Struct MatchResult 

pub struct MatchResult {
    pub rule_title: String,
    pub rule_id: Option<String>,
    pub level: Option<Level>,
    pub tags: Vec<String>,
    pub matched_selections: Vec<String>,
    pub matched_fields: Vec<FieldMatch>,
    pub event: Option<Value>,
    pub custom_attributes: Arc<HashMap<String, Value>>,
}

The result of a rule matching an event.

Contains the matched rule metadata plus details about which selections and fields triggered the match.

Fields

rule_title: String

Title of the matched rule.

rule_id: Option<String>

ID of the matched rule (if present).

level: Option<Level>

Severity level.

tags: Vec<String>

Tags from the matched rule.

matched_selections: Vec<String>

Which named detections (selections) matched.

matched_fields: Vec<FieldMatch>

Specific field matches that triggered the detection.

event: Option<Value>

The full event that triggered the match, included when the rsigma.include_event custom attribute is set to "true".

custom_attributes: Arc<HashMap<String, Value>>

Custom attributes carried from the original Sigma rule.

Contains the merged view of (a) arbitrary non-standard top-level keys, (b) the explicit custom_attributes: block, and (c) anything added by pipeline SetCustomAttribute transformations. Wrapped in Arc so that per-match cloning is a pointer bump.

Trait Implementations

impl Clone for MatchResult

fn clone(&self) -> MatchResult

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MatchResult

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for MatchResult

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.