Enum AdsSection 

pub enum AdsSection {
    Goal,
    Categorization,
    Strategy,
    TechnicalContext,
    BlindSpots,
    FalsePositives,
    Validation,
    Priority,
    Response,
}

One ADS section.

Reference: Palantir Alerting and Detection Strategy framework.

Variants

Goal

What the detection is trying to catch (carried by description).

Categorization

The ATT&CK categorization (carried by attack.* tags).

Strategy

A one-paragraph abstract of the detection approach.

TechnicalContext

The data source, fields, and environment knowledge the detection needs.

BlindSpots

How an attacker could evade the detection, and what it assumes.

FalsePositives

Known benign triggers (carried by falsepositives).

Validation

A recipe that produces a true-positive event the detection fires on.

Priority

Why the detection’s level is what it is (the priority rationale).

Response

What an analyst should do when the detection fires.

Implementations

impl AdsSection

pub fn all() -> &'static [AdsSection]

All sections, in canonical order.

pub fn from_id(id: &str) -> Option<AdsSection>

Look up a section by its stable snake_case id.

pub fn info(&self) -> AdsSectionInfo

This section’s catalogue metadata.

pub fn id(&self) -> &'static str

The stable snake_case id (e.g. blind_spots).

pub fn carrier(&self) -> AdsCarrier

The carrier of this section’s content.

pub fn carrier_field(&self) -> &'static str

The field name or attribute key that carries this section.

pub fn default_required(&self) -> bool

Whether this section is required by default.

pub fn content(&self, rule: &SigmaRule) -> Option<AdsContent>

Extract this section’s content from a rule, or None when the section is absent or blank.

pub fn is_present(&self, rule: &SigmaRule) -> bool

Whether this section’s content is present and non-blank on the rule.

Trait Implementations

impl Clone for AdsSection

fn clone(&self) -> AdsSection

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for AdsSection

impl Debug for AdsSection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AdsSection

impl Hash for AdsSection

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for AdsSection

fn eq(&self, other: &AdsSection) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AdsSection

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AdsSection