| """ | |
| Rule entity — ER Diagram §3.2.6 | |
| Attributes: Rule_ID, embedding_vector, job_ID (FK) | |
| Rule_ID is the Wazuh rule ID string (e.g. "597"). | |
| """ | |
| from sqlalchemy import ForeignKey, String, Text | |
| from sqlalchemy.orm import Mapped, mapped_column, relationship | |
| from app.db.base import Base | |
| class Rule(Base): | |
| __tablename__ = "rules" | |
| rule_id: Mapped[str] = mapped_column(String(50), primary_key=True) | |
| job_id: Mapped[int | None] = mapped_column( | |
| ForeignKey("mapping_jobs.job_id"), nullable=True | |
| ) | |
| # 768-dimensional float vector stored as JSON string; kept nullable for | |
| # rules where only the mapping result is persisted without the vector. | |
| embedding_vector: Mapped[str | None] = mapped_column(Text, nullable=True) | |
| job: Mapped["MappingJob | None"] = relationship(back_populates="rules") | |
| technique_mappings: Mapped[list["RuleTechniqueMapping"]] = relationship( | |
| back_populates="rule", cascade="all, delete-orphan" | |
| ) | |