rules

type AllOf struct {
	Field    string `yaml:"field"`
	Operator string `yaml:"operator"`
	Value    string `yaml:"value"`
}

type Cache struct {
	AllOf     []AllOf      `yaml:"allOf"`
	OneOf     []OneOf      `yaml:"oneOf"`
	TimeLapse int64        `yaml:"timeLapse"`
	MinCount  int          `yaml:"minCount"`
	Save      []SavedField `yaml:"save"`
}

type OneOf struct {
	Field    string `yaml:"field"`
	Operator string `yaml:"operator"`
	Value    string `yaml:"value"`
}

type Rule struct {
	Name        string   `yaml:"name"`
	Severity    string   `yaml:"severity"`
	Description string   `yaml:"description"`
	Solution    string   `yaml:"solution"`
	Category    string   `yaml:"category"`
	Tactic      string   `yaml:"tactic"`
	DataTypes   []string `yaml:"dataTypes"`
	Reference   []string `yaml:"reference"`
	Frequency   int64    `yaml:"frequency"`
	Cache       []Cache  `yaml:"cache"`
	Search      []Search `yaml:"search"`
}

type SavedField struct {
	Field string `yaml:"field"`
	Alias string `yaml:"alias"`
}

type Search struct {
	Query    string       `yaml:"query"`
	MinCount int          `yaml:"minCount"`
	Save     []SavedField `yaml:"save"`
}