Struct FieldSpec 

pub struct FieldSpec {
    pub name: Option<String>,
    pub modifiers: Vec<Modifier>,
}

A field name with optional modifiers, parsed from detection keys like TargetObject|endswith or Destination|contains|all.

Reference: pySigma rule/detection.py SigmaDetectionItem.from_mapping

Fields

name: Option<String>

Field name (None for keyword detections without a field).

modifiers: Vec<Modifier>

Ordered list of modifiers applied to this field.

Implementations

impl FieldSpec

pub fn new(name: Option<String>, modifiers: Vec<Modifier>) -> Self

pub fn has_modifier(&self, m: Modifier) -> bool

pub fn is_keyword(&self) -> bool

Trait Implementations

impl Clone for FieldSpec

fn clone(&self) -> FieldSpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FieldSpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for FieldSpec

fn eq(&self, other: &FieldSpec) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for FieldSpec

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for FieldSpec

impl StructuralPartialEq for FieldSpec