Rename rule argument filters to data filters
Closed this issue · 0 comments
yanivagman commented
Since the new event structure has "data" field to describe event data, and we no longer have "arguments" as part of the event data, it makes sense to rename argument filters to data filters so we keep things consistent.
This also implies that the syntax used by a data filter will change, for example:
rules:
event: security_file_open
filters:
- args.pathname=/tmp*
will now become:
rules:
event: security_file_open
filters:
- data.pathname=/tmp*
To keep backward compatibility we can treat both of these options valid, and fully deprecate args.xxx
syntax in the future