#[non_exhaustive]pub struct QueryEvidence {Show 21 fields
pub connection_info: Option<Box<NetworkConnectionInfo>>,
pub file: Option<Box<File>>,
pub folder: Option<Box<File>>,
pub group: Option<Box<Group>>,
pub job: Option<Box<Job>>,
pub kernel: Option<Box<Kernel>>,
pub module: Option<Box<Module>>,
pub network_interfaces: Option<Vec<NetworkInterface>>,
pub peripheral_device: Option<Box<PeripheralDevice>>,
pub process: Option<Box<Process>>,
pub query_type: Option<String>,
pub query_type_id: Option<i64>,
pub reg_key: Option<Box<WinRegKey>>,
pub reg_value: Option<Box<WinRegValue>>,
pub service: Option<Box<Service>>,
pub session: Option<Box<Session>>,
pub startup_item: Option<Box<StartupItem>>,
pub state: Option<String>,
pub tcp_state_id: Option<i64>,
pub user: Option<Box<User>>,
pub users: Option<Vec<User>>,
}Expand description
Query Evidence
The resulting evidence information that was queried.
[] Category: | Name: query_evidence
Constraints:
- just_one:
[connection_info,file,folder,group,job,kernel,module,network_interfaces,peripheral_device,process,reg_key,reg_value,service,session,startup_item,user]
Fields (Non-exhaustive)§
This struct is marked as non-exhaustive
Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.connection_info: Option<Box<NetworkConnectionInfo>>Connection Info
The network connection information related to a Network Connection query type.
recommended
file: Option<Box<File>>File
The file that is the target of the query when query_type_id indicates a File query.
recommended
folder: Option<Box<File>>Folder
The folder that is the target of the query when query_type_id indicates a Folder query.
recommended
group: Option<Box<Group>>Group
The administrative group that is the target of the query when query_type_id indicates an Admin Group query.
recommended
job: Option<Box<Job>>Job
The job object that pertains to the event when query_type_id indicates a Job query.
recommended
kernel: Option<Box<Kernel>>Kernel
The kernel object that pertains to the event when query_type_id indicates a Kernel query.
recommended
module: Option<Box<Module>>Module
The module that pertains to the event when query_type_id indicates a Module query.
recommended
network_interfaces: Option<Vec<NetworkInterface>>Network Interfaces
The physical or virtual network interfaces that are associated with the device when query_type_id indicates a Network Interfaces query.
recommended
peripheral_device: Option<Box<PeripheralDevice>>Peripheral Device
The peripheral device that triggered the event when query_type_id indicates a Peripheral Device query.
recommended
process: Option<Box<Process>>Process
The process that pertains to the event when query_type_id indicates a Process query.
recommended
query_type: Option<String>Query Type
The normalized caption of query_type_id or the source-specific query type.
optional
query_type_id: Option<i64>Query Type ID
The normalized type of system query performed against a device or system component.
required
reg_key: Option<Box<WinRegKey>>Registry Key
The registry key object describes a Windows registry key.
recommended
reg_value: Option<Box<WinRegValue>>Registry Value
The registry key object describes a Windows registry value.
recommended
service: Option<Box<Service>>Service
The service that pertains to the event when query_type_id indicates a Service query.
recommended
session: Option<Box<Session>>Session
The authenticated user or service session when query_type_id indicates a Session query.
recommended
startup_item: Option<Box<StartupItem>>Startup Item
The startup item object that pertains to the event when query_type_id indicates a Startup Item query.
recommended
state: Option<String>Network Connection State
The state of the socket, normalized to the caption of the state_id value. In the case of ‘Other’, it is defined by the event source.
optional
tcp_state_id: Option<i64>TCP State ID
The state of the TCP socket for the network connection.
optional
user: Option<Box<User>>User
The user that pertains to the event when query_type_id indicates a User query.
recommended
users: Option<Vec<User>>Users
The users that belong to the administrative group when query_type_id indicates a Users query.
optional
Trait Implementations§
Source§impl Clone for QueryEvidence
impl Clone for QueryEvidence
Source§fn clone(&self) -> QueryEvidence
fn clone(&self) -> QueryEvidence
1.0.0 · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more