Enum Selector 

pub enum Selector {
    Rule,
    Level,
    Event(Vec<String>),
    Match(String),
    Enrichment(Vec<String>),
    CorrelationGroupKey(String),
}

A parsed field selector over the EvaluationResult namespace.

Variants

Rule

rule: the rule id, falling back to the rule title.

Level

level: the severity, lowercased.

Event(Vec<String>)

event.<path>: a dotted path into the retained event JSON.

Match(String)

match.<field>: a matched field value (detection only).

Enrichment(Vec<String>)

enrichment.<path>: a dotted path into header.enrichments.

CorrelationGroupKey(String)

correlation.group_key.<field>: a group-by value (correlation only).

Implementations

impl Selector

pub fn parse(raw: &str) -> Result<Self, SelectorParseError>

Parse a selector string. Returns a SelectorParseError naming the offending selector on an unknown namespace or an empty path.

pub fn as_str(&self) -> String

The canonical string form of this selector. Round-trips Selector::parse.

pub fn resolve(&self, result: &EvaluationResult) -> Option<Value>

Resolve this selector against a result. Returns None when the value is absent (missing field, wrong result kind, or no retained event).

Trait Implementations

impl Clone for Selector

fn clone(&self) -> Selector

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Selector

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Selector

impl PartialEq for Selector

fn eq(&self, other: &Selector) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Selector