Struct DraftReport 

pub struct DraftReport {
    pub rule_yaml: String,
    pub fields: Vec<DraftFieldReport>,
    pub exemplar_total: usize,
    pub exemplar_matched: usize,
    pub baseline_total: usize,
    pub baseline_hits: Option<usize>,
    pub baseline_hit_rate: Option<f64>,
    pub warnings: Vec<String>,
}

The result of a draft run: the rule plus the evidence behind it.

Fields

rule_yaml: String

The complete draft rule, standard Sigma YAML, parse- and lint-checked.

fields: Vec<DraftFieldReport>

Profiled candidate fields, ranked (selected fields first).

exemplar_total: usize

Number of exemplar events.

exemplar_matched: usize

Exemplars the final draft matches (always equals exemplar_total; a draft that cannot match every exemplar is an error, not a result).

baseline_total: usize

Number of baseline events provided.

baseline_hits: Option<usize>

Baseline events the draft matches (its estimated false-positive count), when the baseline evaluation ran.

baseline_hit_rate: Option<f64>

baseline_hits / baseline_total (0.0-1.0), when computed.

warnings: Vec<String>

Advisory notes: lint findings, relaxation drops, inference caveats.

Trait Implementations

impl Clone for DraftReport

fn clone(&self) -> DraftReport

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DraftReport

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.