Enum ConditionExpr 

pub enum ConditionExpr {
    And(Vec<ConditionExpr>),
    Or(Vec<ConditionExpr>),
    Not(Box<ConditionExpr>),
    Identifier(String),
    Selector {
        quantifier: Quantifier,
        pattern: SelectorPattern,
    },
}

Parsed condition expression AST.

Produced by the PEG parser + Pratt parser from condition strings like selection and not filter or 1 of selection_* and not 1 of filter_*.

Reference: pySigma conditions.py ConditionItem hierarchy

Variants

And(Vec<ConditionExpr>)

Logical AND of sub-expressions.

Or(Vec<ConditionExpr>)

Logical OR of sub-expressions.

Not(Box<ConditionExpr>)

Logical NOT of a sub-expression.

Identifier(String)

Reference to a named detection identifier.

Selector

Quantified selector: 1 of selection_*, all of them, etc.

Fields

quantifier: Quantifier

pattern: SelectorPattern

Trait Implementations

impl Clone for ConditionExpr

fn clone(&self) -> ConditionExpr

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ConditionExpr

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for ConditionExpr

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for ConditionExpr

fn eq(&self, other: &ConditionExpr) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ConditionExpr

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for ConditionExpr

impl StructuralPartialEq for ConditionExpr