pub type SiemRuleMatchAsync = fn(log: Arc<SiemLog>, key_store: SharedKeyStore, datasets: Arc<BTreeMap<SiemDatasetType, SiemDataset>>) -> Box<dyn Future<Output = Option<(Option<SiemAlert>, Option<SiemTask>)>> + Unpin>;