Struct SchemaRouter 

pub struct SchemaRouter { /* private fields */ }

A multi-engine router over a classifier, a RoutingPlan, one detection engine per pipeline-set, and one shared correlation store.

Implementations

impl SchemaRouter

pub fn build( collection: &SigmaCollection, classifier: SchemaClassifier, plan: RoutingPlan, pipeline_sets: Vec<Vec<Pipeline>>, corr_config: CorrelationConfig, include_event: bool, match_detail: MatchDetailLevel, logsource_extractor: Option<LogSourceExtractor>, partition_rules: bool, ) -> Result<Self>

Build a router. pipeline_sets must be index-aligned with plan.pipeline_sets() (one resolved pipeline list per set).

pub fn on_unknown(&self) -> OnUnknown

The unknown-handling policy this router enforces.

pub fn has_correlations(&self) -> bool

Whether this router has a correlation store.

pub fn detection_rule_count(&self) -> usize

Number of detection rules (same across every per-schema engine, unless per-schema rule partitioning is enabled; see engine_rule_counts).

pub fn engine_rule_counts(&self) -> Vec<usize>

Per-pipeline-set detection rule counts, in set order. Equal across sets unless per-schema rule partitioning is enabled, in which case platform-locked sets carry fewer rules than the default set.

pub fn logsource_pruned_total(&self) -> u64

Total rule candidates pruned by logsource across every per-schema engine (each event routes to exactly one engine).

pub fn logsource_absent_total(&self) -> u64

Total evaluate calls with no extractable event logsource (fail-open) across every per-schema engine.

pub fn schema_pruning_summary(&self) -> Vec<SchemaPruning>

Static per-schema pruning summary: for each schema with an implied logsource, how many rules its events evaluate versus prune. Empty when logsource routing is disabled (no extractor). Sorted by descending pruned count, then schema name.

pub fn correlation_rule_count(&self) -> usize

Number of correlation rules in the shared store (0 when none).

pub fn state_count(&self) -> usize

Number of live correlation window-state entries (0 when none).

pub fn rule_metadata(&self, key: &str) -> RuleMetadataLookup

Resolve a rule key (an id, or a title for a rule without one) to the documentation of every loaded rule that carries it.

A rule set is compiled once per pipeline-set, so the same rule usually yields one candidate per schema. Candidates whose post-pipeline metadata is identical collapse to a single answer; a rule whose pipelines rewrite its documentation differently per schema stays Ambiguous.

pub fn correlation_introspect( &self, id: Option<&str>, group: Option<&str>, ) -> Option<CorrelationStateSnapshot>

Introspect the shared correlation store, if any (id/group filtered).

pub fn export_state(&self) -> Option<CorrelationSnapshot>

Export the shared correlation state, if any, for hot-reload carry-over.

pub fn import_state(&mut self, snapshot: CorrelationSnapshot) -> bool

Import previously exported correlation state into the shared store. No-op (returns true) when there is no correlation store.

pub fn detect_batch<E: Event + Sync>(&self, events: &[&E]) -> Vec<ProcessResult>

Stateless classify + detection for a batch. Safe to call under a shared borrow when there is no correlation store; see Self::process_batch.

pub fn process_batch<E: Event + Sync>( &mut self, events: &[&E], ) -> Vec<ProcessResult>

Route a batch of events: parallel classify + detection, then sequential correlation into the shared store. Mirrors CorrelationEngine::process_batch: the stateless phase runs concurrently (under the parallel feature) and the stateful correlation phase runs in order. Drop/error outcomes yield empty results for that event.

When there is no correlation store this is equivalent to Self::detect_batch and only needs a shared borrow of the router.

pub fn route(&mut self, event: &impl Event) -> RouteResult

Classify and route one event.