struct

ECS::LogEntry::Rule

Inherits JSON::Serializable < Struct < Value < Object

Constructors

new(pull : JSON::PullParser)
Source
new

Initialize all values as nil

Source
new(*, __pull_for_json_serializable pull : JSON::PullParser)
Source

Instance methods

author(new_value : String)

A chainable setter for author

Source
author

rule.author

Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.

Level: Extended Type: Keyword Example:

["Star-Lord"]
Source
author=(author : String | Nil)

rule.author

Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.

Level: Extended Type: Keyword Example:

["Star-Lord"]
Source
category(new_value : String)

A chainable setter for category

Source
category

rule.category

A categorization value keyword used by the entity using the rule for detection of this event.

Level: Extended Type: Keyword Example:

Attempted Information Leak
Source
category=(category : String | Nil)

rule.category

A categorization value keyword used by the entity using the rule for detection of this event.

Level: Extended Type: Keyword Example:

Attempted Information Leak
Source
description(new_value : String)

A chainable setter for description

Source
description

rule.description

The description of the rule generating the event.

Level: Extended Type: Keyword Example:

Block requests to public DNS over HTTPS / TLS protocols
Source
description=(description : String | Nil)

rule.description

The description of the rule generating the event.

Level: Extended Type: Keyword Example:

Block requests to public DNS over HTTPS / TLS protocols
Source
id(new_value : String)

A chainable setter for id

Source
id

rule.id

A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.

Level: Extended Type: Keyword Example:

101
Source
id=(id : String | Nil)

rule.id

A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.

Level: Extended Type: Keyword Example:

101
Source
license(new_value : String)

A chainable setter for license

Source
license

rule.license

Name of the license under which the rule used to generate this event is made available.

Level: Extended Type: Keyword Example:

Apache 2.0
Source
license=(license : String | Nil)

rule.license

Name of the license under which the rule used to generate this event is made available.

Level: Extended Type: Keyword Example:

Apache 2.0
Source
name(new_value : String)

A chainable setter for name

Source
name

rule.name

The name of the rule or signature generating the event.

Level: Extended Type: Keyword Example:

BLOCK_DNS_over_TLS
Source
name=(name : String | Nil)

rule.name

The name of the rule or signature generating the event.

Level: Extended Type: Keyword Example:

BLOCK_DNS_over_TLS
Source
reference(new_value : String)

A chainable setter for reference

Source
reference

rule.reference

Reference URL to additional information about the rule used to generate this event.

The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.

Level: Extended Type: Keyword Example:

https://en.wikipedia.org/wiki/DNS_over_TLS
Source
reference=(reference : String | Nil)

rule.reference

Reference URL to additional information about the rule used to generate this event.

The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.

Level: Extended Type: Keyword Example:

https://en.wikipedia.org/wiki/DNS_over_TLS
Source
ruleset(new_value : String)

A chainable setter for ruleset

Source
ruleset

rule.ruleset

Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.

Level: Extended Type: Keyword Example:

Standard_Protocol_Filters
Source
ruleset=(ruleset : String | Nil)

rule.ruleset

Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.

Level: Extended Type: Keyword Example:

Standard_Protocol_Filters
Source
uuid(new_value : String)

A chainable setter for uuid

Source
uuid

rule.uuid

A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.

Level: Extended Type: Keyword Example:

1100110011
Source
uuid=(uuid : String | Nil)

rule.uuid

A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.

Level: Extended Type: Keyword Example:

1100110011
Source
version(new_value : String)

A chainable setter for version

Source
version

rule.version

The version / revision of the rule being used for analysis.

Level: Extended Type: Keyword Example:

1.1
Source
version=(version : String | Nil)

rule.version

The version / revision of the rule being used for analysis.

Level: Extended Type: Keyword Example:

1.1
Source