Skip to content

feat(signature-types): adding signature types used in microsoft-defender #335

Description

@guzmud

Use case

Most collectors tend to rely on the SignatureTypes enum to use a common vocabulary between the various components of the product, yet currently the microsoft-defender collector relies on a local hardcoded list.

Current workaround

Leave it be.

Proposed solution

Align SignatureTypes with the ones in microsoft-defender, creating here or replacing collector's side the relevant signature types.

Additional information

Currently in microsoft-defender:

        self.relevant_signatures_types = [
            "parent_process_name",
            "process_name",
            "command_line",
            "file_name",
            "hostname",
            "ipv4_address",
            "ipv6_address",
        ]

Metadata

Metadata

Assignees

No one assigned

    Labels

    featureType: new feature or capability (feat:).needs triageNeeds triage from the Filigran product team.solvedResolved (should be linked to the solving PR).

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions