#[non_exhaustive]pub struct FindingInfo {Show 26 fields
pub analytic: Option<Box<Analytic>>,
pub attack_graph: Option<Box<Graph>>,
pub attacks: Option<Vec<Attack>>,
pub created_time: Option<i64>,
pub created_time_dt: Option<String>,
pub data_sources: Option<Vec<String>>,
pub desc: Option<String>,
pub first_seen_time: Option<i64>,
pub first_seen_time_dt: Option<String>,
pub kill_chain: Option<Vec<KillChainPhase>>,
pub last_seen_time: Option<i64>,
pub last_seen_time_dt: Option<String>,
pub modified_time: Option<i64>,
pub modified_time_dt: Option<String>,
pub product: Option<Box<Product>>,
pub product_uid: Option<String>,
pub related_analytics: Option<Vec<Analytic>>,
pub related_events: Option<Vec<RelatedEvent>>,
pub related_events_count: Option<i64>,
pub src_url: Option<String>,
pub tags: Option<Vec<KeyValueObject>>,
pub title: Option<String>,
pub traits: Option<Vec<Trait>>,
pub types: Option<Vec<String>>,
pub uid: Option<String>,
pub uid_alt: Option<String>,
}Expand description
Finding Information
The Finding Information object describes metadata related to a security finding generated by a security tool or system.
[] Category: | Name: finding_info
Fields (Non-exhaustive)§
This struct is marked as non-exhaustive
Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.analytic: Option<Box<Analytic>>Analytic
The analytic technique used to analyze and derive insights from the data or information that led to the finding or conclusion.
recommended
attack_graph: Option<Box<Graph>>Attack Graph
An Attack Graph describes possible routes an attacker could take through an environment. It describes relationships between resources and their findings, such as malware detections, vulnerabilities, misconfigurations, and other security actions.
optional
attacks: Option<Vec<Attack>>MITRE ATT&CK® and ATLAS™ Details
The MITRE ATT&CK® technique and associated tactics related to the finding.
optional
created_time: Option<i64>Created Time
The time when the finding was created.
optional
created_time_dt: Option<String>Created Time
The time when the finding was created.
optional
data_sources: Option<Vec<String>>Data Sources
A list of data sources utilized in generation of the finding.
optional
desc: Option<String>Description
The description of the reported finding.
optional
first_seen_time: Option<i64>First Seen
The time when the finding was first observed. e.g. The time when a vulnerability was first observed.
It can differ from the created_time timestamp, which reflects the time this finding was created.
optional
first_seen_time_dt: Option<String>First Seen
The time when the finding was first observed. e.g. The time when a vulnerability was first observed.
It can differ from the created_time timestamp, which reflects the time this finding was created.
optional
kill_chain: Option<Vec<KillChainPhase>>Kill Chain
The Cyber Kill Chain® provides a detailed description of each phase and its associated activities within the broader context of a cyber attack.
optional
last_seen_time: Option<i64>Last Seen
The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed.
It can differ from the modified_time timestamp, which reflects the time this finding was last modified.
optional
last_seen_time_dt: Option<String>Last Seen
The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed.
It can differ from the modified_time timestamp, which reflects the time this finding was last modified.
optional
modified_time: Option<i64>Modified Time
The time when the finding was last modified.
optional
modified_time_dt: Option<String>Modified Time
The time when the finding was last modified.
optional
product: Option<Box<Product>>Product
Details about the product that reported the finding.
optional
product_uid: Option<String>Product Identifier
The unique identifier of the product that reported the finding.
optional
Related Analytics
Other analytics related to this finding.
optional
Related Events/Findings
Describes events and/or other findings related to the finding as identified by the security product. Note that these events may or may not be in OCSF.
optional
Related Events/Findings Count
Number of related events or findings.
optional
src_url: Option<String>Source URL
The URL pointing to the source of the finding.
optional
Tags
The list of tags; {key:value} pairs associated with the finding.
optional
title: Option<String>Title
A title or a brief phrase summarizing the reported finding.
recommended
traits: Option<Vec<Trait>>Traits
The list of key traits or characteristics extracted from the finding.
optional
types: Option<Vec<String>>Types
One or more types of the reported finding.
optional
uid: Option<String>Unique ID
The unique identifier of the reported finding.
required
uid_alt: Option<String>Alternate ID
The alternative unique identifier of the reported finding.
optional
Trait Implementations§
Source§impl Clone for FindingInfo
impl Clone for FindingInfo
Source§fn clone(&self) -> FindingInfo
fn clone(&self) -> FindingInfo
1.0.0 · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more