ocsf_schema_rs

Struct RdpActivity

Source 
pub struct RdpActivity {
Show 65 fields
    pub action: Option<String>,
    pub action_id: RdpActivityActionId,
    pub activity_id: RdpActivityActivityId,
    pub activity_name: Option<String>,
    pub actor: Option<Actor>,
    pub api: Option<Api>,
    pub app_name: Option<String>,
    pub attacks: Vec<Attack>,
    pub authorizations: Vec<Authorization>,
    pub capabilities: Vec<String>,
    pub category_name: Option<String>,
    pub category_uid: i64,
    pub certificate_chain: Vec<String>,
    pub class_name: Option<String>,
    pub class_uid: i64,
    pub cloud: Cloud,
    pub connection_info: Option<NetworkConnectionInfo>,
    pub count: Option<i64>,
    pub device: Option<Device>,
    pub disposition: Option<String>,
    pub disposition_id: Option<RdpActivityDispositionId>,
    pub dst_endpoint: NetworkEndpoint,
    pub duration: Option<i64>,
    pub end_time: Option<i64>,
    pub end_time_dt: Option<String>,
    pub enrichments: Vec<Enrichment>,
    pub file: Option<File>,
    pub firewall_rule: Option<FirewallRule>,
    pub identifier_cookie: Option<String>,
    pub ja4_fingerprint_list: Vec<Ja4Fingerprint>,
    pub load_balancer: Option<LoadBalancer>,
    pub malware: Vec<Malware>,
    pub message: Option<String>,
    pub metadata: Metadata,
    pub observables: Vec<Observable>,
    pub osint: Vec<Osint>,
    pub protocol_ver: Option<String>,
    pub proxy: Option<NetworkProxy>,
    pub proxy_connection_info: Option<NetworkConnectionInfo>,
    pub proxy_endpoint: Option<NetworkProxy>,
    pub proxy_http_request: Option<HttpRequest>,
    pub proxy_http_response: Option<HttpResponse>,
    pub proxy_tls: Option<Tls>,
    pub proxy_traffic: Option<NetworkTraffic>,
    pub raw_data: Option<String>,
    pub remote_display: Option<Display>,
    pub request: Option<Request>,
    pub response: Option<Response>,
    pub severity: Option<String>,
    pub severity_id: RdpActivitySeverityId,
    pub src_endpoint: Option<NetworkEndpoint>,
    pub start_time: Option<i64>,
    pub start_time_dt: Option<String>,
    pub status: Option<String>,
    pub status_code: Option<String>,
    pub status_detail: Option<String>,
    pub status_id: Option<RdpActivityStatusId>,
    pub time: i64,
    pub time_dt: Option<String>,
    pub timezone_offset: Option<i64>,
    pub tls: Option<Tls>,
    pub traffic: Option<NetworkTraffic>,
    pub type_name: Option<String>,
    pub type_uid: i64,
    pub unmapped: Option<Object>,

