Closed renatomassaro closed 6 years ago
Ebert has finished reviewing this Pull Request and has found:
You can see more details about this review at https://ebertapp.io/github/HackerExperience/Helix/pulls/372.
Reviewed 1 of 41 files at r1, 37 of 44 files at r2, 20 of 20 files at r3. Review status: all files reviewed at latest revision, 1 unresolved discussion.
Comments from Reviewable
Closes #366
Previously there was no way to know what file originated a process, or whether
connection_id
meant the target connection or the source connection. For most processes that's OK, but not for others. For instance, a FileEncryptProcess has a origin file (the encryptor) and a target file (the file being encrypted). Now there's a way to represent both of them, as well as react to events/signals that affect each one of them.Same applies to connections. Most or all remote processes have an origin connection (SSH, FTP, CRC) and some of them target a connection (e.g. Encrypting a connection, or Exploiting a connection).
TODO:
src_*
ortgt_*
src_connection_id
to FileInstallProcess (SSH connection).Incidental
tgt_process_id
as well, so processes that target other processes have first-class support.This change is