Struct TransformedRule 

pub struct TransformedRule {
    pub rule: SigmaRule,
    pub applied_items: Vec<String>,
    pub state: PipelineState,
}

A rule after pipeline application, with the transformations that fired.

Returned by transform_rule and transform_collection for callers that need to read the rewritten rule itself rather than evaluate it: a collector deriving which log channels to subscribe to from the post-pipeline logsource, a report showing the injected conditions, or a test asserting that a mapping applied.

Fields

rule: SigmaRule

The rule after every pipeline ran.

applied_items: Vec<String>

Ids of the transformations that fired, sorted. Transformations without an id: are not tracked, so this can be empty even though rule changed.

state: PipelineState

The merged state the pipelines accumulated (see apply_pipelines_with_state).

Trait Implementations

impl Clone for TransformedRule

fn clone(&self) -> TransformedRule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TransformedRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.