Struct SchemaRouter 

pub struct SchemaRouter { /* private fields */ }

A multi-engine router over a classifier, a RoutingPlan, one detection engine per pipeline-set, and one shared correlation store.

Implementations

impl SchemaRouter

pub fn build( collection: &SigmaCollection, classifier: SchemaClassifier, plan: RoutingPlan, pipeline_sets: Vec<Vec<Pipeline>>, corr_config: CorrelationConfig, include_event: bool, match_detail: MatchDetailLevel, logsource_extractor: Option<LogSourceExtractor>, ) -> Result<Self>

Build a router. pipeline_sets must be index-aligned with plan.pipeline_sets() (one resolved pipeline list per set).

pub fn on_unknown(&self) -> OnUnknown

The unknown-handling policy this router enforces.

pub fn has_correlations(&self) -> bool

Whether this router has a correlation store.

pub fn detection_rule_count(&self) -> usize

Number of detection rules (same across every per-schema engine).

pub fn logsource_pruned_total(&self) -> u64

Total rule candidates pruned by logsource across every per-schema engine (each event routes to exactly one engine).

pub fn logsource_absent_total(&self) -> u64

Total evaluate calls with no extractable event logsource (fail-open) across every per-schema engine.

pub fn correlation_rule_count(&self) -> usize

Number of correlation rules in the shared store (0 when none).

pub fn state_count(&self) -> usize

Number of live correlation window-state entries (0 when none).

pub fn correlation_introspect( &self, id: Option<&str>, group: Option<&str>, ) -> Option<CorrelationStateSnapshot>

Introspect the shared correlation store, if any (id/group filtered).

pub fn export_state(&self) -> Option<CorrelationSnapshot>

Export the shared correlation state, if any, for hot-reload carry-over.

pub fn import_state(&mut self, snapshot: CorrelationSnapshot) -> bool

Import previously exported correlation state into the shared store. No-op (returns true) when there is no correlation store.

pub fn process_batch<E: Event + Sync>( &mut self, events: &[&E], ) -> Vec<ProcessResult>

Route a batch of events: parallel classify + detection, then sequential correlation into the shared store. Mirrors CorrelationEngine::process_batch: the stateless phase runs concurrently (under the parallel feature) and the stateful correlation phase runs in order. Drop/error outcomes yield empty results for that event.

pub fn route(&mut self, event: &impl Event) -> RouteResult

Classify and route one event.