Use case
Most collectors tend to rely on the SignatureTypes enum to use a common vocabulary between the various components of the product, yet currently the microsoft-defender collector relies on a local hardcoded list.
Current workaround
Leave it be.
Proposed solution
Align SignatureTypes with the ones in microsoft-defender, creating here or replacing collector's side the relevant signature types.
Additional information
Currently in microsoft-defender:
self.relevant_signatures_types = [
"parent_process_name",
"process_name",
"command_line",
"file_name",
"hostname",
"ipv4_address",
"ipv6_address",
]
Use case
Most collectors tend to rely on the
SignatureTypesenum to use a common vocabulary between the various components of the product, yet currently themicrosoft-defendercollector relies on a local hardcoded list.Current workaround
Leave it be.
Proposed solution
Align
SignatureTypeswith the ones inmicrosoft-defender, creating here or replacing collector's side the relevant signature types.Additional information
Currently in
microsoft-defender: