Struct SigSet 

pub struct SigSet { /* private fields */ }

A set of compiled YARA signatures for malware detection.

SigSet wraps compiled YARA rules and can be cheaply cloned due to internal use of Arc. It provides a fluent builder API for constructing signature sets from individual rules, directories, or recursive directory trees.

Examples

use open_detect::{SigSet, Signature};
use std::path::Path;

// From a single signature
let sig_set = SigSet::from_signature(
    Signature("rule test { condition: true }".to_string())
).unwrap();

// From a directory
let sig_set = SigSet::new()
    .with_sig_dir(Path::new("signatures"))
    .unwrap();

// Chain multiple sources
let sig_set = SigSet::from_signature(
    Signature("rule manual { condition: true }".to_string())
)
.unwrap()
.with_sig_dir_recursive(Path::new("signatures"))
.unwrap();

Implementations

impl SigSet

pub fn new() -> Self

Create a new empty SigSet with no signatures.

This is useful as a starting point for the builder pattern.

Examples

use open_detect::SigSet;

let sig_set = SigSet::new();
assert_eq!(sig_set.count(), 0);

pub fn from_signature(signature: Signature) -> Result<Self>

Create a SigSet from a single YARA signature.

Errors

Returns an error if the signature fails to compile.

Examples

use open_detect::{SigSet, Signature};

let sig_set = SigSet::from_signature(
    Signature("rule test { condition: true }".to_string())
).unwrap();
assert_eq!(sig_set.count(), 1);

pub fn from_signatures(signatures: Vec<Signature>) -> Result<Self>

Create a SigSet from multiple YARA signatures.

Errors

Returns an error if any signature fails to compile.

Examples

use open_detect::{SigSet, Signature};

let sig_set = SigSet::from_signatures(vec![
    Signature("rule test1 { condition: true }".to_string()),
    Signature("rule test2 { condition: false }".to_string()),
]).unwrap();
assert_eq!(sig_set.count(), 2);

pub fn with_signature(self, signature: Signature) -> Result<Self>

Add a single signature to this SigSet, returning a new SigSet.

This recompiles all signatures including the new one.

Errors

Returns an error if signature compilation fails.

Examples

use open_detect::{SigSet, Signature};

let sig_set = SigSet::new()
    .with_signature(Signature("rule test { condition: true }".to_string()))
    .unwrap();
assert_eq!(sig_set.count(), 1);

pub fn with_signatures(self, new_signatures: Vec<Signature>) -> Result<Self>

Add multiple signatures to this SigSet, returning a new SigSet.

This recompiles all signatures including the new ones.

Errors

Returns an error if signature compilation fails.

Examples

use open_detect::{SigSet, Signature};

let sig_set = SigSet::new()
    .with_signatures(vec![
        Signature("rule test1 { condition: true }".to_string()),
        Signature("rule test2 { condition: false }".to_string()),
    ])
    .unwrap();
assert_eq!(sig_set.count(), 2);

pub fn with_sig_dir(self, path: &Path) -> Result<Self>

Add all YARA files from a directory (non-recursive).

Loads files with extensions: .yar, .yara, .yrc

Errors

Returns an error if:

• The directory cannot be read
• Any signature file cannot be read
• Signature compilation fails

Examples

use open_detect::SigSet;
use std::path::Path;

let sig_set = SigSet::new()
    .with_sig_dir(Path::new("signatures"))
    .unwrap();

pub fn with_sig_dir_recursive(self, path: &Path) -> Result<Self>

Add all YARA files from a directory recursively.

Recursively traverses subdirectories and loads all files with extensions: .yar, .yara, .yrc

Errors

Returns an error if:

• The directory cannot be read
• Any signature file cannot be read
• Signature compilation fails

Examples

use open_detect::SigSet;
use std::path::Path;

let sig_set = SigSet::new()
    .with_sig_dir_recursive(Path::new("signatures"))
    .unwrap();

pub fn count(&self) -> usize

Get the number of rules in this signature set.

Examples

use open_detect::{SigSet, Signature};

let sig_set = SigSet::from_signature(
    Signature("rule test { condition: true }".to_string())
).unwrap();
assert_eq!(sig_set.count(), 1);

Trait Implementations

impl Clone for SigSet

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for SigSet

fn default() -> Self

Returns the “default value” for a type.

impl From<SigSet> for Scanner

fn from(sig_set: SigSet) -> Self

Converts to this type from the input type.