Struct Observable 

#[non_exhaustive]
pub struct Observable {
    pub event_uid: Option<String>,
    pub name: Option<String>,
    pub reputation: Option<Box<Reputation>>,
    pub type: Option<String>,
    pub type_id: Option<i64>,
    pub type_uid: Option<i64>,
    pub value: Option<String>,
}

Observable

The observable object is a pivot element that contains related information found in many places in the event.

[] Category: | Name: observable

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

event_uid: Option<String>

Event UID

The unique identifier (metadata.uid) of the source OCSF event from which this observable was extracted. This field enables linking observables back to their originating event data when observables are stored in a separate location or system.

optional

name: Option<String>

Name

The full name of the observable attribute. The name is a pointer/reference to an attribute within the OCSF event data. For example: file.name. Array attributes may be represented in one of three ways. For example: resources.uid, resources[].uid, resources[0].uid.

recommended

reputation: Option<Box<Reputation>>

Reputation Scores

Contains the original and normalized reputation scores.

optional

type: Option<String>

Type

The observable value type name.

optional

type_id: Option<i64>

Type ID

The observable value type identifier.

required

type_uid: Option<i64>

Type ID

The OCSF event type UID (type_uid) of the source event that this observable was extracted from. This field enables filtering and categorizing observables by their originating event type. For example: 300101 for Network Activity (class_uid 3001) with activity_id 1.

optional

value: Option<String>

Value

The value associated with the observable attribute. The meaning of the value depends on the observable type.
If the name refers to a scalar attribute, then the value is the value of the attribute.
If the name refers to an object attribute, then the value is not populated.

optional

Trait Implementations

impl Clone for Observable

fn clone(&self) -> Observable

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Observable

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Observable

fn default() -> Observable

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Observable

where Observable: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for Observable

fn eq(&self, other: &Observable) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Observable

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Observable