Struct Behavior 

pub struct Behavior {
    pub common: CommonProperties,
    pub name: Behavior,
    pub description: Option<String>,
    pub timestamp: Option<DateTime<Utc>>,
    pub attributes: Option<HashMap<String, Value>>,
    pub action_refs: Vec<String>,
    pub technique_refs: Vec<ExternalReference>,
}

MAEC Behavior

A Behavior corresponds to the specific purpose behind a particular snippet of code, as executed by a malware instance. Examples include keylogging, detecting a virtual machine, and installing a backdoor.

Fields

common: CommonProperties

Common MAEC properties

name: Behavior

Name of the behavior

description: Option<String>

Textual description

timestamp: Option<DateTime<Utc>>

Timestamp when the behavior occurred/was observed

attributes: Option<HashMap<String, Value>>

Behavior attributes as key/value pairs

action_refs: Vec<String>

References to actions implementing this behavior

technique_refs: Vec<ExternalReference>

References to techniques used (ATT&CK, etc.)

Implementations

impl Behavior

pub fn builder() -> BehaviorBuilder

Creates a new Behavior builder

pub fn new(name: Behavior) -> Self

Creates a minimal Behavior with just a name

pub fn validate(&self) -> Result<()>

Validates the Behavior structure

Trait Implementations

impl Clone for Behavior

fn clone(&self) -> Behavior

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Behavior

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Behavior

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl MaecObject for Behavior

fn id(&self) -> &str

Returns the unique identifier of the object

fn type_(&self) -> &str

Returns the type of the MAEC object (e.g., “package”, “malware-family”)

fn created(&self) -> DateTime<Utc>

Returns when the object was created

impl PartialEq for Behavior

fn eq(&self, other: &Behavior) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Behavior

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Behavior