pub fn builtin_schema_logsource() -> HashMap<String, LogSource>Expand description
Built-in schema-to-logsource defaults for the platform-locked schemas.
Only schemas that unambiguously imply a platform are listed. The plain
cross-platform schemas (ecs, ocsf, cef, generic_json) are omitted:
they must not imply a product, since doing so would prune correct rules for
the other platforms those schemas also carry. The ecs_windows and
ecs_linux specializations do carry a platform (and route as ecs via
builtin_schema_aliases).
Built-in schema-to-logsource mapping for schemas that carry an implied
product/service (or custom dimensions for off-taxonomy sources).
Testable via the public API: callers who need the map can inspect it
to verify that every signature name they recognize also has a logsource.