Struct KernelObjectQuery

pub struct KernelObjectQuery {

    pub activity_id: KernelObjectQueryActivityId,
    pub activity_name: Option<String>,
    pub actor: Option<Actor>,
    pub api: Option<Api>,
    pub category_name: Option<String>,
    pub category_uid: i64,
    pub class_name: Option<String>,
    pub class_uid: i64,
    pub cloud: Cloud,
    pub count: Option<i64>,
    pub device: Option<Device>,
    pub duration: Option<i64>,
    pub end_time: Option<i64>,
    pub end_time_dt: Option<String>,
    pub enrichments: Vec<Enrichment>,
    pub kernel: Kernel,
    pub message: Option<String>,
    pub metadata: Metadata,
    pub observables: Vec<Observable>,
    pub osint: Vec<Osint>,
    pub query_info: Option<QueryInfo>,
    pub query_result: Option<String>,
    pub query_result_id: KernelObjectQueryQueryResultId,
    pub raw_data: Option<String>,
    pub severity: Option<String>,
    pub severity_id: KernelObjectQuerySeverityId,
    pub start_time: Option<i64>,
    pub start_time_dt: Option<String>,
    pub status: Option<String>,
    pub status_code: Option<String>,
    pub status_detail: Option<String>,
    pub status_id: Option<KernelObjectQueryStatusId>,
    pub time: i64,
    pub time_dt: Option<String>,
    pub timezone_offset: Option<i64>,
    pub type_name: Option<String>,
    pub type_uid: i64,
    pub unmapped: Option<Object>,
}

KernelObjectQuery

JSON schema

{
 "$id": "https://schema.ocsf.io/schema/classes/kernel_object_query",
 "type": "object",
 "required": [
   "activity_id",
   "category_uid",
   "class_uid",
   "cloud",
   "kernel",
   "metadata",
   "osint",
   "query_result_id",
   "severity_id",
   "time",
   "type_uid"
 ],
 "properties": {
   "activity_id": {
     "type": "integer",
     "enum": [
       0,
       1,
       99
     ]
   },
   "activity_name": {
     "type": "string"
   },
   "actor": {
     "$ref": "#/$defs/actor"
   },
   "api": {
     "$ref": "#/$defs/api"
   },
   "category_name": {
     "type": "string"
   },
   "category_uid": {
     "type": "integer",
     "const": 5
   },
   "class_name": {
     "type": "string"
   },
   "class_uid": {
     "type": "integer",
     "const": 5006
   },
   "cloud": {
     "$ref": "#/$defs/cloud"
   },
   "count": {
     "type": "integer"
   },
   "device": {
     "$ref": "#/$defs/device"
   },
   "duration": {
     "type": "integer"
   },
   "end_time": {
     "type": "integer"
   },
   "end_time_dt": {
     "type": "string"
   },
   "enrichments": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/enrichment"
     }
   },
   "kernel": {
     "$ref": "#/$defs/kernel"
   },
   "message": {
     "type": "string"
   },
   "metadata": {
     "$ref": "#/$defs/metadata"
   },
   "observables": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/observable"
     }
   },
   "osint": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/osint"
     }
   },
   "query_info": {
     "$ref": "#/$defs/query_info"
   },
   "query_result": {
     "type": "string"
   },
   "query_result_id": {
     "type": "integer",
     "enum": [
       3,
       0,
       1,
       2,
       99,
       4,
       5
     ]
   },
   "raw_data": {
     "type": "string"
   },
   "severity": {
     "type": "string"
   },
   "severity_id": {
     "type": "integer",
     "enum": [
       3,
       6,
       0,
       1,
       2,
       99,
       4,
       5
     ]
   },
   "start_time": {
     "type": "integer"
   },
   "start_time_dt": {
     "type": "string"
   },
   "status": {
     "type": "string"
   },
   "status_code": {
     "type": "string"
   },
   "status_detail": {
     "type": "string"
   },
   "status_id": {
     "type": "integer",
     "enum": [
       0,
       1,
       2,
       99
     ]
   },
   "time": {
     "type": "integer"
   },
   "time_dt": {
     "type": "string"
   },
   "timezone_offset": {
     "type": "integer"
   },
   "type_name": {
     "type": "string"
   },
   "type_uid": {
     "type": "integer"
   },
   "unmapped": {
     "$ref": "#/$defs/object"
   }
 },
 "$schema": "http://json-schema.org/draft-07/schema#"
}

Fields

activity_id: KernelObjectQueryActivityId

activity_name: Option<String>

actor: Option<Actor>

api: Option<Api>

category_name: Option<String>

category_uid: i64

class_name: Option<String>

class_uid: i64

cloud: Cloud

count: Option<i64>

device: Option<Device>

duration: Option<i64>

end_time: Option<i64>

end_time_dt: Option<String>

enrichments: Vec<Enrichment>

kernel: Kernel

message: Option<String>

metadata: Metadata

observables: Vec<Observable>

osint: Vec<Osint>

query_info: Option<QueryInfo>

query_result: Option<String>

query_result_id: KernelObjectQueryQueryResultId

raw_data: Option<String>

severity: Option<String>

severity_id: KernelObjectQuerySeverityId

start_time: Option<i64>

start_time_dt: Option<String>

status: Option<String>

status_code: Option<String>

status_detail: Option<String>

status_id: Option<KernelObjectQueryStatusId>

time: i64

time_dt: Option<String>

timezone_offset: Option<i64>

type_name: Option<String>

type_uid: i64

unmapped: Option<Object>

Implementations

impl KernelObjectQuery

pub fn builder() -> KernelObjectQuery

Trait Implementations

impl Clone for KernelObjectQuery

fn clone(&self) -> KernelObjectQuery

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KernelObjectQuery

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for KernelObjectQuery

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl From<&KernelObjectQuery> for KernelObjectQuery

fn from(value: &KernelObjectQuery) -> Self

Converts to this type from the input type.

impl From<KernelObjectQuery> for KernelObjectQuery

fn from(value: KernelObjectQuery) -> Self

Converts to this type from the input type.

impl Serialize for KernelObjectQuery

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl TryFrom<KernelObjectQuery> for KernelObjectQuery

type Error = ConversionError

The type returned in the event of a conversion error.

fn try_from(value: KernelObjectQuery) -> Result<Self, ConversionError>

Performs the conversion.