rules

type ActionStats struct {
	ActionsExecuted uint64
	ActionsSuccess  uint64
	ActionsFailed   uint64
	IPsBlocked      uint64
	// contains filtered or unexported fields
}

type AlertWriter interface {
	WriteAlert(alert *types.Alert) error
	Close() error
}

type Config struct {
	Description string  `yaml:"description"`
	Rules       []*Rule `yaml:"rules"`
}

type EmbeddedRuleSetInfo struct {
	Name        string
	Description string
	RuleCount   int
}

type Engine struct {
	// contains filtered or unexported fields
}

type FileAlertWriter struct {
	// contains filtered or unexported fields
}

type ResponseAction struct {
	// Type is the action type (iptables_block, iptables_reject, iptables_rate_limit, iptables_log)
	Type string `yaml:"type"`

	// Config contains action-specific configuration
	Config map[string]any `yaml:"config,omitempty"`

	// Enabled allows disabling specific actions (default: true if omitted)
	Enabled *bool `yaml:"enabled,omitempty"`
}

type Rule struct {
	// Name is a unique identifier for the rule
	Name string `yaml:"name"`

	// Description provides human-readable information about the rule
	Description string `yaml:"description"`

	// Type specifies which audit record type this rule applies to (e.g., "TCP", "HTTP")
	Type string `yaml:"type"`

	// Expression is the expr-lang expression to evaluate
	Expression string `yaml:"expression"`

	// Severity indicates the importance of alerts generated by this rule
	// Valid values: low, medium, high, critical
	Severity string `yaml:"severity"`

	// MITRE contains MITRE ATT&CK technique IDs associated with this rule
	MITRE []string `yaml:"mitre"`

	// Tags are custom labels for categorizing rules
	Tags []string `yaml:"tags"`

	// Enabled determines whether this rule is active
	Enabled bool `yaml:"enabled"`

	// Threshold is the number of times this rule must match before triggering an alert
	// If 0 or 1, alert is triggered immediately on first match (default behavior)
	Threshold int `yaml:"threshold,omitempty"`

	// ThresholdWindow is the time window (in seconds) within which the threshold must be reached
	// Only applicable when Threshold > 1. Default is 60 seconds (1 minute)
	ThresholdWindow int `yaml:"threshold_window,omitempty"`

	// Actions are response actions to execute when this rule matches and generates an alert.
	// These are automated responses like blocking IPs via iptables.
	Actions []*ResponseAction `yaml:"actions,omitempty"`
	// contains filtered or unexported fields
}