Struct EvaluationResult 

pub struct EvaluationResult {
    pub header: RuleHeader,
    pub body: ResultBody,
}

A single evaluation result.

Wraps a detection match (ResultBody::Detection) or a correlation firing (ResultBody::Correlation) behind one shared RuleHeader. Serialize emits a single flat JSON object combining header and body fields.

Fields

header: RuleHeader

body: ResultBody

Implementations

impl EvaluationResult

pub fn is_detection(&self) -> bool

True when this result was produced by detection rule matching.

pub fn is_correlation(&self) -> bool

True when this result was produced by a correlation firing.

pub fn as_detection(&self) -> Option<&DetectionBody>

Read the detection-specific body, if this result is a detection.

pub fn as_correlation(&self) -> Option<&CorrelationBody>

Read the correlation-specific body, if this result is a correlation.

pub fn as_detection_mut(&mut self) -> Option<&mut DetectionBody>

Mutable accessor for the detection-specific body.

pub fn as_correlation_mut(&mut self) -> Option<&mut CorrelationBody>

Mutable accessor for the correlation-specific body.

Trait Implementations

impl Clone for EvaluationResult

fn clone(&self) -> EvaluationResult

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EvaluationResult

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for EvaluationResult

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.