}
Expand description

RdpActivity

JSON schema 
{
 "$id": "https://schema.ocsf.io/schema/classes/rdp_activity",
 "type": "object",
 "required": [
   "action_id",
   "activity_id",
   "category_uid",
   "class_uid",
   "cloud",
   "dst_endpoint",
   "metadata",
   "osint",
   "severity_id",
   "time",
   "type_uid"
 ],
 "properties": {
   "action": {
     "type": "string"
   },
   "action_id": {
     "type": "integer",
     "enum": [
       0,
       1,
       2,
       99
     ]
   },
   "activity_id": {
     "type": "integer",
     "enum": [
       3,
       6,
       0,
       1,
       2,
       99,
       4,
       5
     ]
   },
   "activity_name": {
     "type": "string"
   },
   "actor": {
     "$ref": "#/$defs/actor"
   },
   "api": {
     "$ref": "#/$defs/api"
   },
   "app_name": {
     "type": "string"
   },
   "attacks": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/attack"
     }
   },
   "authorizations": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/authorization"
     }
   },
   "capabilities": {
     "type": "array",
     "items": {
       "type": "string"
     }
   },
   "category_name": {
     "type": "string"
   },
   "category_uid": {
     "type": "integer",
     "const": 4
   },
   "certificate_chain": {
     "type": "array",
     "items": {
       "type": "string"
     }
   },
   "class_name": {
     "type": "string"
   },
   "class_uid": {
     "type": "integer",
     "const": 4005
   },
   "cloud": {
     "$ref": "#/$defs/cloud"
   },
   "connection_info": {
     "$ref": "#/$defs/network_connection_info"
   },
   "count": {
     "type": "integer"
   },
   "device": {
     "$ref": "#/$defs/device"
   },
   "disposition": {
     "type": "string"
   },
   "disposition_id": {
     "type": "integer",
     "enum": [
       3,
       6,
       0,
       1,
       2,
       99,
       4,
       5,
       7,
       8,
       9,
       10,
       11,
       14,
       15,
       16,
       17,
       18,
       20,
       21,
       22,
       23,
       24,
       25,
       26,
       27,
       12,
       13,
       19
     ]
   },
   "dst_endpoint": {
     "$ref": "#/$defs/network_endpoint"
   },
   "duration": {
     "type": "integer"
   },
   "end_time": {
     "type": "integer"
   },
   "end_time_dt": {
     "type": "string"
   },
   "enrichments": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/enrichment"
     }
   },
   "file": {
     "$ref": "#/$defs/file"
   },
   "firewall_rule": {
     "$ref": "#/$defs/firewall_rule"
   },
   "identifier_cookie": {
     "type": "string"
   },
   "ja4_fingerprint_list": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/ja4_fingerprint"
     }
   },
   "load_balancer": {
     "$ref": "#/$defs/load_balancer"
   },
   "malware": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/malware"
     }
   },
   "message": {
     "type": "string"
   },
   "metadata": {
     "$ref": "#/$defs/metadata"
   },
   "observables": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/observable"
     }
   },
   "osint": {
     "type": "array",
     "items": {
       "$ref": "#/$defs/osint"
     }
   },
   "protocol_ver": {
     "type": "string"
   },
   "proxy": {
     "$ref": "#/$defs/network_proxy"
   },
   "proxy_connection_info": {
     "$ref": "#/$defs/network_connection_info"
   },
   "proxy_endpoint": {
     "$ref": "#/$defs/network_proxy"
   },
   "proxy_http_request": {
     "$ref": "#/$defs/http_request"
   },
   "proxy_http_response": {
     "$ref": "#/$defs/http_response"
   },
   "proxy_tls": {
     "$ref": "#/$defs/tls"
   },
   "proxy_traffic": {
     "$ref": "#/$defs/network_traffic"
   },
   "raw_data": {
     "type": "string"
   },
   "remote_display": {
     "$ref": "#/$defs/display"
   },
   "request": {
     "$ref": "#/$defs/request"
   },
   "response": {
     "$ref": "#/$defs/response"
   },
   "severity": {
     "type": "string"
   },
   "severity_id": {
     "type": "integer",
     "enum": [
       3,
       6,
       0,
       1,
       2,
       99,
       4,
       5
     ]
   },
   "src_endpoint": {
     "$ref": "#/$defs/network_endpoint"
   },
   "start_time": {
     "type": "integer"
   },
   "start_time_dt": {
     "type": "string"
   },
   "status": {
     "type": "string"
   },
   "status_code": {
     "type": "string"
   },
   "status_detail": {
     "type": "string"
   },
   "status_id": {
     "type": "integer",
     "enum": [
       0,
       1,
       2,
       99
     ]
   },
   "time": {
     "type": "integer"
   },
   "time_dt": {
     "type": "string"
   },
   "timezone_offset": {
     "type": "integer"
   },
   "tls": {
     "$ref": "#/$defs/tls"
   },
   "traffic": {
     "$ref": "#/$defs/network_traffic"
   },
   "type_name": {
     "type": "string"
   },
   "type_uid": {
     "type": "integer"
   },
   "unmapped": {
     "$ref": "#/$defs/object"
   }
 },
 "$schema": "http://json-schema.org/draft-07/schema#"
}

