Enum Format 

pub enum Format {
    Sysmon,
    Auditd,
    Esf,
}

A telemetry format opseclint can ingest. All three reduce to the same Command behind the same --telemetry input path.

Variants

Sysmon

Windows Sysmon Event ID 1 (Process Create), JSON — a top-level array of event objects, or one JSON object per line (JSONL).

Auditd

Linux auditd process-execution events, raw audit.log text — the multi-line SYSCALL / EXECVE / CWD records for one execve, reassembled by their audit(…) event id.

Esf

macOS Endpoint Security NOTIFY_EXEC events, as eslogger exec JSON — a top-level array, a single object, or JSONL. Carries the calling process, so it supplies a real ParentImage.

Trait Implementations

impl Clone for Format

fn clone(&self) -> Format

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Format

impl Debug for Format

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Format

impl PartialEq for Format

fn eq(&self, other: &Format) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Format