Struct RuleIdentity 

pub struct RuleIdentity {
    pub kind: RuleKind,
    pub id: Option<String>,
    pub title: String,
}

A rule’s identity: its kind plus the id and title it is known by.

Kept structured rather than flattened to a single string so a detection rule and a correlation rule that happen to share a key stay distinguishable.

Fields

kind: RuleKind

Whether this is a detection or a correlation rule.

id: Option<String>

The rule’s id, when it declares one.

title: String

The rule’s title.

Implementations

impl RuleIdentity

pub fn key(&self) -> &str

The key downstream aggregation groups this rule under: the id, falling back to the title. Mirrors how a result header is reduced to a rule key.

Trait Implementations

impl Clone for RuleIdentity

fn clone(&self) -> RuleIdentity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuleIdentity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for RuleIdentity

impl PartialEq for RuleIdentity

fn eq(&self, other: &RuleIdentity) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for RuleIdentity

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for RuleIdentity