Struct assemblyline_models::datastore::alert::Alert

pub struct Alert {

    pub alert_id: String,
    pub al: ALResults,
    pub attack: Attack,
    pub classification: String,
    pub expiry_ts: Option<DateTime<Utc>>,
    pub extended_scan: ExtendedScanValues,
    pub file: File,
    pub filtered: bool,
    pub heuristic: Heuristic,
    pub label: Vec<String>,
    pub metadata: HashMap<String, String>,
    pub owner: Option<String>,
    pub priority: Option<Priorities>,
    pub reporting_ts: DateTime<Utc>,
    pub sid: String,
    pub status: Option<Statuses>,
    pub ts: DateTime<Utc>,
    pub alert_type: String,
    pub verdict: Verdict,
    pub events: Vec<Event>,
    pub workflows_completed: bool,
}

Model for Alerts

Fields

alert_id: String

ID of the alert

al: ALResults

Assemblyline Result Block

attack: Attack

ATT&CK Block

classification: String

Classification of the alert

expiry_ts: Option<DateTime<Utc>>

Expiry timestamp

extended_scan: ExtendedScanValues

Status of the extended scan

file: File

File Block

filtered: bool

Are the alert results filtered?

heuristic: Heuristic

Heuristic Block

label: Vec<String>

List of labels applied to the alert

metadata: HashMap<String, String>

Metadata submitted with the file

owner: Option<String>

Owner of the alert

priority: Option<Priorities>

Priority applied to the alert

reporting_ts: DateTime<Utc>

Alert creation timestamp

sid: String

Submission ID related to this alert

status: Option<Statuses>

Status applied to the alert

ts: DateTime<Utc>

File submission timestamp

alert_type: String

Type of alert

verdict: Verdict

Verdict Block

events: Vec<Event>

An audit of events applied to alert

workflows_completed: bool

Have all workflows ran on this alert?

Trait Implementations

impl Described<ElasticMeta> for Alert

fn metadata() -> Descriptor<ElasticMeta>

Get self description of this type

impl<'de> Deserialize<'de> for Alert

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Alert

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.