Enum SiemDestination 

pub enum SiemDestination {
    Syslog {
        host: String,
        port: u16,
        transport: String,
        facility: SyslogFacility,
        tag: String,
    },
    Http {
        url: String,
        method: String,
        headers: HashMap<String, String>,
        timeout: u64,
        retry: RetryConfig,
    },
    Https {
        url: String,
        method: String,
        headers: HashMap<String, String>,
        timeout: u64,
        retry: RetryConfig,
    },
    File {
        path: String,
        format: String,
        rotation: Option<FileRotationConfig>,
    },
    Splunk {
        url: String,
        token: String,
        index: Option<String>,
        source_type: Option<String>,
    },
    Datadog {
        api_key: String,
        app_key: Option<String>,
        site: String,
        tags: Vec<String>,
    },
    Cloudwatch {
        region: String,
        log_group: String,
        stream: String,
        credentials: HashMap<String, String>,
    },
    Gcp {
        project_id: String,
        log_name: String,
        credentials_path: String,
    },
    Azure {
        workspace_id: String,
        shared_key: String,
        log_type: String,
    },
}

SIEM destination configuration

Variants

Syslog

Syslog destination

Fields

host: String

Syslog host

port: u16

Syslog port

transport: String

Transport protocol (udp or tcp)

facility: SyslogFacility

Syslog facility

tag: String

Tag/application name

Http

HTTP/HTTPS webhook destination

Fields

url: String

Webhook URL

method: String

HTTP method (default: POST)

headers: HashMap<String, String>

Custom headers

timeout: u64

Request timeout in seconds

retry: RetryConfig

Retry configuration

Https

HTTPS webhook destination (alias for http with https URL)

Fields

url: String

Webhook URL

method: String

HTTP method (default: POST)

headers: HashMap<String, String>

Custom headers

timeout: u64

Request timeout in seconds

retry: RetryConfig

Retry configuration

File

File-based export destination

Fields

path: String

File path

format: String

File format (jsonl or json)

rotation: Option<FileRotationConfig>

File rotation configuration

Splunk

Splunk HEC destination

Fields

url: String

Splunk HEC URL

token: String

Splunk HEC token

index: Option<String>

Splunk index

source_type: Option<String>

Source type

Datadog

Datadog API destination

Fields

api_key: String

Datadog API key

app_key: Option<String>

Datadog application key (optional)

site: String

Datadog site (default: datadoghq.com)

tags: Vec<String>

Additional tags

Cloudwatch

AWS CloudWatch Logs destination

Fields

region: String

AWS region

log_group: String

Log group name

stream: String

Log stream name

credentials: HashMap<String, String>

AWS credentials (access_key_id, secret_access_key)

Gcp

Google Cloud Logging destination

Fields

project_id: String

GCP project ID

log_name: String

Log name

credentials_path: String

Service account credentials path

Azure

Azure Monitor Logs destination

Fields

workspace_id: String

Azure workspace ID

shared_key: String

Azure shared key

log_type: String

Log type

Trait Implementations

impl Clone for SiemDestination

fn clone(&self) -> SiemDestination

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SiemDestination

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SiemDestination

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for SiemDestination

fn schema_name() -> String

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn is_referenceable() -> bool

Whether JSON Schemas generated for this type should be re-used where possible using the $ref keyword.

impl Serialize for SiemDestination

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.