Fields§

§action: Option<String>§action_id: RdpActivityActionId§activity_id: RdpActivityActivityId§activity_name: Option<String>§actor: Option<Actor>§api: Option<Api>§app_name: Option<String>§attacks: Vec<Attack>§authorizations: Vec<Authorization>§capabilities: Vec<String>§category_name: Option<String>§category_uid: i64§certificate_chain: Vec<String>§class_name: Option<String>§class_uid: i64§cloud: Cloud§connection_info: Option<NetworkConnectionInfo>§count: Option<i64>§device: Option<Device>§disposition: Option<String>§disposition_id: Option<RdpActivityDispositionId>§dst_endpoint: NetworkEndpoint§duration: Option<i64>§end_time: Option<i64>§end_time_dt: Option<String>§enrichments: Vec<Enrichment>§file: Option<File>§firewall_rule: Option<FirewallRule>§identifier_cookie: Option<String>§ja4_fingerprint_list: Vec<Ja4Fingerprint>§load_balancer: Option<LoadBalancer>§malware: Vec<Malware>§message: Option<String>§metadata: Metadata§observables: Vec<Observable>§osint: Vec<Osint>§protocol_ver: Option<String>§proxy: Option<NetworkProxy>§proxy_connection_info: Option<NetworkConnectionInfo>§proxy_endpoint: Option<NetworkProxy>§proxy_http_request: Option<HttpRequest>§proxy_http_response: Option<HttpResponse>§proxy_tls: Option<Tls>§proxy_traffic: Option<NetworkTraffic>§raw_data: Option<String>§remote_display: Option<Display>§request: Option<Request>§response: Option<Response>§severity: Option<String>§severity_id: RdpActivitySeverityId§src_endpoint: Option<NetworkEndpoint>§start_time: Option<i64>§start_time_dt: Option<String>§status: Option<String>§status_code: Option<String>§status_detail: Option<String>§status_id: Option<RdpActivityStatusId>§time: i64§time_dt: Option<String>§timezone_offset: Option<i64>§tls: Option<Tls>§traffic: Option<NetworkTraffic>§type_name: Option<String>§type_uid: i64§unmapped: Option<Object>

Implementations§

Trait Implementations§

Source§

impl Clone for RdpActivity

Source§

fn clone(&self) -> RdpActivity

Returns a duplicate of the value. Read more
1.0.0 · Source§

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more
Source§

impl Debug for RdpActivity

Source§

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more
Source§

impl<'de> Deserialize<'de> for RdpActivity

Source§

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>
where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer. Read more
Source§

impl From<&RdpActivity> for RdpActivity

Source§

fn from(value: &RdpActivity) -> Self

Converts to this type from the input type.
Source§

impl From<RdpActivity> for RdpActivity

Source§

fn from(value: RdpActivity) -> Self

Converts to this type from the input type.
Source§

impl Serialize for RdpActivity

Source§

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>
where __S: Serializer,

Serialize this value into the given Serde serializer. Read more
Source§

impl TryFrom<RdpActivity> for RdpActivity

Source§

type Error = ConversionError

The type returned in the event of a conversion error.
Source§

fn try_from(value: RdpActivity) -> Result<Self, ConversionError>

Performs the conversion.

Auto Trait Implementations§

Blanket Implementations§

Source§

impl<T> Any for T
where T: 'static + ?Sized,

Source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
Source§

impl<T> Borrow<T> for T
where T: ?Sized,

Source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
Source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
Source§

impl<T> CloneToUninit for T
where T: Clone,

Source§

unsafe fn clone_to_uninit(&self, dest: *mut u8)

🔬This is a nightly-only experimental API. (clone_to_uninit)
Performs copy-assignment from self to dest. Read more
Source§

impl<T> DynClone for T
where T: Clone,

Source§

fn __clone_box(&self, _: Private) -> *mut ()

Source§

impl<T> From<T> for T

Source§

fn from(t: T) -> T

Returns the argument unchanged.

Source§

impl<T, U> Into<U> for T
where U: From<T>,

Source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source§

impl<T> ToOwned for T
where T: Clone,

Source§

type Owned = T

The resulting type after obtaining ownership.
Source§

fn to_owned(&self) -> T

Creates owned data from borrowed data, usually by cloning. Read more
Source§

fn clone_into(&self, target: &mut T)

Uses borrowed data to replace owned data, usually by cloning. Read more
Source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

Source§

type Error = Infallible

The type returned in the event of a conversion error.
Source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
Source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

Source§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
Source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.
Source§

impl<T> DeserializeOwned for T
where T: for<'de> Deserialize<'de>,