| 104 | |
| 105 | #[must_use] |
| 106 | pub fn build(self) -> OcsfEvent { |
| 107 | let activity_name = self.activity.finding_label().to_string(); |
| 108 | let mut metadata = self |
| 109 | .ctx |
| 110 | .metadata(&["security_control", "container", "host"]); |
| 111 | if let Some(source) = self.log_source { |
| 112 | metadata.log_source = Some(source); |
| 113 | } |
| 114 | |
| 115 | let mut base = BaseEventData::new( |
| 116 | 2004, |
| 117 | "Detection Finding", |
| 118 | 2, |
| 119 | "Findings", |
| 120 | self.activity.as_u8(), |
| 121 | &activity_name, |
| 122 | self.severity, |
| 123 | metadata, |
| 124 | ); |
| 125 | self.ctx.apply_common_fields(&mut base, None, self.message); |
| 126 | |
| 127 | OcsfEvent::DetectionFinding(DetectionFindingEvent { |
| 128 | base, |
| 129 | finding_info: self |
| 130 | .finding_info |
| 131 | .unwrap_or_else(|| FindingInfo::new("unknown", "Unknown Finding")), |
| 132 | evidences: if self.evidences.is_empty() { |
| 133 | None |
| 134 | } else { |
| 135 | Some(self.evidences) |
| 136 | }, |
| 137 | attacks: if self.attacks.is_empty() { |
| 138 | None |
| 139 | } else { |
| 140 | Some(self.attacks) |
| 141 | }, |
| 142 | remediation: self.remediation, |
| 143 | is_alert: self.is_alert, |
| 144 | confidence: self.confidence, |
| 145 | risk_level: self.risk_level, |
| 146 | action: self.action, |
| 147 | disposition: self.disposition, |
| 148 | }) |
| 149 | } |
| 150 | } |
| 151 | |
| 152 | impl_activity_setter!(DetectionFindingBuilder); |