Function draft_rule 

pub fn draft_rule<E: Event>(
    exemplars: &[E],
    baseline: &[E],
    config: &DraftConfig,
) -> Result<DraftReport, DraftError>

Draft a Sigma detection rule from exemplar events, optionally contrasted against a baseline corpus (pass an empty slice for no baseline).

The returned draft is guaranteed to parse, compile, and match every exemplar; drafting errors instead of emitting a rule that does not.