Enum CorrelationAction 

pub enum CorrelationAction {
    Alert,
    Reset,
}

What to do with window state after a correlation fires.

This is an engine-level default that can be overridden per-correlation via the rsigma.action custom attribute set in processing pipelines.

Variants

Alert

Keep window state as-is after firing (current / default behavior). Subsequent events that still satisfy the condition will re-fire.

Reset

Clear the window state for the firing group key after emitting the alert. The threshold must be met again from scratch before the next alert.

Trait Implementations

impl Clone for CorrelationAction

fn clone(&self) -> CorrelationAction

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorrelationAction

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CorrelationAction

fn default() -> CorrelationAction

Returns the “default value” for a type.

impl FromStr for CorrelationAction

type Err = String

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl PartialEq for CorrelationAction

fn eq(&self, other: &CorrelationAction) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for CorrelationAction

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for CorrelationAction

impl Eq for CorrelationAction

impl StructuralPartialEq for CorrelationAction