List of all items
Structs
- compiler::CompiledDetectionItem
- compiler::CompiledRule
- correlation::CompiledCondition
- correlation::CompiledCorrelation
- correlation::EventBuffer
- correlation::EventRef
- correlation::EventRefBuffer
- correlation::GroupKey
- correlation_engine::CorrelationConfig
- correlation_engine::CorrelationEngine
- correlation_engine::CorrelationInfo
- correlation_engine::CorrelationSnapshot
- correlation_engine::CorrelationStateSnapshot
- correlation_engine::GroupKeyPart
- correlation_engine::GroupStateInfo
- engine::Engine
- event::JsonEvent
- event::KvEvent
- event::MapEvent
- event::MappedEvent
- event::PlainEvent
- exemplar::ExemplarReport
- exemplar::ExemplarResult
- exemplar::MissingExemplars
- explain::ArrayMemberTrace
- explain::ItemTrace
- explain::RuleExplanation
- explain::SelectionBranch
- field_observer::FieldCoverage
- field_observer::FieldObservation
- field_observer::FieldObservationEntry
- field_observer::FieldObserver
- fields::FieldOrigin
- fields::RuleFieldSet
- logsource::LogSourceExtractor
- matcher::MatchDescriptor
- pipeline::Pipeline
- pipeline::TransformationItem
- pipeline::TransformedRule
- pipeline::conditions::NamedRuleCondition
- pipeline::sources::DynamicSource
- pipeline::sources::SourceRef
- pipeline::state::PipelineState
- result::CorrelationBody
- result::DetectionBody
- result::EvaluationResult
- result::FieldMatch
- result::RuleHeader
- router::RouteResult
- router::SchemaPruning
- router::SchemaRouter
- rule_draft::DraftConfig
- rule_draft::DraftFieldReport
- rule_draft::DraftReport
- rule_draft::correlation::CorrelationDraftConfig
- rule_draft::correlation::CorrelationDraftReport
- rule_draft::correlation::CorrelationSlotReport
- rule_draft::correlation::CorrelationVerification
- rule_draft::correlation::GroupedExemplar
- rule_draft::correlation::SourceLocation
- rule_draft::correlation::TimedEvent
- rule_metadata::RuleBundleMetadata
- rule_metadata::RuleIdentity
- rule_tune::TuneConfig
- rule_tune::TuneExpectationDiff
- rule_tune::TuneFieldReport
- rule_tune::TuneReport
- rule_tune::TuneSelectionReport
- rule_tune::TuneVerification
- schema::FieldNumberConfig
- schema::FieldPairConfig
- schema::FieldValueConfig
- schema::FieldValuesConfig
- schema::PredicateOutcome
- schema::RoutingConfig
- schema::RoutingPlan
- schema::SchemaBinding
- schema::SchemaClassifier
- schema::SchemaCountEntry
- schema::SchemaExplanation
- schema::SchemaLogsource
- schema::SchemaMatch
- schema::SchemaObservation
- schema::SchemaObserver
- schema::SchemaPredicateConfig
- schema::SchemaSignature
- schema::SchemaSignatureConfig
- schema::SchemaSignaturesFile
- schema::SignatureExplanation
- schema::UnknownShapeEntry
- schema_discovery::DiscoveryCandidate
- schema_discovery::DiscoveryConfig
- schema_discovery::DiscoveryReport
- schema_discovery::DiscoveryStats
- schema_discovery::FieldProfile
Enums
- compiler::CompiledDetection
- correlation::GroupByField
- correlation::WindowDecision
- correlation::WindowState
- correlation_engine::CorrelationAction
- correlation_engine::CorrelationEventMode
- correlation_engine::TimestampFallback
- error::EvalError
- event::EventValue
- exemplar::ExemplarRunError
- explain::ArrayEmptyReason
- explain::ConditionTrace
- explain::DetectionTrace
- explain::MatchReason
- fields::FieldSource
- matcher::CompiledMatcher
- matcher::ExpandPart
- matcher::GroupMode
- matcher::TimePart
- pipeline::conditions::DetectionItemCondition
- pipeline::conditions::FieldMatchType
- pipeline::conditions::FieldMatcher
- pipeline::conditions::FieldNameCondition
- pipeline::conditions::RuleCondition
- pipeline::finalizers::Finalizer
- pipeline::sources::DataFormat
- pipeline::sources::ErrorPolicy
- pipeline::sources::ExtractExpr
- pipeline::sources::RefLocation
- pipeline::sources::RefreshPolicy
- pipeline::sources::SourceStatus
- pipeline::sources::SourceType
- pipeline::transformations::Transformation
- result::MatchDetailLevel
- result::MatcherKind
- result::ResultBody
- router::RouteOutcome
- rule_draft::DraftError
- rule_draft::Stability
- rule_draft::correlation::CorrelationDraftError
- rule_draft::correlation::CorrelationDraftType
- rule_metadata::RuleKind
- rule_metadata::RuleMetadataLookup
- rule_tune::TuneError
- rule_tune::TuneFieldDisposition
- schema::CompareOp
- schema::OnUnknown
- schema::RouteDecision
- schema::SchemaError
- schema::SchemaPredicate
- schema_discovery::CandidateSource
Traits
Functions
- compiler::compile_detection
- compiler::compile_rule
- compiler::compile_to_compiled
- compiler::eval_condition
- compiler::evaluate_rule
- correlation::apply_window_open
- correlation::compile_correlation
- exemplar::run_exemplars
- explain::explain_rule
- matcher::ascii_lowercase_cow
- matcher::parse_expand_template
- matcher::sigma_string_to_regex
- pipeline::apply_pipelines
- pipeline::apply_pipelines_to_correlation
- pipeline::apply_pipelines_with_state
- pipeline::builtin::builtin_names
- pipeline::builtin::resolve_builtin
- pipeline::conditions::all_rule_conditions_match
- pipeline::conditions::eval_condition_expr
- pipeline::merge_pipelines
- pipeline::parse_pipeline
- pipeline::parse_pipeline_file
- pipeline::parse_sources
- pipeline::parse_sources_dir
- pipeline::parse_sources_file
- pipeline::parse_transformation_items
- pipeline::transform_collection
- pipeline::transform_rule
- pipeline::validate_source_refs
- rule_draft::correlation::draft_correlation
- rule_draft::draft_rule
- rule_tune::tune_rule
- schema::builtin_schema_logsource
- schema::builtin_schema_names
- schema::load_schema_config
- schema::load_schema_signatures
- schema::parse_schema_config
- schema::parse_schema_signatures
- schema::validate_schema_config
- schema_discovery::cluster_count
- schema_discovery::mine_events
- schema_discovery::mine_shapes