Struct DetectionItem 

pub struct DetectionItem {
    pub field: FieldSpec,
    pub values: Vec<SigmaValue>,
}

A single detection item: a field (with modifiers) mapped to one or more values.

Examples:

• EventType: "user.mfa.factor.deactivate" → field=“EventType”, values=[“user.mfa…”]
• Destination|contains|all: ['new-object', 'net.webclient'] → field=“Destination”, modifiers=[Contains, All], values=[…]

Reference: pySigma rule/detection.py SigmaDetectionItem

Fields

field: FieldSpec

The field specification (name + modifiers).

values: Vec<SigmaValue>

One or more values to match against.

Trait Implementations

impl Clone for DetectionItem

fn clone(&self) -> DetectionItem

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DetectionItem

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for DetectionItem

fn eq(&self, other: &DetectionItem) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for DetectionItem

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for DetectionItem