aquasecurity / aquasecurity/tracee
Selecting event output fields
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
Users should be able to select which event fields are printed or not. The motivation is to minimize event size. This surfaced in https://github.com/aquasecurity/tracee/issues/2870#issuecomment-1468743262 and in https://github.com/aquasecurity/tracee/discussions/2640.
We already allow conditional printing of some fields (stack traces, syscall, exec env) through output options. The same control should be available for all metadata and context fields in a consistent way.
Contributor guide
Research direction
Start by reviewing the existing output options for stack traces, syscall, and exec env, then compare how metadata and context fields are represented. Read the linked issue and discussion for context. Done means users can consistently select all event metadata and context fields for printing while minimizing event size.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100