Struct CorrelationConfig 

pub struct CorrelationConfig {
    pub timestamp_fields: Vec<String>,
    pub timestamp_fallback: TimestampFallback,
    pub max_state_entries: usize,
    pub suppress: Option<u64>,
    pub action_on_match: CorrelationAction,
    pub emit_detections: bool,
    pub correlation_event_mode: CorrelationEventMode,
    pub max_correlation_events: usize,
}

Configuration for the correlation engine.

Provides engine-level defaults that mirror pySigma backend optional arguments. Per-correlation overrides can be set via SetCustomAttribute pipeline transformations using the rsigma.* attribute namespace.

Fields

timestamp_fields: Vec<String>

Field names to try for timestamp extraction, in order of priority.

The engine will try each field until one yields a parseable timestamp. If none succeed, the timestamp_fallback policy applies.

timestamp_fallback: TimestampFallback

What to do when no timestamp can be extracted from an event.

Default: WallClock (use Utc::now()).

max_state_entries: usize

Maximum number of state entries (across all correlations and groups) before aggressive eviction is triggered. Prevents unbounded memory growth.

Default: 100_000.

suppress: Option<u64>

Default suppression window in seconds.

After a correlation fires for a (correlation, group_key), suppress re-alerts for this duration. None means no suppression (every condition-satisfying event produces an alert).

Can be overridden per-correlation via the rsigma.suppress custom attribute.

action_on_match: CorrelationAction

Default action to take after a correlation fires.

Can be overridden per-correlation via the rsigma.action custom attribute.

emit_detections: bool

Whether to emit detection-level matches for rules that are only referenced by correlations (where generate: false).

Default: true (emit all detection matches). Set to false to suppress detection output for correlation-only rules.

correlation_event_mode: CorrelationEventMode

How to include contributing events in correlation results.

• None (default): no event storage, zero overhead.
• Full: events are deflate-compressed and decompressed on output.
• Refs: only timestamps + event IDs are stored (minimal memory).

Can be overridden per-correlation via rsigma.correlation_event_mode.

max_correlation_events: usize

Maximum number of events to store per (correlation, group_key) window when correlation_event_mode is not None.

Bounds memory at: max_correlation_events × cost_per_event × active_groups. Default: 10.

Trait Implementations

impl Clone for CorrelationConfig

fn clone(&self) -> CorrelationConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorrelationConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CorrelationConfig

fn default() -> Self

Returns the “default value” for a type.