[RFC] Stge 0 - New fieldset for volume device #2201
Conversation
Trinity2019
changed the title
Trinity2019
changed the title
| * volume.mount_name | ||
| * volume.device_name | ||
| * volume.dos_name | ||
| * volume.nt_name |
There was a problem hiding this comment.
above 2 fields are Windows specific
| This RFC propose adding the volume device fieldset to describe volume storage devices that are removable disks such as USB, mountable virtual disks such as ISO. | ||
|
|
||
| * volume.mount_name | ||
| * volume.device_name |
There was a problem hiding this comment.
above 2 fields are posix specific
There was a problem hiding this comment.
Thanks for the proposal, @Trinity2019.
The motivation of describing alerts and event associated with volumes makes sense as an addition to ECS.
| * volume.vendor_name | ||
| * volume.serial_number | ||
| * volume.volume_device_type | ||
| * volume.action |
There was a problem hiding this comment.
volume.action will be like "attach", "detach", "mount", "unmount". I'm hesitating to place it here. Seems event.action is a better place to save such information. Because these volumes fields will be part of a device event, similar to process events whose event.action can be "start"/"end".
thoughts?
There was a problem hiding this comment.
I'd also prefer to use the existing event.action field over introducing an additional *.action field, if we can avoid it.
I reviewed this as well, I think we can go ahead with merging |
make test? - N/Amakeand committed those changes? - N/A