Struct Detections 

pub struct Detections {
    pub named: HashMap<String, Detection>,
    pub conditions: Vec<ConditionExpr>,
    pub condition_strings: Vec<String>,
    pub timeframe: Option<String>,
}

The complete detection section of a Sigma rule.

Contains named detection identifiers, condition expressions, and optional timeframe.

Reference: pySigma rule/detection.py SigmaDetections

Fields

named: HashMap<String, Detection>

Named detections (e.g. selection, filter_main, etc.)

conditions: Vec<ConditionExpr>

One or more condition expressions (parsed from condition string or list).

condition_strings: Vec<String>

Raw condition strings (before parsing).

timeframe: Option<String>

Optional timeframe for aggregation rules (deprecated in favor of correlations).

Trait Implementations

impl Clone for Detections

fn clone(&self) -> Detections

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Detections

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Detections

fn eq(&self, other: &Detections) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Detections

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Detections