Enum WindowMode 

pub enum WindowMode {
    Sliding,
    Tumbling,
    Session,
}

Window semantics for a correlation rule’s timespan.

Controls how timespan is anchored to the event stream. Sliding is the default and matches the behavior the Sigma correlation specification already prefers (a trailing per-event window), so omitting window never changes the meaning of an existing rule.

• Sliding: trailing window (t - timespan, t] evaluated per event.
• Tumbling: fixed, boundary-aligned, non-overlapping buckets of size timespan.
• Session: dynamic window that extends while consecutive in-group events stay within gap, capped by timespan as the maximum total span.

Variants

Sliding

Tumbling

Session

Implementations

impl WindowMode

pub fn as_str(&self) -> &'static str

Trait Implementations

impl Clone for WindowMode

fn clone(&self) -> WindowMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for WindowMode

impl Debug for WindowMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for WindowMode

fn default() -> WindowMode

Returns the “default value” for a type.

impl Eq for WindowMode

impl FromStr for WindowMode

type Err = ()

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl PartialEq for WindowMode

fn eq(&self, other: &WindowMode) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for WindowMode

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for WindowMode