Skip to main content

eval_condition

Function eval_condition 

Source
pub fn eval_condition(
    expr: &ConditionExpr,
    detections: &HashMap<String, CompiledDetection>,
    event: &impl Event,
    matched_selections: &mut Vec<String>,
) -> bool
Expand description

Evaluate a condition expression against the event using compiled detections.

Returns true if the condition is satisfied. Populates matched_selections with the names of detections that were evaluated and returned true.