Struct SigmaCollection 

pub struct SigmaCollection {
    pub rules: Vec<SigmaRule>,
    pub correlations: Vec<CorrelationRule>,
    pub filters: Vec<FilterRule>,
    pub errors: Vec<String>,
}

A collection of parsed Sigma documents from one or more YAML files.

Fields

rules: Vec<SigmaRule>

correlations: Vec<CorrelationRule>

filters: Vec<FilterRule>

errors: Vec<String>

Per-document parse errors accumulated while building the collection. Populated by parse_sigma_yaml and friends; one entry per document the parser could not produce a SigmaRule, CorrelationRule, or FilterRule from. The collection is still returned on Ok(_) so callers can decide whether a partial parse is acceptable; the SigmaCollection::has_errors / SigmaCollection::error_count / SigmaCollection::into_result helpers cover the common “treat any error as a failure” path.

Implementations

impl SigmaCollection

pub fn new() -> Self

pub fn len(&self) -> usize

Total number of parsed documents.

pub fn is_empty(&self) -> bool

pub fn has_errors(&self) -> bool

True when the parser recorded one or more per-document parse errors while building this collection.

pub fn error_count(&self) -> usize

Number of per-document parse errors recorded while building this collection. Equivalent to self.errors.len().

pub fn into_result(self) -> Result<Self, Vec<String>>

Promote the accumulated errors to a hard failure. Returns the collection when SigmaCollection::has_errors is false; otherwise returns the collection’s errors so callers can format them. The original collection is consumed either way so the success path can move out of self without re-cloning the documents.

Trait Implementations

impl Clone for SigmaCollection

fn clone(&self) -> SigmaCollection

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SigmaCollection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SigmaCollection

fn default() -> Self

Returns the “default value” for a type.

impl Serialize for SigmaCollection

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.