Enum DetectionTrace 

pub enum DetectionTrace {
    AllOf {
        matched: bool,
        items: Vec<ItemTrace>,
    },
    AnyOf {
        matched: bool,
        branches: Vec<DetectionTrace>,
    },
    And {
        matched: bool,
        branches: Vec<DetectionTrace>,
    },
    Keywords {
        matched: bool,
        item: ItemTrace,
    },
    ArrayMatch {
        field: String,
        quantifier: String,
        matched: bool,
        member_count: usize,
        matched_count: usize,
        scalar: bool,
        empty_reason: Option<ArrayEmptyReason>,
        truncated: bool,
        omitted: usize,
        members: Vec<ArrayMemberTrace>,
    },
    Conditional {
        matched: bool,
        condition: Box<ConditionTrace>,
    },
    Other {
        kind: String,
        matched: bool,
    },
}

A node in the explained detection tree, mirroring CompiledDetection.

Variants

AllOf

Every item must match (a YAML mapping).

Fields

matched: bool

items: Vec<ItemTrace>

AnyOf

Any sub-detection may match (a YAML list of mappings).

Fields

matched: bool

branches: Vec<DetectionTrace>

And

All sub-detections must match (a mapping mixing plain and array blocks).

Fields

matched: bool

branches: Vec<DetectionTrace>

Keywords

Keyword detection: match a value across all event fields.

Fields

matched: bool

item: ItemTrace

ArrayMatch

Array object-scope match with per-member traces.

Fields

field: String

quantifier: String

Quantifier as written: any, all, all_or_empty, or none.

matched: bool

member_count: usize

matched_count: usize

Members whose body matched, counted over the full array (not just the recorded subset), so truncation cannot understate it.

scalar: bool

True when the field value was a non-array scalar treated as one member.

empty_reason: Option<ArrayEmptyReason>

truncated: bool

omitted: usize

members: Vec<ArrayMemberTrace>

Conditional

Extended array-body condition, or a top-level Conditional detection.

Fields

matched: bool

condition: Box<ConditionTrace>

Other

Last-resort opaque detection (unknown selection names).

Fields

kind: String

matched: bool

Implementations

impl DetectionTrace

pub fn matched(&self) -> bool

The verdict recorded for this node.

Trait Implementations

impl Clone for DetectionTrace

fn clone(&self) -> DetectionTrace

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DetectionTrace

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for DetectionTrace

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.