| 60 | |
| 61 | #[must_use] |
| 62 | pub fn build(self) -> OcsfEvent { |
| 63 | let activity_name = self.activity.process_label().to_string(); |
| 64 | let mut base = BaseEventData::new( |
| 65 | 1007, |
| 66 | "Process Activity", |
| 67 | 1, |
| 68 | "System Activity", |
| 69 | self.activity.as_u8(), |
| 70 | &activity_name, |
| 71 | self.severity, |
| 72 | self.ctx |
| 73 | .metadata(&["security_control", "container", "host"]), |
| 74 | ); |
| 75 | self.ctx |
| 76 | .apply_common_fields(&mut base, self.status, self.message); |
| 77 | |
| 78 | OcsfEvent::ProcessActivity(ProcessActivityEvent { |
| 79 | base, |
| 80 | process: self.process.unwrap_or_else(|| Process::new("unknown", 0)), |
| 81 | actor: self.actor, |
| 82 | launch_type: self.launch_type, |
| 83 | exit_code: self.exit_code, |
| 84 | action: self.action, |
| 85 | disposition: self.disposition, |
| 86 | }) |
| 87 | } |
| 88 | } |
| 89 | |
| 90 | impl_activity_setter!(ProcessActivityBuilder); |