fix(hunt): catch the rest of the builtin detections

WithSecureLabs / chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

GNU General Public License v3.0

2.85k stars 260 forks source link

fix(hunt): catch the rest of the builtin detections #62

Closed fscc-alexkornitzer closed 2 years ago

fscc-alexkornitzer commented 2 years ago

This starts the discussion required to fix #59. We are going to have to decide how to output grouped events, this is probably going to end up being a breaking change!

When the option to ignore builtins was added grouped builtins were missed. Now adding these is not really possible as it would be a breaking change. So for now we create a virtual event with the data incorrectly typed. This will probably not go live but allows for easy discussion.

fscc-alexkornitzer commented 2 years ago

@FranticTyping we need to have a chat about this one :)