Relative file creation times for Process and DLL events #269
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
💚 Build Succeeded
Expand to view the summary
Build stats
🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
pzl approved these changes Jul 19, 2022
Comment on lines +44 to +45
| "relative_file_creation_time": 48628704.4029488, | ||
| "relative_file_name_modify_time": 48628704.4029488 |
joeypoon approved these changes Jul 19, 2022
custom_schemas/custom_process.yml Outdated
| - name: Ext.relative_file_creation_time | ||
| level: custom | ||
| type: double | ||
| short: Number of seconds since the DLL's file was created |
There was a problem hiding this comment.
Is DLL the correct terminology? Not executable or something. Not sure, just my copy-pasta spider sense is going off.
There was a problem hiding this comment.
Well, it seems DLL is used for all three types. So, perhaps these comments are just noise.
There was a problem hiding this comment.
Good catch. Thanks. Fixed: 476b668
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
Change Summary
Add the EXE/DLL file's creation time, and file name modification time to process and DLL events, relative to the time of the event. They may be negative if the file's timestamps are in the future.
Release Target
8.4.0
Q/A
For mapping changes:
makeafter making the schema changes, and committed all changes