OCSF.Class (OCSF v0.1.0)

OCSF event classes.

Maps event class names to their OCSF 1.8 numeric identifiers. Each class belongs to a OCSF.Category and defines the schema for a specific type of security event.

See the OCSF classes definition.

Values

Name	ID	Category
`:"Account Change"`	3001	3
`:Authentication`	3002	3
`:Authorization`	3003	3
`:"API Activity"`	6003	6

See OCSF.Category for category definitions and OCSF.Activity for per-class activity mappings.

Summary

Functions

category(class_uid)

Return the category_uid for a given class_uid.

ecto_values()

Return values formatted for Ecto.Enum.

name(uid)

Return the name atom for the given numeric identifier.

uid(name)

Return the numeric identifier for the given name atom.

valid?(name)

Return true if the given name or identifier is valid.

values()

Return all values as a keyword list.

Functions

category(class_uid)

@spec category(integer()) :: integer() | nil

Return the category_uid for a given class_uid.

Examples

iex> OCSF.Class.category(3002)
3

iex> OCSF.Class.category(9999)
nil

ecto_values()

@spec ecto_values() :: keyword()

Return values formatted for Ecto.Enum.

Examples

iex> OCSF.Class.ecto_values()
[{:"Account Change", 3001}, {:Authentication, 3002}, {:Authorization, 3003}, {:"API Activity", 6003}]

name(uid)

@spec name(integer()) :: atom() | nil

Return the name atom for the given numeric identifier.

Examples

iex> OCSF.Class.name(3002)
:Authentication

iex> OCSF.Class.name(9999)
nil

uid(name)

@spec uid(atom()) :: integer() | nil

Return the numeric identifier for the given name atom.

Examples

iex> OCSF.Class.uid(:Authentication)
3002

iex> OCSF.Class.uid(:NonExistent)
nil

valid?(name)

@spec valid?(atom() | integer()) :: boolean()

Return true if the given name or identifier is valid.

Examples

iex> OCSF.Class.valid?(:Authentication)
true

iex> OCSF.Class.valid?(3002)
true

iex> OCSF.Class.valid?(:NonExistent)
false

values()

@spec values() :: [{atom(), integer()}]

Return all values as a keyword list.

Examples

iex> OCSF.Class.values()
[{:"Account Change", 3001}, {:Authentication, 3002}, {:Authorization, 3003}, {:"API Activity", 6003}]