review_protocol/
types.rs

1//! Data types used by the protocol.
2
3use std::{
4    net::{IpAddr, SocketAddr},
5    ops::RangeInclusive,
6    time::Duration,
7};
8
9use ipnet::IpNet;
10use num_enum::{IntoPrimitive, TryFromPrimitive};
11use serde::{Deserialize, Serialize};
12use serde_repr::{Deserialize_repr, Serialize_repr};
13
14/// The data source key, either a numeric ID or a name.
15#[derive(Debug, Deserialize, Serialize)]
16pub enum DataSourceKey<'a> {
17    Id(u32),
18    Name(&'a str),
19}
20
21#[derive(Debug, Deserialize, Serialize)]
22pub struct DataSource {
23    pub id: u32,
24    pub name: String,
25
26    pub server_name: String,
27    pub address: SocketAddr,
28
29    pub data_type: DataType,
30    pub source: String,
31    pub kind: Option<String>,
32
33    pub description: String,
34}
35
36/// The type of data that a data source provides.
37#[derive(Clone, Copy, Debug, Deserialize, Serialize, IntoPrimitive, TryFromPrimitive)]
38#[serde(into = "u16", try_from = "u16")]
39#[repr(u16)]
40pub enum DataType {
41    /// comma-separated values
42    Csv = 0,
43    /// line-based text data
44    Log = 1,
45    /// time series data
46    TimeSeries = 2,
47}
48
49/// CPU, memory, and disk usage.
50#[derive(Debug, Deserialize, Serialize)]
51pub struct ResourceUsage {
52    /// The average CPU usage in percent.
53    pub cpu_usage: f32,
54
55    /// The RAM size in KB.
56    pub total_memory: u64,
57
58    /// The amount of used RAM in KB.
59    pub used_memory: u64,
60
61    /// The total disk space in bytes.
62    pub total_disk_space: u64,
63
64    /// The total disk space in bytes that is currently used.
65    pub used_disk_space: u64,
66}
67
68#[derive(Debug, Deserialize, Serialize)]
69pub struct Process {
70    pub user: String,
71    pub cpu_usage: f32,
72    pub mem_usage: f64,
73    pub start_time: i64,
74    pub command: String,
75}
76
77#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
78pub struct HostNetworkGroup {
79    pub hosts: Vec<IpAddr>,
80    pub networks: Vec<IpNet>,
81    pub ip_ranges: Vec<RangeInclusive<IpAddr>>,
82}
83
84#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)]
85#[repr(u32)]
86pub enum SamplingKind {
87    Conn = 0,
88    Dns = 1,
89    Http = 2,
90    Rdp = 3,
91}
92
93// A policy for time series sampling.
94#[derive(Clone, Debug, Deserialize, Serialize)]
95pub struct SamplingPolicy {
96    pub id: u32,
97    pub kind: SamplingKind,
98    pub interval: Duration,
99    pub period: Duration,
100    pub offset: i32,
101    pub src_ip: Option<IpAddr>,
102    pub dst_ip: Option<IpAddr>,
103    pub node: Option<String>,
104    pub column: Option<u32>,
105}
106
107// IP address, port numbers, and protocols.
108pub type TrafficFilterRule = (IpNet, Option<Vec<u16>>, Option<Vec<u16>>);
109
110#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
111#[repr(u8)]
112pub enum EventCategory {
113    Unknown = 0,
114    Reconnaissance = 1,
115    InitialAccess = 2,
116    Execution = 3,
117    CredentialAccess = 4,
118    Discovery = 5,
119    LateralMovement = 6,
120    CommandAndControl = 7,
121    Exfiltration = 8,
122    Impact = 9,
123    Collection = 10,
124    DefenseEvasion = 11,
125    Persistence = 12,
126    PrivilegeEscalation = 13,
127    ResourceDevelopment = 14,
128}
129
130#[derive(Clone, Copy, Debug, Deserialize_repr, Eq, PartialEq, Serialize_repr)]
131#[repr(u8)]
132pub enum TiKind {
133    Ip = 0,
134    Url = 1,
135    Token = 2,
136    Regex = 3,
137}
138
139#[derive(Clone, Debug, Deserialize, Serialize)]
140pub struct TiRule {
141    pub rule_id: u32,
142    pub category: EventCategory,
143    pub name: String,
144    pub description: Option<String>,
145    pub references: Option<Vec<String>>,
146    pub samples: Option<Vec<String>>,
147    pub signatures: Option<Vec<String>>,
148}
149
150#[derive(Clone, Debug, Deserialize, Serialize)]
151pub struct Tidb {
152    pub id: u32,
153    pub name: String,
154    pub description: Option<String>,
155    pub kind: TiKind,
156    pub category: EventCategory,
157    pub version: String,
158    pub patterns: Vec<TiRule>,
159}
160
161#[derive(Clone, Copy, Debug, Deserialize, Serialize)]
162pub enum Status {
163    Ready,
164    Idle,
165}
review_protocol/types.rs

review_protocol/
types.rs
