aquasecurity/tracee

Rename rule argument filters to data filters

Closed this issue · 0 comments

Since the new event structure has "data" field to describe event data, and we no longer have "arguments" as part of the event data, it makes sense to rename argument filters to data filters so we keep things consistent.
This also implies that the syntax used by a data filter will change, for example:

    rules:
        event: security_file_open
        filters:
        - args.pathname=/tmp*

will now become:

    rules:
        event: security_file_open
        filters:
        - data.pathname=/tmp*

To keep backward compatibility we can treat both of these options valid, and fully deprecate args.xxx syntax in the future