Enum CompiledDetection 

pub enum CompiledDetection {
    AllOf(Vec<CompiledDetectionItem>),
    AnyOf(Vec<CompiledDetection>),
    Keywords(CompiledMatcher),
    ArrayMatch {
        field: String,
        quantifier: ArrayQuantifier,
        body: Box<CompiledDetection>,
    },
    And(Vec<CompiledDetection>),
    Conditional {
        named: HashMap<String, CompiledDetection>,
        condition: ConditionExpr,
    },
}

A compiled detection definition.

Variants

AllOf(Vec<CompiledDetectionItem>)

AND-linked detection items (from a YAML mapping).

AnyOf(Vec<CompiledDetection>)

OR-linked sub-detections (from a YAML list of mappings).

Keywords(CompiledMatcher)

Keyword detection: match values across all event fields.

ArrayMatch

Array object-scope match: evaluate body against the members of the array at field, with any/all quantification. Within body, a detection item with field == None matches the array member itself.

Fields

field: String

quantifier: ArrayQuantifier

body: Box<CompiledDetection>

And(Vec<CompiledDetection>)

AND of heterogeneous sub-detections (a mapping mixing plain items with array object-scope blocks).

Conditional

Extended array object-scope body: named element-scoped sub-selections combined by condition (and/or/not), evaluated against a single array member. Appears only as an ArrayMatch body.

Fields

named: HashMap<String, CompiledDetection>

condition: ConditionExpr

Trait Implementations

impl Clone for CompiledDetection

fn clone(&self) -> CompiledDetection

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CompiledDetection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.