Struct CorrelationRule 

pub struct CorrelationRule {

    pub title: String,
    pub sigma_version: Option<u32>,
    pub id: Option<String>,
    pub name: Option<String>,
    pub status: Option<Status>,
    pub description: Option<String>,
    pub author: Option<String>,
    pub date: Option<String>,
    pub modified: Option<String>,
    pub related: Vec<Related>,
    pub references: Vec<String>,
    pub taxonomy: Option<String>,
    pub license: Option<String>,
    pub tags: Vec<String>,
    pub fields: Vec<String>,
    pub falsepositives: Vec<String>,
    pub level: Option<Level>,
    pub scope: Vec<String>,
    pub correlation_type: CorrelationType,
    pub rules: Vec<String>,
    pub group_by: Vec<String>,
    pub timespan: Timespan,
    pub window: WindowMode,
    pub gap: Option<Timespan>,
    pub condition: CorrelationCondition,
    pub aliases: Vec<FieldAlias>,
    pub generate: bool,
    pub custom_attributes: HashMap<String, Value>,
}

A Sigma correlation rule.

Reference: pySigma correlations.py SigmaCorrelationRule

Fields

title: String

sigma_version: Option<u32>

The Sigma specification MAJOR version this document targets (the sigma-version attribute). See SigmaRule::sigma_version. A correlation rule and the rules it aggregates should share a major.

id: Option<String>

name: Option<String>

status: Option<Status>

description: Option<String>

author: Option<String>

date: Option<String>

modified: Option<String>

related: Vec<Related>

references: Vec<String>

taxonomy: Option<String>

license: Option<String>

tags: Vec<String>

fields: Vec<String>

falsepositives: Vec<String>

level: Option<Level>

scope: Vec<String>

correlation_type: CorrelationType

rules: Vec<String>

group_by: Vec<String>

timespan: Timespan

window: WindowMode

Window semantics for timespan: sliding (default), tumbling, or session. Absent in the source defaults to WindowMode::Sliding.

gap: Option<Timespan>

Maximum inactivity between consecutive in-group events for a session window. Required when window is session, and unset otherwise.

condition: CorrelationCondition

aliases: Vec<FieldAlias>

generate: bool

custom_attributes: HashMap<String, Value>

Custom attributes attached to the correlation rule.

Populated the same way as SigmaRule.custom_attributes: arbitrary top-level YAML keys, the dedicated custom_attributes: block, and pipeline SetCustomAttribute transformations (last-write-wins). Engine-level rsigma.* extensions (e.g. rsigma.correlation_event_mode, rsigma.suppress, rsigma.action) are read from here.

Trait Implementations

impl Clone for CorrelationRule

fn clone(&self) -> CorrelationRule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorrelationRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for CorrelationRule

fn eq(&self, other: &CorrelationRule) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for CorrelationRule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for CorrelationRule