Struct SchemaSignature 

pub struct SchemaSignature {
    pub name: String,
    pub predicates: Vec<SchemaPredicate>,
    pub specificity: u32,
}

A named schema recognizer: every predicate must hold for the signature to match. Higher specificity wins when several signatures match the same event. Multiple signatures may share a name (for example several distinct ways to recognize Sysmon); the classifier reports the name.

Fields

name: String

Schema label reported on a match (for example ecs, sysmon).

predicates: Vec<SchemaPredicate>

Conditions that must all hold (logical AND). An empty predicate set matches every event; prefer SchemaPredicate::HasAnyField for a structured-event fallback.

specificity: u32

Tie-breaking weight; the highest-specificity matching signature wins.

Trait Implementations

impl Clone for SchemaSignature

fn clone(&self) -> SchemaSignature

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SchemaSignature

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.