Skip to main content

scaffold_missing

Function scaffold_missing 

Source
pub fn scaffold_missing(rule: &SigmaRule) -> Vec<AdsScaffoldEntry>
Expand description

Build placeholder rsigma.ads.* entries for the sections a rule is missing.

Only the custom-attribute sections are scaffolded; the reused fields (description, tags, falsepositives) already live on the rule, so the scaffold leaves them in place and fills the gaps under rsigma.ads.*.