Enum DecodedEvent 

pub enum DecodedEvent {
    ProcessStart(ProcessStartEvent),
    ProcessEnd(ProcessEndEvent),
    ImageLoad(ImageLoadEvent),
    ImageUnload(ImageUnloadEvent),
    Tcp(TcpEvent),
    Registry(RegistryEvent),
    FileIo(FileIoEvent),
    Generic(Vec<EventField>),
    Unknown,
}

A decoded ETW event with typed fields.

Variants

ProcessStart(ProcessStartEvent)

Process start event (opcode 1).

ProcessEnd(ProcessEndEvent)

Process end event (opcode 2).

ImageLoad(ImageLoadEvent)

Image load event (opcode 10).

ImageUnload(ImageUnloadEvent)

Image unload event (opcode 2).

Tcp(TcpEvent)

TCP/IP kernel event.

Registry(RegistryEvent)

Registry kernel event.

FileIo(FileIoEvent)

File I/O kernel event.

Generic(Vec<EventField>)

Generic schema-decoded fields (typically from TDH parsing).

Unknown

Event was not recognized by the direct decoders.

Trait Implementations

impl Clone for DecodedEvent

fn clone(&self) -> DecodedEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DecodedEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.