Enum Detection 

pub enum Detection {
    AllOf(Vec<DetectionItem>),
    AnyOf(Vec<Detection>),
    Keywords(Vec<SigmaValue>),
}

A detection definition: a group of detection items or nested detections.

When constructed from a YAML mapping, items are AND-linked. When constructed from a YAML list of mappings, sub-detections are OR-linked.

Reference: pySigma rule/detection.py SigmaDetection

Variants

AllOf(Vec<DetectionItem>)

AND-linked detection items (from a YAML mapping).

AnyOf(Vec<Detection>)

OR-linked sub-detections (from a YAML list of mappings).

Keywords(Vec<SigmaValue>)

Keyword detection: plain value(s) without a field.

Trait Implementations

impl Clone for Detection

fn clone(&self) -> Detection

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Detection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Detection

fn eq(&self, other: &Detection) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Detection

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Detection