Struct RuleBundleMetadata 

pub struct RuleBundleMetadata {
    pub identity: RuleIdentity,
    pub level: Option<Level>,
    pub tags: Vec<String>,
    pub description: Option<String>,
    pub falsepositives: Vec<String>,
    pub custom_attributes: Arc<HashMap<String, Value>>,
}

Everything needed to document one rule away from the engine that compiled it: its identity, its severity and tags, and the three standard fields plus rsigma.ads.* attributes an ADS document is assembled from.

Fields

identity: RuleIdentity

The rule’s kind, id, and title.

level: Option<Level>

The rule’s level.

tags: Vec<String>

The rule’s tags (the ADS categorization carrier).

description: Option<String>

The rule’s description (the ADS goal carrier).

falsepositives: Vec<String>

The rule’s falsepositives (the ADS false-positives carrier).

custom_attributes: Arc<HashMap<String, Value>>

The rule’s custom attributes, post-pipeline. Carries the six rsigma.ads.* sections that have no standard Sigma field.

Trait Implementations

impl AdsCarriers for RuleBundleMetadata

fn ads_description(&self) -> Option<&str>

The description field (the goal carrier).

fn ads_tags(&self) -> &[String]

The tags field (the categorization carrier, filtered to attack.*).

fn ads_falsepositives(&self) -> &[String]

The falsepositives field (the false-positives carrier).

fn ads_custom_attribute(&self, key: &str) -> Option<AdsContent>

One rsigma.ads.* custom attribute, already rendered to content.

fn ads_match_exemplar_count(&self) -> usize

Count of structurally valid expect: match exemplars. Defaults to zero so JSON-backed carriers that do not surface exemplars stay compiling.

impl Clone for RuleBundleMetadata

fn clone(&self) -> RuleBundleMetadata

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuleBundleMetadata

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for RuleBundleMetadata

fn eq(&self, other: &RuleBundleMetadata) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for RuleBundleMetadata

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for RuleBundleMetadata