Enum Detection 

pub enum Detection {
    AllOf(Vec<DetectionItem>),
    AnyOf(Vec<Detection>),
    Keywords(Vec<SigmaValue>),
    ArrayMatch {
        field: String,
        quantifier: ArrayQuantifier,
        body: Box<Detection>,
    },
    And(Vec<Detection>),
    Conditional {
        named: HashMap<String, Detection>,
        condition: ConditionExpr,
    },
}

A detection definition: a group of detection items or nested detections.

When constructed from a YAML mapping, items are AND-linked. When constructed from a YAML list of mappings, sub-detections are OR-linked.

Reference: pySigma rule/detection.py SigmaDetection

Variants

AllOf(Vec<DetectionItem>)

AND-linked detection items (from a YAML mapping).

AnyOf(Vec<Detection>)

OR-linked sub-detections (from a YAML list of mappings).

Keywords(Vec<SigmaValue>)

Keyword detection: plain value(s) without a field.

ArrayMatch

Array object-scope quantifier block: field[any]: / field[all]: opening a nested detection that is evaluated against a single array member.

• field is the dot-path to the array (quantifier markers stripped).
• quantifier decides whether one (any) or every (all) member must satisfy body.
• body is the nested detection applied per member. A body item with no field name (FieldSpec::name == None) matches the array member value itself (the scalar-array case field[all]: value).

This is the only construct that expresses same-member correlation across multiple predicates, and the only one that lowers cleanly to backend array primitives (Elasticsearch nested, KQL mv-apply, SQL jsonb_array_elements, Splunk mvexpand).

Fields

field: String

Dot-path to the array field (quantifier markers stripped).

quantifier: ArrayQuantifier

Whether one or all members must satisfy body.

body: Box<Detection>

Nested detection evaluated against a single array member.

And(Vec<Detection>)

AND of heterogeneous sub-detections. Produced when a YAML mapping mixes plain detection items with one or more array object-scope blocks, which Detection::AllOf (a list of simple items) cannot represent.

Conditional

Extended object-scope block body: named element-scoped sub-selections combined by a condition expression (the recursive “mini-event” form), enabling per-element and/or/not. Produced only as an ArrayMatch body when the block map carries a condition: key. The basic conjunction-map body is the degenerate case (an implicit AND of items); this is the explicit-condition form.

Fields

named: HashMap<String, Detection>

Element-scoped named sub-selections (each a nested detection).

condition: ConditionExpr

Boolean combination of the named sub-selections, evaluated per array member.

Trait Implementations

impl Clone for Detection

fn clone(&self) -> Detection

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Detection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Detection

fn eq(&self, other: &Detection) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Detection

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Detection