Struct CorrelationConfig 

pub struct CorrelationConfig {
    pub timestamp_fields: Vec<String>,
    pub timestamp_fallback: TimestampFallback,
    pub max_state_entries: usize,
    pub max_group_entries: Option<usize>,
    pub suppress: Option<u64>,
    pub action_on_match: CorrelationAction,
    pub emit_detections: bool,
    pub correlation_event_mode: CorrelationEventMode,
    pub max_correlation_events: usize,
}

Configuration for the correlation engine.

Provides engine-level defaults that mirror pySigma backend optional arguments. Per-correlation overrides can be set via SetCustomAttribute pipeline transformations using the rsigma.* attribute namespace.

Fields

timestamp_fields: Vec<String>

Field names to try for timestamp extraction, in order of priority.

The engine will try each field until one yields a parseable timestamp. If none succeed, the timestamp_fallback policy applies.

timestamp_fallback: TimestampFallback

What to do when no timestamp can be extracted from an event.

Default: WallClock (use Utc::now()).

max_state_entries: usize

Maximum number of state entries (across all correlations and groups) before aggressive eviction is triggered. Prevents unbounded memory growth.

Default: 100_000.

max_group_entries: Option<usize>

Maximum number of retained entries within a single group’s window state (timestamps for event_count, (timestamp, value) pairs for value_count and the numeric aggregations, per-rule hits for temporal types). Bounds the within-window growth that max_state_entries does not: a group’s deque otherwise grows with timespan x event rate.

When the cap is exceeded the oldest entries are dropped, which can only under-count (aggregates saturate; correlations that would have fired on evicted entries may not). Session windows always keep their oldest entry as the span anchor so truncation cannot silently extend the timespan cap.

None (default) means unbounded, preserving existing behavior. Can be overridden per-correlation via rsigma.max_group_entries.

suppress: Option<u64>

Default suppression window in seconds.

After a correlation fires for a (correlation, group_key), suppress re-alerts for this duration. None means no suppression (every condition-satisfying event produces an alert).

Can be overridden per-correlation via the rsigma.suppress custom attribute.

action_on_match: CorrelationAction

Default action to take after a correlation fires.

Can be overridden per-correlation via the rsigma.action custom attribute.

emit_detections: bool

Whether to emit detection-level matches for rules that are only referenced by correlations (where generate: false).

Default: true (emit all detection matches). Set to false to suppress detection output for correlation-only rules.

correlation_event_mode: CorrelationEventMode

How to include contributing events in correlation results.

• None (default): no event storage, zero overhead.
• Full: events are deflate-compressed and decompressed on output.
• Refs: only timestamps + event IDs are stored (minimal memory).

Can be overridden per-correlation via rsigma.correlation_event_mode.

max_correlation_events: usize

Maximum number of events to store per (correlation, group_key) window when correlation_event_mode is not None.

Bounds memory at: max_correlation_events × cost_per_event × active_groups. Default: 10.

Trait Implementations

impl Clone for CorrelationConfig

fn clone(&self) -> CorrelationConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorrelationConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CorrelationConfig

fn default() -> Self

Returns the “default value” for a type.