Table of Contents

Class DenialSummary

Namespace
Openshell.V1
Assembly
OpenShell.Sdk.dll

Structured denial summary from sandbox aggregator.

public sealed class DenialSummary : IMessage<DenialSummary>, IEquatable<DenialSummary>, IDeepCloneable<DenialSummary>, IBufferMessage, IMessage
Inheritance
DenialSummary
Implements
IMessage<DenialSummary>
IDeepCloneable<DenialSummary>
IBufferMessage
IMessage
Inherited Members

Constructors

DenialSummary() 

public DenialSummary()

DenialSummary(DenialSummary) 

public DenialSummary(DenialSummary other)

Parameters

other DenialSummary

Fields

AncestorsFieldNumber

Field number for the "ancestors" field.

public const int AncestorsFieldNumber = 5

Field Value

int

BinaryFieldNumber

Field number for the "binary" field.

public const int BinaryFieldNumber = 4

Field Value

int

BinarySha256FieldNumber

Field number for the "binary_sha256" field.

public const int BinarySha256FieldNumber = 13

Field Value

int

CountFieldNumber

Field number for the "count" field.

public const int CountFieldNumber = 9

Field Value

int

DenialStageFieldNumber

Field number for the "denial_stage" field.

public const int DenialStageFieldNumber = 15

Field Value

int

DenyReasonFieldNumber

Field number for the "deny_reason" field.

public const int DenyReasonFieldNumber = 6

Field Value

int

FirstSeenTimeFieldNumber

Field number for the "first_seen_time" field.

public const int FirstSeenTimeFieldNumber = 107

Field Value

int

HostFieldNumber

Field number for the "host" field.

public const int HostFieldNumber = 2

Field Value

int

L7InspectionActiveFieldNumber

Field number for the "l7_inspection_active" field.

public const int L7InspectionActiveFieldNumber = 17

Field Value

int

L7RequestSamplesFieldNumber

Field number for the "l7_request_samples" field.

public const int L7RequestSamplesFieldNumber = 16

Field Value

int

LastSeenTimeFieldNumber

Field number for the "last_seen_time" field.

public const int LastSeenTimeFieldNumber = 108

Field Value

int

PersistentFieldNumber

Field number for the "persistent" field.

public const int PersistentFieldNumber = 14

Field Value

int

PortFieldNumber

Field number for the "port" field.

public const int PortFieldNumber = 3

Field Value

int

SampleCmdlinesFieldNumber

Field number for the "sample_cmdlines" field.

public const int SampleCmdlinesFieldNumber = 12

Field Value

int

SandboxIdFieldNumber

Field number for the "sandbox_id" field.

public const int SandboxIdFieldNumber = 1

Field Value

int

SuppressedCountFieldNumber

Field number for the "suppressed_count" field.

public const int SuppressedCountFieldNumber = 10

Field Value

int

TotalCountFieldNumber

Field number for the "total_count" field.

public const int TotalCountFieldNumber = 11

Field Value

int

Properties

Ancestors

Process ancestor chain.

public RepeatedField<string> Ancestors { get; }

Property Value

RepeatedField<string>

Binary

Binary that attempted the connection.

public string Binary { get; set; }

Property Value

string

BinarySha256

SHA-256 of the binary for audit trail.

public string BinarySha256 { get; set; }

Property Value

string

Count

Number of denials in the current window.

public uint Count { get; set; }

Property Value

uint

DenialStage

Denial category: "l4_deny", "l7_deny", "l7_audit", "ssrf".

public string DenialStage { get; set; }

Property Value

string

DenyReason

Denial reason from OPA evaluation.

public string DenyReason { get; set; }

Property Value

string

Descriptor 

public static MessageDescriptor Descriptor { get; }

Property Value

MessageDescriptor

FirstSeenTime

Time of the first denial.

public Timestamp FirstSeenTime { get; set; }

Property Value

Timestamp

Host

Denied destination host.

public string Host { get; set; }

Property Value

string

L7InspectionActive

True if L7 inspection was active during observation window.

public bool L7InspectionActive { get; set; }

Property Value

bool

L7RequestSamples

Observed HTTP request patterns (from L7 inspection).

public RepeatedField<L7RequestSample> L7RequestSamples { get; }

Property Value

RepeatedField<L7RequestSample>

LastSeenTime

Time of the most recent denial.

public Timestamp LastSeenTime { get; set; }

Property Value

Timestamp

Parser 

public static MessageParser<DenialSummary> Parser { get; }

Property Value

MessageParser<DenialSummary>

Persistent

True if emitted by stale-flush rather than threshold.

public bool Persistent { get; set; }

Property Value

bool

Port

Denied destination port.

public uint Port { get; set; }

Property Value

uint

SampleCmdlines

Distinct cmdline strings observed (sanitized of credentials).

public RepeatedField<string> SampleCmdlines { get; }

Property Value

RepeatedField<string>

SandboxId

Sandbox ID that produced this summary.

public string SandboxId { get; set; }

Property Value

string

SuppressedCount

Events dropped during aggregator cooldown.

public uint SuppressedCount { get; set; }

Property Value

uint

TotalCount

Cumulative lifetime count (never resets).

public uint TotalCount { get; set; }

Property Value

uint

Methods

CalculateSize()

Calculates the size of this message in Protocol Buffer wire format, in bytes.

public int CalculateSize()

Returns

int

The number of bytes required to write this message to a coded output stream.

Clone()

Creates a deep clone of this object.

public DenialSummary Clone()

Returns

DenialSummary

A deep clone of this object.

Equals(DenialSummary)

Indicates whether the current object is equal to another object of the same type.

public bool Equals(DenialSummary other)

Parameters

other DenialSummary

An object to compare with this object.

Returns

bool

true if the current object is equal to the other parameter; otherwise, false.

Equals(object)

Determines whether the specified object is equal to the current object.

public override bool Equals(object other)

Parameters

other object

Returns

bool

true if the specified object is equal to the current object; otherwise, false.

GetHashCode()

Serves as the default hash function.

public override int GetHashCode()

Returns

int

A hash code for the current object.

MergeFrom(CodedInputStream)

Merges the data from the specified coded input stream with the current message.

public void MergeFrom(CodedInputStream input)

Parameters

input CodedInputStream

Remarks

See the user guide for precise merge semantics.

MergeFrom(DenialSummary)

Merges the given message into this one.

public void MergeFrom(DenialSummary other)

Parameters

other DenialSummary

Remarks

See the user guide for precise merge semantics.

ToString()

Returns a string that represents the current object.

public override string ToString()

Returns

string

A string that represents the current object.

WriteTo(CodedOutputStream)

Writes the data to the given coded output stream.

public void WriteTo(CodedOutputStream output)

Parameters

output CodedOutputStream

Coded output stream to write the data to. Must not be null.