Struct usiem::components::alert::SiemRule

pub struct SiemRule {
    pub name: &'static str,
    pub service: &'static str,
    pub description: &'static str,
    pub templates: &'static BTreeMap<&'static str, &'static str>,
    pub tenants: &'static BTreeMap<&'static str, &'static str>,
    pub mitre: (&'static Vec<MitreTactics>, &'static Vec<MitreTechniques>),
    pub datasets: BTreeMap<SiemDatasetType, SiemDataset>,
    pub needed_datasets: &'static Vec<SiemDatasetType>,
    pub rule: SiemRuleMatchSync,
}

Fields

name: &'static str

Name of the rule

service: &'static str

Name of the Service applied to match this rule

description: &'static str

A description of the rule to be showed in the UI

templates: &'static BTreeMap<&'static str, &'static str>

Includes templateS for this rule. used to generate the alert description

tenants: &'static BTreeMap<&'static str, &'static str>

Sets the mapping of languages to be used in each tenant

mitre: (&'static Vec<MitreTactics>, &'static Vec<MitreTechniques>)

tactics and techniques covered by this rule

datasets: BTreeMap<SiemDatasetType, SiemDataset>

Datasets to be used by the rules

needed_datasets: &'static Vec<SiemDatasetType>

List of datasets needed by this rule

rule: SiemRuleMatchSync

Checks if the log matches this rule. It can return an alert and/or an action to be executed by the SOAR

Implementations

impl SiemRule

pub fn match_log(
    &self,
    log: &SiemLog
) -> Option<(Option<SiemAlert>, Option<SiemTask>)>

pub fn set_dataset(&mut self, dataset: SiemDataset)

Updates the references for the datasets

pub fn get_dataset(&self, typ: SiemDatasetType) -> Option<&SiemDataset>

To be used by the SiemRuleMatch

pub fn get_template_for_log(&self, log: &SiemLog) -> &'static str

To be used by the SiemRuleMatch

Trait Implementations

impl Clone for SiemRule

fn clone(&self) -> SiemRule

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.