Module exemplar 

Embedded rule exemplars under rsigma.exemplars.

Exemplars are machine-verifiable example events carried on a Sigma rule as a custom attribute. Detection rules use a single event mapping; correlation rules use a timestamped events sequence. The engine never interprets these values at match time; they are documentation plus a closed verification recipe for rule test.

Structs

Exemplar

One extracted exemplar.

ExemplarShapeError

A structural problem in an exemplar list or entry.

TimedEvent

One timed event in a correlation exemplar sequence.

Enums

ExemplarErrorKind

Classification of an exemplar shape error.

ExemplarPayload

The payload of one exemplar.

ExemplarRuleKind

Which kind of Sigma document an exemplar list is attached to.

Expect

Whether the exemplar is expected to match the target rule.

Constants

EXEMPLARS_KEY

The custom-attribute key that carries embedded exemplars.

Functions

correlation_exemplars

Extract exemplars from a correlation rule.

exemplars

Extract exemplars from a detection rule.

exemplars_from_attrs

Extract exemplars from a winning custom_attributes map.

filter_exemplars

Extract exemplars from a filter rule (always empty or an error).

match_exemplar_count

Count structurally valid expect: match exemplars on a parsed attribute map.

match_exemplar_count_json

Count structurally valid expect: match exemplars on a JSON attribute map.

parse_exemplars

Parse a raw exemplar YAML value with kind-specific payload rules.

raw_exemplar_values

Every raw rsigma.exemplars value on a YAML mapping, from both the nested custom_attributes: map and a top-level dotted key, with its JSON-pointer.

raw_match_exemplar_count

Count structurally valid expect: match exemplars on the winning raw value.

raw_winning_exemplars

The winning raw exemplar value, matching parser precedence (nested wins).