Struct FileActivity 

pub struct FileActivity {

    pub class_uid: u16,
    pub category_uid: u8,
    pub type_uid: u32,
    pub activity_id: u8,
    pub activity_name: Option<String>,
    pub time: i64,
    pub severity_id: u8,
    pub severity: Option<String>,
    pub status_id: u8,
    pub status: Option<String>,
    pub message: Option<String>,
    pub metadata: Metadata,
    pub file: OcsfFile,
    pub actor: Option<Actor>,
    pub unmapped: Option<Value>,
}

OCSF File Activity event (class_uid = 1001).

Fields

class_uid: u16

Always 1001.

category_uid: u8

Always 1 (System Activity).

type_uid: u32

class_uid * 100 + activity_id.

activity_id: u8

Activity ID.

activity_name: Option<String>

Human-readable activity name.

time: i64

Event time as epoch milliseconds.

severity_id: u8

Severity ID (0-6, 99).

severity: Option<String>

Human-readable severity label.

status_id: u8

Status ID (0=Unknown, 1=Success, 2=Failure).

status: Option<String>

Human-readable status label.

message: Option<String>

Human-readable event message.

metadata: Metadata

Metadata (required).

file: OcsfFile

The file being accessed (required).

actor: Option<Actor>

Actor performing the file operation.

unmapped: Option<Value>

Vendor-specific unmapped data.

Implementations

impl FileActivity

pub fn new( activity: FileActivityType, time: i64, severity_id: u8, status_id: u8, metadata: Metadata, file: OcsfFile, ) -> Self

Create a new File Activity event with required fields.

pub fn with_message(self, msg: impl Into<String>) -> Self

Set the event message.

pub fn with_actor(self, actor: Actor) -> Self

Set the actor.

Trait Implementations

impl Clone for FileActivity

fn clone(&self) -> FileActivity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FileActivity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for FileActivity

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for FileActivity

fn eq(&self, other: &FileActivity) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for FileActivity

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for FileActivity