""" Rule entity — ER Diagram §3.2.6 Attributes: Rule_ID, embedding_vector, job_ID (FK) Rule_ID is the Wazuh rule ID string (e.g. "597"). """ from sqlalchemy import ForeignKey, String, Text from sqlalchemy.orm import Mapped, mapped_column, relationship from app.db.base import Base class Rule(Base): __tablename__ = "rules" rule_id: Mapped[str] = mapped_column(String(50), primary_key=True) job_id: Mapped[int | None] = mapped_column( ForeignKey("mapping_jobs.job_id"), nullable=True ) # 768-dimensional float vector stored as JSON string; kept nullable for # rules where only the mapping result is persisted without the vector. embedding_vector: Mapped[str | None] = mapped_column(Text, nullable=True) job: Mapped["MappingJob | None"] = relationship(back_populates="rules") technique_mappings: Mapped[list["RuleTechniqueMapping"]] = relationship( back_populates="rule", cascade="all, delete-orphan" )