Closed wrouesnel closed 1 year ago
@wrouesnel , I've finished this feature. I was wondering if "Process" as the name of the column is a good name to define the absolute path to the binary that opened the connection.
Would be more appropiate Application maybe?
By the way, what version are you using?
Summary:
As a user, I would like to see the command line of the process in the event log when it runs.
Currently this information seems only present if you configure actual rule pop-ups to include it, whereas for audit or review of rules you frequently end up with a lot of unhelpful lines like
/usr/bin/python3.10
which omits important information to determine whether something untoward has or is happening.