stix_ffi/lib.rs
1//! FFI-friendly facade over the stix toolkit.
2//!
3//! Pure Rust (no FFI macros). The language bindings each wrap this surface:
4//! an [`Engine`] parses patterns and bundles into opaque [`Pattern`]/[`Bundle`]
5//! handles and runs matches, returning a [`MatchOutcome`]; deep structure (the AST,
6//! object properties) crosses as JSON.
7//!
8//! ```
9//! use stix_ffi::Engine;
10//!
11//! let engine = Engine::new();
12//! let pattern = engine.parse_pattern("[ipv4-addr:value = '198.51.100.5']").unwrap();
13//! let bundle = engine.parse_bundle(r#"{"type":"bundle","objects":[
14//! {"type":"ipv4-addr","id":"ipv4-addr--1","value":"198.51.100.5"},
15//! {"type":"observed-data","id":"observed-data--1",
16//! "first_observed":"2020-01-01T00:00:00Z","last_observed":"2020-01-01T00:00:00Z",
17//! "number_observed":1,"object_refs":["ipv4-addr--1"]}
18//! ]}"#).unwrap();
19//! assert!(engine.match_bundle(&pattern, &bundle).unwrap().matched);
20//! ```
21
22#![warn(missing_docs)]
23
24pub mod engine;
25pub mod error;
26pub mod handles;
27
28pub use engine::Engine;
29pub use error::{ErrorCode, FfiError};
30pub use handles::{Bundle, MatchOutcome, Pattern};