Struct KernelActivity

pub struct KernelActivity {

    pub action: Option<String>,
    pub action_id: KernelActivityActionId,
    pub activity_id: KernelActivityActivityId,
    pub activity_name: Option<String>,
    pub actor: Actor,
    pub api: Option<Api>,
    pub attacks: Vec<Attack>,
    pub authorizations: Vec<Authorization>,
    pub category_name: Option<String>,
    pub category_uid: i64,
    pub class_name: Option<String>,
    pub class_uid: i64,
    pub cloud: Cloud,
    pub count: Option<i64>,
    pub device: Device,
    pub disposition: Option<String>,
    pub disposition_id: Option<KernelActivityDispositionId>,
    pub duration: Option<i64>,
    pub end_time: Option<i64>,
    pub end_time_dt: Option<String>,
    pub enrichments: Vec<Enrichment>,
    pub firewall_rule: Option<FirewallRule>,
    pub kernel: Kernel,
    pub malware: Vec<Malware>,
    pub message: Option<String>,
    pub metadata: Metadata,
    pub observables: Vec<Observable>,
    pub osint: Vec<Osint>,
    pub raw_data: Option<String>,
    pub severity: Option<String>,
    pub severity_id: KernelActivitySeverityId,
    pub start_time: Option<i64>,
    pub start_time_dt: Option<String>,
    pub status: Option<String>,
    pub status_code: Option<String>,
    pub status_detail: Option<String>,
    pub status_id: Option<KernelActivityStatusId>,
    pub time: i64,
    pub time_dt: Option<String>,
    pub timezone_offset: Option<i64>,
    pub type_name: Option<String>,
    pub type_uid: i64,
    pub unmapped: Option<Object>,
}

KernelActivity

JSON schema

{
 "$id": "https://schema.ocsf.io/schema/classes/kernel_activity",
 "type": "object",
 "required": [
   "action_id",
   "activity_id",
   "actor",
   "category_uid",
   "class_uid",
   "cloud",
   "device",
   "kernel",
   "metadata",
   "osint",
   "severity_id",
   "time",
   "type_uid"
 ],
 "properties": {
   "action": {
     "type": "string"
   },
   "action_id": {
     "type": "integer",
     "enum": [
       0,
       1,
       2,
       99
     ]
   },
   "activity_id": {
     "type": "integer",
     "enum": [
       3,
       0,
       1,
       2,
       99,
       4
     ]
   },
   "activity_name": {
     "type": "string"
   },
   "actor": {
     "$ref": "#/$defs/actor"
   },
   "api": {
     "$ref": "#/$defs/api"
   },
   "attacks": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/attack"
     }
   },
   "authorizations": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/authorization"
     }
   },
   "category_name": {
     "type": "string"
   },
   "category_uid": {
     "type": "integer",
     "const": 1
   },
   "class_name": {
     "type": "string"
   },
   "class_uid": {
     "type": "integer",
     "const": 1003
   },
   "cloud": {
     "$ref": "#/$defs/cloud"
   },
   "count": {
     "type": "integer"
   },
   "device": {
     "$ref": "#/$defs/device"
   },
   "disposition": {
     "type": "string"
   },
   "disposition_id": {
     "type": "integer",
     "enum": [
       3,
       6,
       0,
       1,
       2,
       99,
       4,
       5,
       7,
       8,
       9,
       10,
       11,
       14,
       15,
       16,
       17,
       18,
       20,
       21,
       22,
       23,
       24,
       25,
       26,
       27,
       12,
       13,
       19
     ]
   },
   "duration": {
     "type": "integer"
   },
   "end_time": {
     "type": "integer"
   },
   "end_time_dt": {
     "type": "string"
   },
   "enrichments": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/enrichment"
     }
   },
   "firewall_rule": {
     "$ref": "#/$defs/firewall_rule"
   },
   "kernel": {
     "$ref": "#/$defs/kernel"
   },
   "malware": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/malware"
     }
   },
   "message": {
     "type": "string"
   },
   "metadata": {
     "$ref": "#/$defs/metadata"
   },
   "observables": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/observable"
     }
   },
   "osint": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/osint"
     }
   },
   "raw_data": {
     "type": "string"
   },
   "severity": {
     "type": "string"
   },
   "severity_id": {
     "type": "integer",
     "enum": [
       3,
       6,
       0,
       1,
       2,
       99,
       4,
       5
     ]
   },
   "start_time": {
     "type": "integer"
   },
   "start_time_dt": {
     "type": "string"
   },
   "status": {
     "type": "string"
   },
   "status_code": {
     "type": "string"
   },
   "status_detail": {
     "type": "string"
   },
   "status_id": {
     "type": "integer",
     "enum": [
       0,
       1,
       2,
       99
     ]
   },
   "time": {
     "type": "integer"
   },
   "time_dt": {
     "type": "string"
   },
   "timezone_offset": {
     "type": "integer"
   },
   "type_name": {
     "type": "string"
   },
   "type_uid": {
     "type": "integer"
   },
   "unmapped": {
     "$ref": "#/$defs/object"
   }
 },
 "$schema": "http://json-schema.org/draft-07/schema#"
}

Fields

action: Option<String>

action_id: KernelActivityActionId

activity_id: KernelActivityActivityId

activity_name: Option<String>

actor: Actor

api: Option<Api>

attacks: Vec<Attack>

authorizations: Vec<Authorization>

category_name: Option<String>

category_uid: i64

class_name: Option<String>

class_uid: i64

cloud: Cloud

count: Option<i64>

device: Device

disposition: Option<String>

disposition_id: Option<KernelActivityDispositionId>

duration: Option<i64>

end_time: Option<i64>

end_time_dt: Option<String>

enrichments: Vec<Enrichment>

firewall_rule: Option<FirewallRule>

kernel: Kernel

malware: Vec<Malware>

message: Option<String>

metadata: Metadata

observables: Vec<Observable>

osint: Vec<Osint>

raw_data: Option<String>

severity: Option<String>

severity_id: KernelActivitySeverityId

start_time: Option<i64>

start_time_dt: Option<String>

status: Option<String>

status_code: Option<String>

status_detail: Option<String>

status_id: Option<KernelActivityStatusId>

time: i64

time_dt: Option<String>

timezone_offset: Option<i64>

type_name: Option<String>

type_uid: i64

unmapped: Option<Object>

Implementations

impl KernelActivity

pub fn builder() -> KernelActivity

Trait Implementations

impl Clone for KernelActivity

fn clone(&self) -> KernelActivity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KernelActivity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for KernelActivity

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl From<&KernelActivity> for KernelActivity

fn from(value: &KernelActivity) -> Self

Converts to this type from the input type.

impl From<KernelActivity> for KernelActivity

fn from(value: KernelActivity) -> Self

Converts to this type from the input type.

impl Serialize for KernelActivity

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl TryFrom<KernelActivity> for KernelActivity

type Error = ConversionError

The type returned in the event of a conversion error.

fn try_from(value: KernelActivity) -> Result<Self, ConversionError>

Performs the conversion.