Struct SigmaString 

pub struct SigmaString {
    pub parts: Vec<StringPart>,
    pub original: String,
}

A Sigma string value that may contain wildcards.

When Sigma rules specify string values, * and ? are interpreted as wildcards unless escaped with \. This type preserves the structure so downstream consumers (evaluators, converters) can handle wildcards appropriately.

Escape semantics

Backslash (\) is the escape character. Its behavior depends on what follows:

Input	Parsed as	Rationale
\*	literal *	Escapes the wildcard — backslash consumed
\?	literal ?	Escapes the wildcard — backslash consumed
\\	literal \	Escapes itself — backslash consumed
\W	literal \W (both kept)	Non-special char — backslash preserved

This matches the pySigma SigmaString behavior: backslash only consumes itself when followed by a Sigma-special character (*, ?, \). Before non-special characters it is treated as a literal backslash, which is important for patterns like \Windows\ in file paths.

Fields

parts: Vec<StringPart>

original: String

Implementations

impl SigmaString

pub fn new(s: &str) -> Self

Parse a string, interpreting * and ? as wildcards and \ as escape.

pub fn from_raw(s: &str) -> Self

Create from a raw string with no wildcard parsing (e.g. for re modifier).

pub fn is_plain(&self) -> bool

Returns true if the string contains no wildcards.

pub fn contains_wildcards(&self) -> bool

Returns true if the string contains any wildcard characters.

pub fn as_plain(&self) -> Option<String>

Get the plain string content (without wildcards). Returns None if wildcards present.

Trait Implementations

impl Clone for SigmaString

fn clone(&self) -> SigmaString

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SigmaString

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for SigmaString

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for SigmaString

fn eq(&self, other: &SigmaString) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SigmaString

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for SigmaString

impl StructuralPartialEq for SigmaString