Enum usiem::components::dataset::SiemDataset

#[non_exhaustive]
pub enum SiemDataset {
    GeoIp(GeoIpSynDataset),
    IpMac(IpMapSynDataset),
    IpDNS(IpMapListSynDataset),
    MacHost(TextMapSynDataset),
    HostUser(TextMapSynDataset),
    BlockIp(IpSetSynDataset),
    BlockDomain(TextSetSynDataset),
    BlockEmailSender(TextSetSynDataset),
    BlockCountry(TextSetSynDataset),
    HostVulnerable(TextMapListSynDataset),
    UserTag(TextMapListSynDataset),
    AssetTag(TextMapListSynDataset),
    IpCloudService(IpNetSynDataset),
    IpCloudProvider(IpNetSynDataset),
    UserHeadquarters(TextMapSynDataset),
    IpHeadquarters(IpNetSynDataset),
    HeadquartersWorkingHours,
    CustomMapIpNet((Cow<'static, str>, IpNetSynDataset)),
    CustomMapText((Cow<'static, str>, TextMapSynDataset)),
    CustomMapTextList((Cow<'static, str>, TextMapListSynDataset)),
    CustomIpList((Cow<'static, str>, IpSetSynDataset)),
    CustomIpMap((Cow<'static, str>, IpMapSynDataset)),
    CustomTextList((Cow<'static, str>, TextSetSynDataset)),
    MantainceCalendar(CalendarSynDataset),
    Configuration(TextMapSynDataset),
    Secrets((Cow<'static, str>, TextMapSynDataset)),
}

Common work datasets that allow a rapid development of rules and that the information of some logs allows enriching others. Other datasets like the ones associated with headquarters is controlled by the CMDB

The custom datasets are associated with the name of the dataset

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

GeoIp(GeoIpSynDataset)

Map IP to country, city, latitude and longitude

IpMac(IpMapSynDataset)

IP associated with a MAC address

IpDNS(IpMapListSynDataset)

IP associated with a resolved domain

MacHost(TextMapSynDataset)

MAC address associated with a Hostname

HostUser(TextMapSynDataset)

Hostname associated with a username

BlockIp(IpSetSynDataset)

List of IPs in the block list

BlockDomain(TextSetSynDataset)

List of domain in the block list

BlockEmailSender(TextSetSynDataset)

List of email senders in the block list

BlockCountry(TextSetSynDataset)

List of countries in the block list

HostVulnerable(TextMapListSynDataset)

Association of hostname with a vulnerability.

UserTag(TextMapListSynDataset)

Tag each user with roles => user.roles = [vip, admin, extern, guest, director, super_user, local_user]

AssetTag(TextMapListSynDataset)

Tag each host with categories => [web_server, sec_related, critical, ad_related, net_related]

IpCloudService(IpNetSynDataset)

Cloud service => Office 365, G Suit …

IpCloudProvider(IpNetSynDataset)

Cloud Provider => Azure, Google Cloud, AWS

UserHeadquarters(TextMapSynDataset)

User associated with a headquarter

IpHeadquarters(IpNetSynDataset)

IP net associated with a headquarter

HeadquartersWorkingHours

Working hours of each headquarter

CustomMapIpNet((Cow<'static, str>, IpNetSynDataset))

User custom dataset IP_NET => Text

CustomMapText((Cow<'static, str>, TextMapSynDataset))

User custom dataset Text => Text

CustomMapTextList((Cow<'static, str>, TextMapListSynDataset))

User custom dataset Text => Text

CustomIpList((Cow<'static, str>, IpSetSynDataset))

User custom dataset IP list

CustomIpMap((Cow<'static, str>, IpMapSynDataset))

User custom dataset IP list

CustomTextList((Cow<'static, str>, TextSetSynDataset))

User custom dataset Text list

MantainceCalendar(CalendarSynDataset)

Mantaince Calendar

Configuration(TextMapSynDataset)

Configuration of components. Allows modifications of component parameters in real time.

Secrets((Cow<'static, str>, TextMapSynDataset))

Secret store. A component will only be able to access his own secrets.

Implementations

impl SiemDataset

pub fn dataset_type(&self) -> SiemDatasetType

Trait Implementations

impl Clone for SiemDataset

fn clone(&self) -> SiemDataset

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SiemDataset

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for SiemDataset

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Ord for SiemDataset

fn cmp(&self, other: &Self) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Selfwhere
    Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Selfwhere
    Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Selfwhere
    Self: Sized + PartialOrd<Self>,

Restrict a value to a certain interval.

impl PartialEq<SiemDataset> for SiemDataset

fn eq(&self, other: &Self) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd<SiemDataset> for SiemDataset

fn partial_cmp(&self, other: &Self) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

This method tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

This method tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

This method tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

This method tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for SiemDataset

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>where
    S: Serializer,

Serialize this value into the given Serde serializer.

impl<'a> TryFrom<&'a SiemDataset> for &'a GeoIpSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: &'a SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl<'a> TryFrom<&'a SiemDataset> for &'a IpMapListSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: &'a SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl<'a> TryFrom<&'a SiemDataset> for &'a IpMapSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: &'a SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl<'a> TryFrom<&'a SiemDataset> for &'a IpNetSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: &'a SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl<'a> TryFrom<&'a SiemDataset> for &'a IpSetSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: &'a SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl<'a> TryFrom<&'a SiemDataset> for &'a TextMapListSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: &'a SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl<'a> TryFrom<&'a SiemDataset> for &'a TextMapSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: &'a SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl<'a> TryFrom<&'a SiemDataset> for &'a TextSetSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: &'a SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<(SiemDatasetType, GeoIpSynDataset)> for SiemDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(
    value: (SiemDatasetType, GeoIpSynDataset)
) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<(SiemDatasetType, IpMapListSynDataset)> for SiemDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(
    value: (SiemDatasetType, IpMapListSynDataset)
) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<(SiemDatasetType, IpMapSynDataset)> for SiemDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(
    value: (SiemDatasetType, IpMapSynDataset)
) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<(SiemDatasetType, IpNetSynDataset)> for SiemDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(
    value: (SiemDatasetType, IpNetSynDataset)
) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<(SiemDatasetType, IpSetSynDataset)> for SiemDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(
    value: (SiemDatasetType, IpSetSynDataset)
) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<(SiemDatasetType, TextMapListSynDataset)> for SiemDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(
    value: (SiemDatasetType, TextMapListSynDataset)
) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<(SiemDatasetType, TextMapSynDataset)> for SiemDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(
    value: (SiemDatasetType, TextMapSynDataset)
) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<(SiemDatasetType, TextSetSynDataset)> for SiemDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(
    value: (SiemDatasetType, TextSetSynDataset)
) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<SiemDataset> for GeoIpSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<SiemDataset> for IpMapListSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<SiemDataset> for IpMapSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<SiemDataset> for IpNetSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<SiemDataset> for IpSetSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<SiemDataset> for TextMapListSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<SiemDataset> for TextMapSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<SiemDataset> for TextSetSynDataset

type Error = &'static str

The type returned in the event of a conversion error.

fn try_from(value: SiemDataset) -> Result<Self, Self::Error>

Performs the conversion.

impl Eq for SiemDataset