aquasecurity / aquasecurity/tracee

Parse arguments of triggering events

Open
#4,601 3 comments 0 reactions 1 assignee Claimed by @NDStrahilevitz View on GitHub
kind/feature
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Summary
Findings include an argument named "triggeredBy" which encodes a summary of the triggering event in the signature.
Previously, the encoded arguments would be parsed if the `parse-arguments` flag was enabled. Since (#4544) moving to disabling the flag by default, and moving the parse stage, if enabled, to occur only after the signature stage, the encoded events consequently do not have parsed arguments.
## Usecase
Clients may want to receive the arguments:
1. Entirely parsed in all events
2. Parsed _only_ in the output events(?) - probably not necessary but could be implemented in addition
3. Parsed _only_ in the triggering events
4. Raw in all events

I think this should be configured via the parse-arguments flag. Maybe its time to promote it from option to full subflag in `output`.

Further, analyze should support this usecase. As such parse-arguments may be relevant for analyze too (this could be resolved in #4425 just as well, so support in analyze depends on the priority of that issue).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.