OCSF.Events.Authentication (OCSF v0.1.0)

Copy Markdown View Source

Builder for OCSF Authentication events (class 3002).

Corresponds to the OCSF Authentication class under the Identity & Access Management category (UID 3).

Each function maps to an OCSF activity:

FunctionActivity IDOCSF name
logon/11Logon
logoff/12Logoff
preauth/16Preauth
authentication_ticket/13Authentication Ticket
account_switch/17Account Switch

OCSF compliance note: user is a required field for the Authentication class. Builders return {:error, _} if omitted.

See OCSF.Event, OCSF.Activity, OCSF.EventCodeFormat.

Summary

Functions

account_switch(opts)

Build an Account Switch event (activity_id 7).

authentication_ticket(opts)

Build an Authentication Ticket event (activity_id 3).

logoff(opts)

Build a Logoff authentication event (activity_id 2).

logon(opts)

Build a Logon authentication event (activity_id 1).

preauth(opts)

Build a Preauth authentication event (activity_id 6).

Functions

account_switch(opts)

@spec account_switch(keyword()) :: {:ok, OCSF.Event.t()} | {:error, OCSF.Error.t()}

Build an Account Switch event (activity_id 7).

authentication_ticket(opts)

@spec authentication_ticket(keyword()) ::
  {:ok, OCSF.Event.t()} | {:error, OCSF.Error.t()}

Build an Authentication Ticket event (activity_id 3).

logoff(opts)

@spec logoff(keyword()) :: {:ok, OCSF.Event.t()} | {:error, OCSF.Error.t()}

Build a Logoff authentication event (activity_id 2).

logon(opts)

@spec logon(keyword()) :: {:ok, OCSF.Event.t()} | {:error, OCSF.Error.t()}

Build a Logon authentication event (activity_id 1).

Options

See OCSF.Event for all accepted top-level keys. Required:

  • :user — map with at least :uid. Cast to %OCSF.User{}.

Examples

{:ok, event} =
  OCSF.Events.Authentication.logon(
    user: %{uid: "u1", org: %{uid: "acme"}},
    status: :Success,
    severity: :Informational
  )

preauth(opts)

@spec preauth(keyword()) :: {:ok, OCSF.Event.t()} | {:error, OCSF.Error.t()}

Build a Preauth authentication event (activity_id 6).