| 65 | |
| 66 | #[must_use] |
| 67 | pub fn build(self) -> OcsfEvent { |
| 68 | let mut base = BaseEventData::new( |
| 69 | 5019, |
| 70 | "Device Config State Change", |
| 71 | 5, |
| 72 | "Discovery", |
| 73 | 1, |
| 74 | "Log", // activity_id=1 (Log) |
| 75 | self.severity, |
| 76 | self.ctx |
| 77 | .metadata(&["security_control", "container", "host"]), |
| 78 | ); |
| 79 | if !self.unmapped.is_empty() { |
| 80 | base.unmapped = Some(serde_json::Value::Object(self.unmapped)); |
| 81 | } |
| 82 | self.ctx |
| 83 | .apply_common_fields(&mut base, self.status, self.message); |
| 84 | |
| 85 | OcsfEvent::DeviceConfigStateChange(DeviceConfigStateChangeEvent { |
| 86 | base, |
| 87 | state: self.state_id, |
| 88 | state_custom_label: self.state_label, |
| 89 | security_level: self.security_level, |
| 90 | prev_security_level: self.prev_security_level, |
| 91 | }) |
| 92 | } |
| 93 | } |
| 94 | |
| 95 | impl_builder_setters!(ConfigStateChangeBuilder); |