Skip to content

evaluator

evaluator ¤

Shape-specific evaluators that turn a compiled trigger into a legacy DataFrame in the same format the shape-driven adapter already consumes.

Point and summary rules pass matching rows through; interval rules coalesce contiguous True runs (per group_by) into single rows with start/end/duration; static rules emit a single summary row.

Whatever the shape, the returned frame is fed verbatim to :func:~ts_shape.eventlog.to_event_log, which then exercises the same adapter, EID generation, severity bucketing, object auto-extraction and schema validation as built-in detectors. No parallel pipeline.

evaluate ¤

evaluate(spec: RuleSpec, df: DataFrame) -> pd.DataFrame

Run spec against df and return a legacy-shaped DataFrame.

The output column conventions match what the shape adapter expects:

  • shape="point" | "summary": original rows with a systime-like timestamp column preserved (no renaming).
  • shape="interval": rows with start, end, source_uuid (if grouped), plus value/severity columns averaged over the run.
  • shape="static": a single row carrying summary fields.