Struct ProcessActivity 

pub struct ProcessActivity {

    pub class_uid: u16,
    pub category_uid: u8,
    pub type_uid: u32,
    pub activity_id: u8,
    pub activity_name: Option<String>,
    pub time: i64,
    pub severity_id: u8,
    pub severity: Option<String>,
    pub status_id: u8,
    pub status: Option<String>,
    pub message: Option<String>,
    pub metadata: Metadata,
    pub process: OcsfProcess,
    pub actor: Option<Actor>,
    pub unmapped: Option<Value>,
}

OCSF Process Activity event (class_uid = 1007).

Fields

class_uid: u16

Always 1007.

category_uid: u8

Always 1 (System Activity).

type_uid: u32

class_uid * 100 + activity_id.

activity_id: u8

Activity ID.

activity_name: Option<String>

Human-readable activity name.

time: i64

Event time as epoch milliseconds.

severity_id: u8

Severity ID (0-6, 99).

severity: Option<String>

Human-readable severity label.

status_id: u8

Status ID (0=Unknown, 1=Success, 2=Failure).

status: Option<String>

Human-readable status label.

message: Option<String>

Human-readable event message.

metadata: Metadata

Metadata (required).

process: OcsfProcess

The process (required).

actor: Option<Actor>

Actor who initiated the process activity.

unmapped: Option<Value>

Vendor-specific unmapped data.

Implementations

impl ProcessActivity

pub fn new( activity: ProcessActivityType, time: i64, severity_id: u8, status_id: u8, metadata: Metadata, process: OcsfProcess, ) -> Self

Create a new Process Activity event with required fields.

pub fn with_message(self, msg: impl Into<String>) -> Self

Set the event message.

pub fn with_actor(self, actor: Actor) -> Self

Set the actor.

pub fn with_unmapped(self, unmapped: Value) -> Self

Set unmapped vendor data.

Trait Implementations

impl Clone for ProcessActivity

fn clone(&self) -> ProcessActivity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProcessActivity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ProcessActivity

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for ProcessActivity

fn eq(&self, other: &ProcessActivity) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ProcessActivity

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ProcessActivity