aquasecurity / aquasecurity/tracee
Parse arguments of triggering events
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
## Summary
Findings include an argument named "triggeredBy" which encodes a summary of the triggering event in the signature.
Previously, the encoded arguments would be parsed if the `parse-arguments` flag was enabled. Since (#4544) moving to disabling the flag by default, and moving the parse stage, if enabled, to occur only after the signature stage, the encoded events consequently do not have parsed arguments.
## Usecase
Clients may want to receive the arguments:
1. Entirely parsed in all events
2. Parsed _only_ in the output events(?) - probably not necessary but could be implemented in addition
3. Parsed _only_ in the triggering events
4. Raw in all events
I think this should be configured via the parse-arguments flag. Maybe its time to promote it from option to full subflag in `output`.
Further, analyze should support this usecase. As such parse-arguments may be relevant for analyze too (this could be resolved in #4425 just as well, so support in analyze depends on the priority of that issue).
Contributor guide
Assessment
This issue has not been assessed yet.