Skip to main content

CompiledRule

rsigma_eval::compiler

Struct CompiledRule

pub struct CompiledRule {
    pub title: String,
    pub id: Option<String>,
    pub level: Option<Level>,
    pub tags: Vec<String>,
    pub logsource: LogSource,
    pub detections: HashMap<String, CompiledDetection>,
    pub conditions: Vec<ConditionExpr>,
    pub include_event: bool,
}

Expand description

A compiled Sigma rule, ready for evaluation.

Fields§

§title: String§id: Option<String>§level: Option<Level>§tags: Vec<String>§logsource: LogSource§detections: HashMap<String, CompiledDetection>

Compiled named detections, keyed by detection name.

§conditions: Vec<ConditionExpr>

Condition expression trees (usually one, but can be multiple).

§include_event: bool

Whether to include the full event JSON in the match result. Controlled by the rsigma.include_event custom attribute.

Trait Implementations§

impl Clone for CompiledRule

fn clone(&self) -> CompiledRule

Returns a duplicate of the value. Read more

1.0.0 · Source§

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more

impl Debug for CompiledRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more

Auto Trait Implementations§

impl Freeze for CompiledRule

impl RefUnwindSafe for CompiledRule

impl Send for CompiledRule

impl Sync for CompiledRule

impl Unpin for CompiledRule

impl UnsafeUnpin for CompiledRule

impl UnwindSafe for CompiledRule

Blanket Implementations§

impl<T> Any for T
where T: 'static + ?Sized,

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more

impl<T> Borrow<T> for T
where T: ?Sized,

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more

impl<T> BorrowMut<T> for T
where T: ?Sized,

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more

impl<T> CloneToUninit for T
where T: Clone,

unsafe fn clone_to_uninit(&self, dest: *mut u8)

🔬This is a nightly-only experimental API. (clone_to_uninit)

Performs copy-assignment from self to dest. Read more

impl<T> From<T> for T

fn from(t: T) -> T

Returns the argument unchanged.

impl<T, U> Into<U> for T
where U: From<T>,

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

impl<T> ToOwned for T
where T: Clone,

type Owned = T

The resulting type after obtaining ownership.

fn to_owned(&self) -> T

Creates owned data from borrowed data, usually by cloning. Read more

fn clone_into(&self, target: &mut T)

Uses borrowed data to replace owned data, usually by cloning. Read more

impl<T, U> TryFrom<U> for T
where U: Into<T>,

type Error = Infallible

The type returned in the event of a conversion error.

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.