Struct NetworkActivity 

pub struct NetworkActivity {

    pub class_uid: u16,
    pub category_uid: u8,
    pub type_uid: u32,
    pub activity_id: u8,
    pub activity_name: Option<String>,
    pub time: i64,
    pub severity_id: u8,
    pub severity: Option<String>,
    pub status_id: u8,
    pub status: Option<String>,
    pub message: Option<String>,
    pub metadata: Metadata,
    pub src_endpoint: Option<NetworkEndpoint>,
    pub dst_endpoint: Option<NetworkEndpoint>,
    pub connection_info: Option<ConnectionInfo>,
    pub actor: Option<Actor>,
    pub action_id: Option<u8>,
    pub disposition_id: Option<u8>,
    pub unmapped: Option<Value>,
}

OCSF Network Activity event (class_uid = 4001).

Fields

class_uid: u16

Always 4001.

category_uid: u8

Always 4 (Network Activity).

type_uid: u32

class_uid * 100 + activity_id.

activity_id: u8

Activity ID.

activity_name: Option<String>

Human-readable activity name.

time: i64

Event time as epoch milliseconds.

severity_id: u8

Severity ID (0-6, 99).

severity: Option<String>

Human-readable severity label.

status_id: u8

Status ID (0=Unknown, 1=Success, 2=Failure).

status: Option<String>

Human-readable status label.

message: Option<String>

Human-readable event message.

metadata: Metadata

Metadata (required).

src_endpoint: Option<NetworkEndpoint>

Source endpoint.

dst_endpoint: Option<NetworkEndpoint>

Destination endpoint.

connection_info: Option<ConnectionInfo>

Connection info.

actor: Option<Actor>

Actor who initiated the network activity.

action_id: Option<u8>

Action ID (1=Allowed, 2=Denied).

disposition_id: Option<u8>

Disposition ID.

unmapped: Option<Value>

Vendor-specific unmapped data.

Implementations

impl NetworkActivity

pub fn new( activity: NetworkActivityType, time: i64, severity_id: u8, status_id: u8, metadata: Metadata, ) -> Self

Create a new Network Activity event with required fields.

pub fn with_src_endpoint(self, ep: NetworkEndpoint) -> Self

Set the source endpoint.

pub fn with_dst_endpoint(self, ep: NetworkEndpoint) -> Self

Set the destination endpoint.

pub fn with_connection_info(self, ci: ConnectionInfo) -> Self

Set connection info.

pub fn with_message(self, msg: impl Into<String>) -> Self

Set the event message.

pub fn with_actor(self, actor: Actor) -> Self

Set the actor.

pub fn with_action_id(self, action_id: u8) -> Self

Set action ID.

pub fn with_disposition_id(self, disposition_id: u8) -> Self

Set disposition ID.

Trait Implementations

impl Clone for NetworkActivity

fn clone(&self) -> NetworkActivity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NetworkActivity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for NetworkActivity

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for NetworkActivity

fn eq(&self, other: &NetworkActivity) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for NetworkActivity

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for NetworkActivity