Trait Event 

pub trait Event {
    // Required methods
    fn get_field(&self, path: &str) -> Option<EventValue<'_>>;
    fn any_string_value(&self, pred: &dyn Fn(&str) -> bool) -> bool;
    fn all_string_values(&self) -> Vec<Cow<'_, str>>;
    fn to_json(&self) -> Value;
}

Generic interface for accessing event data during Sigma rule evaluation.

Implementations provide field lookup (with dot-notation), keyword search over all string values, and serialization to JSON for correlation storage.

Required Methods

fn get_field(&self, path: &str) -> Option<EventValue<'_>>

Look up a field by name. Supports dot-notation for nested access.

Returns None if the field is absent. Returns Some(EventValue::Null) if the field exists but is null.

fn any_string_value(&self, pred: &dyn Fn(&str) -> bool) -> bool

Check if any string value anywhere in the event satisfies a predicate. Used by keyword detection.

fn all_string_values(&self) -> Vec<Cow<'_, str>>

Collect all string values in the event.

fn to_json(&self) -> Value

Materialize the event as a serde_json::Value.

Implementations on Foreign Types

impl<T: Event + ?Sized> Event for &T

fn get_field(&self, path: &str) -> Option<EventValue<'_>>

fn any_string_value(&self, pred: &dyn Fn(&str) -> bool) -> bool

fn all_string_values(&self) -> Vec<Cow<'_, str>>

fn to_json(&self) -> Value

Implementors

impl Event for KvEvent

impl Event for PlainEvent

impl<'a> Event for JsonEvent<'a>

impl<K, V> Event for MapEvent<K, V>

where K: AsRef<str> + Debug + Clone, V: AsRef<str> + Debug + Clone,