Struct CorrelationResult 

pub struct CorrelationResult {
    pub rule_title: String,
    pub rule_id: Option<String>,
    pub level: Option<Level>,
    pub tags: Vec<String>,
    pub correlation_type: CorrelationType,
    pub group_key: Vec<(String, String)>,
    pub aggregated_value: f64,
    pub timespan_secs: u64,
    pub events: Option<Vec<Value>>,
    pub event_refs: Option<Vec<EventRef>>,
    pub custom_attributes: Arc<HashMap<String, Value>>,
}

The result of a correlation rule firing.

Fields

rule_title: String

Title of the correlation rule.

rule_id: Option<String>

ID of the correlation rule (if present).

level: Option<Level>

Severity level.

tags: Vec<String>

Tags from the correlation rule.

correlation_type: CorrelationType

Type of correlation.

group_key: Vec<(String, String)>

Group-by field names and their values for this match.

aggregated_value: f64

The aggregated value that triggered the condition (count, sum, avg, etc.).

timespan_secs: u64

The time window in seconds.

events: Option<Vec<Value>>

Full event bodies, included when correlation_event_mode is Full.

Contains up to max_correlation_events recently stored window events. Events are decompressed from deflate storage on output.

event_refs: Option<Vec<EventRef>>

Lightweight event references, included when correlation_event_mode is Refs.

Contains up to max_correlation_events timestamp + optional ID pairs.

custom_attributes: Arc<HashMap<String, Value>>

Custom attributes from the original Sigma correlation rule (merged view of arbitrary top-level keys, the custom_attributes: block, and any pipeline-applied overrides).

Trait Implementations

impl Clone for CorrelationResult

fn clone(&self) -> CorrelationResult

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorrelationResult

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for CorrelationResult

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.