Struct ObservedData 

pub struct ObservedData {
    pub type_: String,
    pub id: String,
    pub first_observed: String,
    pub last_observed: String,
    pub number_observed: u64,
    pub object_refs: Vec<String>,
    pub objects: Option<BTreeMap<String, StixValue>>,
    pub additional: BTreeMap<String, StixValue>,
}

The STIX observed-data SDO.

Carries the temporal fields and object_refs the matcher needs. Unknown or custom properties are retained in additional (via #[serde(flatten)]) so the ObjectView still exposes them. Tolerates STIX 2.0 inline objects as well as 2.1 object_refs.

Fields

type_: String

The STIX type property (always observed-data).

id: String

The object’s STIX id.

first_observed: String

The start of the observation window (RFC3339 timestamp).

last_observed: String

The end of the observation window (RFC3339 timestamp).

number_observed: u64

How many times the window’s contents were observed.

object_refs: Vec<String>

The ids of the referenced SCOs (STIX 2.1).

objects: Option<BTreeMap<String, StixValue>>

STIX 2.0 inline observed objects (objects), if present.

additional: BTreeMap<String, StixValue>

Any other properties, retained for ObjectView and round-tripping.

Implementations

impl ObservedData

pub fn sco_ids(&self) -> Vec<&str>

The referenced SCO ids. Prefers 2.1 object_refs; otherwise empty. (2.0 inline objects are keyed locally, not by id, so they yield no refs.)

Trait Implementations

impl Clone for ObservedData

fn clone(&self) -> ObservedData

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ObservedData

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ObservedData

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl ObjectView for ObservedData

fn id(&self) -> Option<&str>

The object’s STIX id, if it has one.

fn type_(&self) -> Option<&str>

The object’s STIX type, if it has one.

fn property(&self, name: &str) -> Option<StixValue>

The named top-level property as an owned value, or None if absent.

impl PartialEq for ObservedData

fn eq(&self, other: &ObservedData) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ObservedData

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ObservedData