Struct RuleHeader 

pub struct RuleHeader {
    pub rule_title: String,
    pub rule_id: Option<String>,
    pub level: Option<Level>,
    pub tags: Vec<String>,
    pub custom_attributes: Arc<HashMap<String, Value>>,
    pub enrichments: Option<Map<String, Value>>,
}

Fields shared between detection and correlation results.

The optional enrichments map is None for results emitted directly by the engine; downstream middleware can populate it with arbitrary JSON values to ride along with each result.

Fields

rule_title: String

Title of the matched rule.

rule_id: Option<String>

ID of the matched rule (if present).

level: Option<Level>

Severity level.

tags: Vec<String>

Tags from the matched rule.

custom_attributes: Arc<HashMap<String, Value>>

Custom attributes from the rule (merged with pipeline overrides).

Wrapped in Arc so per-match cloning is a pointer bump.

enrichments: Option<Map<String, Value>>

Optional map of arbitrary enrichment values, written by downstream middleware. None for engine-emitted results; skipped on serialize.

Trait Implementations

impl Clone for RuleHeader

fn clone(&self) -> RuleHeader

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuleHeader

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for RuleHeader

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.