Struct QueryRule 

pub struct QueryRule { /* private fields */ }

A KQL or Lucene query rule. Rules start disabled unless explicitly enabled.

Other rule types can be created by passing their JSON definition to Security::create_rule.

Implementations

impl QueryRule

pub fn new( name: impl Into<String>, description: impl Into<String>, query: impl Into<String>, ) -> Self

A disabled KQL rule over logs-* with medium severity, on the default RuleSchedule: every 5 minutes, searching the last 6.

use security_client_rs::security::{QueryRule, RuleSchedule};
use serde_json::to_value;
use std::time::Duration;

let rule = QueryRule::new("Failed logins", "Repeated failures", "event.outcome: failure")
    .schedule(RuleSchedule::every(Duration::from_secs(600))?);
let body = to_value(rule)?;
assert_eq!(body["enabled"], false);
assert_eq!(body["interval"], "10m");
assert_eq!(body["from"], "now-11m");

pub fn language(self, language: QueryLanguage) -> Self

pub fn index<I: IntoIterator<Item = S>, S: Into<String>>( self, patterns: I, ) -> Self

pub fn severity(self, severity: Severity) -> Self

pub fn risk_score(self, score: RiskScore) -> Self

pub fn enabled(self, enabled: bool) -> Self

pub fn schedule(self, schedule: RuleSchedule) -> Self

Sets how often the rule runs and how far back each run searches.

pub fn custom_schedule( self, interval: impl Into<String>, from: impl Into<String>, ) -> Self

Sets Kibana’s interval, such as 15m, and from, such as now-20m or other date math, directly. Keep from at least one interval back, or runs leave gaps; prefer schedule.

pub fn tags<I: IntoIterator<Item = S>, S: Into<String>>(self, tags: I) -> Self

pub fn rule_id(self, rule_id: impl Into<String>) -> Self

A stable identifier, generated by Kibana when omitted.

pub fn exceptions_list(self, lists: Vec<ListReference>) -> Self

Trait Implementations

impl Clone for QueryRule

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for QueryRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for QueryRule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.