Struct usiem::components::alert::SiemRuleAsync

pub struct SiemRuleAsync {
    pub name: &'static str,
    pub service: &'static str,
    pub description: &'static str,
    pub templates: &'static BTreeMap<&'static str, &'static str>,
    pub tenants: &'static BTreeMap<&'static str, &'static str>,
    pub mitre: (&'static Vec<MitreTactics>, &'static Vec<MitreTechniques>),
    pub needed_datasets: &'static Vec<SiemDatasetType>,
}

Fields

name: &'static str

Name of the rule

service: &'static str

Name of the Service applied to match this rule

description: &'static str

A description of the rule to be showed in the UI

templates: &'static BTreeMap<&'static str, &'static str>

Includes templateS for this rule. used to generate the alert description

tenants: &'static BTreeMap<&'static str, &'static str>

Sets the mapping of languages to be used in each tenant

mitre: (&'static Vec<MitreTactics>, &'static Vec<MitreTechniques>)

tactics and techniques covered by this rule

needed_datasets: &'static Vec<SiemDatasetType>

List of datasets needed by this rule

Implementations

impl SiemRuleAsync

pub fn get_template_for_log(&self, log: &SiemLog) -> &'static str

To be used by the SiemRuleMatch