rabbitstack / fibratus

Adversary tradecraft detection, protection, and hunting
https://www.fibratus.io
Other
2.21k stars 189 forks source link

feat(alertsenders/eventlog): Introduce verbose mode #340

Closed rabbitstack closed 3 weeks ago

rabbitstack commented 3 weeks ago

What is the purpose of this PR / why it is needed?

When in verbose mode, the eventlog alert sender, will include the full event context that comprises the event data, all event parameters, and the process information.

What type of change does this PR introduce?

Any specific area of the project related to this PR?

Special notes for the reviewer:

Does this PR introduce a user-facing change?

This introduces a new config option to control if the full event information is displayed in the security alert. The documentation needs to reflect the new feature of the eventlog sender.