

source: Vec<String>

Event sources to match (e.g. ["receipt", "hubble"]).

action_type: Option<String>

Required action type (e.g. "file", "egress").

verdict: Option<String>

Required verdict (e.g. "allow", "deny").

target_pattern: Option<String>

Regex pattern that the target must match.

not_target_pattern: Option<String>

Regex pattern that the target must not match.

after: Option<String>

Bind name of a prior condition that must fire before this one.

within: Option<Duration>

Sub-window: maximum time after the after condition fires.

bind: String

Bind name for cross-referencing this condition in after and output.evidence.

Trait Implementations

impl Clone for RuleCondition

fn clone(&self) -> RuleCondition

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuleCondition

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for RuleCondition

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for RuleCondition

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.