Struct NativeEventTechnique 

#[non_exhaustive]
pub struct NativeEventTechnique {
    pub event_id: u32,
    pub logon_type: Option<u32>,
    pub technique: &'static str,
    pub tactic: &'static str,
    pub description: &'static str,
}

A native event signature mapped to the ATT&CK technique it is consistent with. logon_type == None matches any logon type (or events that have none).

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

event_id: u32

Windows event ID, e.g. 4624, 7045.

logon_type: Option<u32>

Required logon type (e.g. 10 = RemoteInteractive/RDP), or None for any.

technique: &'static str

ATT&CK technique ID, e.g. "T1021.001".

tactic: &'static str

ATT&CK tactic in lowercase snake form, e.g. "initial_access".

description: &'static str

Short forensic description of the signature.

Trait Implementations

impl Clone for NativeEventTechnique

fn clone(&self) -> NativeEventTechnique

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for NativeEventTechnique

impl Debug for NativeEventTechnique

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for NativeEventTechnique

impl PartialEq for NativeEventTechnique

fn eq(&self, other: &NativeEventTechnique) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for NativeEventTechnique