Struct CompiledRule 

pub struct CompiledRule {
    pub title: String,
    pub id: Option<String>,
    pub level: Option<Level>,
    pub tags: Vec<String>,
    pub description: Option<String>,
    pub falsepositives: Vec<String>,
    pub logsource: LogSource,
    pub detections: HashMap<String, CompiledDetection>,
    pub conditions: Vec<ConditionExpr>,
    pub include_event: bool,
    pub custom_attributes: Arc<HashMap<String, Value>>,
}

A compiled Sigma rule, ready for evaluation.

Fields

title: String

id: Option<String>

level: Option<Level>

tags: Vec<String>

description: Option<String>

The rule’s description. Retained because it carries the ADS goal section, which downstream consumers surface alongside a match.

falsepositives: Vec<String>

The rule’s falsepositives, retained as the ADS false-positives section carrier.

logsource: LogSource

detections: HashMap<String, CompiledDetection>

Compiled named detections, keyed by detection name.

conditions: Vec<ConditionExpr>

Condition expression trees (usually one, but can be multiple).

include_event: bool

Whether to include the full event JSON in the match result. Controlled by the rsigma.include_event custom attribute.

custom_attributes: Arc<HashMap<String, Value>>

Custom attributes from the original Sigma rule (merged view of arbitrary top-level keys, the explicit custom_attributes: block, and pipeline SetCustomAttribute additions). Propagated to match results. Wrapped in Arc so per-match cloning is a pointer bump.

Implementations

impl CompiledRule

pub fn identity(&self) -> RuleIdentity

This rule’s identity as a detection rule.

pub fn bundle_metadata(&self) -> RuleBundleMetadata

The documentation fields a downstream consumer needs to explain a match.

Trait Implementations

impl Clone for CompiledRule

fn clone(&self) -> CompiledRule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CompiledRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.