Module reverse 

Reverse conversion: SIEM query strings → Sigma YAML.

This is the mirror image of the forward Backend engine. Where a backend lowers a rule’s HIR into a query string, a Frontend parses a query string into the shared HIR (IrRule), which is then raised to a SigmaRule and emitted as Sigma YAML.

query -> Frontend::parse_query() -> IrRule -> raise_rule() -> SigmaRule -> emit_rule_yaml()

The framework owns everything that is dialect-independent: a QueryDialect-driven tokenizer, a precedence-climbing boolean parser (NOT > AND > OR), and the assembly of a boolean tree of leaves into named Sigma selections plus a condition. A target dialect (e.g. lucene) supplies a QueryDialect and a single Frontend::parse_atom that interprets one leaf predicate; everything else is shared, so a new target is a dialect table plus a leaf parser.

Reverse conversion is best-effort: a query carries no rule metadata, so the ReverseCtx supplies the title, id, logsource, level, and status, and constructs a query cannot express are rejected with a structured ConvertError rather than emitted as silently-wrong Sigma.

Re-exports

pub use lucene::LUCENE_DIALECT;

pub use lucene::LuceneFrontend;

Modules

lucene

Elastic Lucene reverse frontend.

Structs

QueryDialect

Boolean-syntax configuration for a query dialect. The reverse analogue of the boolean-operator half of TextQueryConfig: a pure data table that drives the shared tokenizer and boolean parser.

ReverseCtx

Metadata and options the query string cannot supply. Owns the selection-naming scheme through assemble_rule.

ReverseOutput

The result of converting a batch of queries: successes plus per-query errors (the batch never aborts on a single failure), mirroring convert_collection.

ReverseResult

One successful reverse conversion.

Enums

QueryExpr

A boolean expression tree over leaves of type L.

QueryLeaf

One resolved leaf predicate.

Traits

Frontend

A reverse-conversion target: parses one query dialect into the HIR.

Functions

assemble_rule

Turn a resolved boolean tree into an IrRule with named selections and a condition. Positive field leaves that share an AND are merged into one selection; same-field OR leaves collapse into a value list; negated branches become filter selections.

infer_str_matcher

Infer an idiomatic string matcher from a raw value: surrounding * wildcards select contains/startswith/endswith; anything else stays an exact match (with inner wildcards preserved inline).

parse_pattern

Build an IrPattern from a raw value, interpreting */? as wildcards and \ as an escape (matching Sigma value semantics).

reverse_collection

Convert a batch of queries, collecting per-query errors instead of aborting.