docs: Document new EventDetailURL keys (#1361)

google · May 30, 2024 · 53a2bbd · 53a2bbd
1 parent e417d88
commit 53a2bbd
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/docs/deployment/configuration.md b/docs/deployment/configuration.md
@@ -106,6 +106,10 @@ them to. The following sequences will be replaced in the final URL:
 | %file_identifier%              | SHA-256 of the file that was blocked                                           |
 | %bundle\_or\_file\_identifier% | SHA-256 of the file that was blocked or the bundle containing it, if available |
 | %file_sha%                     | Deprecated, acts like bundle\_or\_file\_identifier                             |
+| %file\_bundle\_id%             | The bundle ID that this binary is part of, if any.
+| %team\_id%                     | The team ID that signed this binary, if any.
+| %signing\_id%                  | The signing ID of this binary, if any.
+| %cdhash%                       | The binary's CDHash, if any.
 | %machine\_id%                  | ID of the machine                                                              |
 | %username%                     | The executing user                                                             |
 | %serial%                       | System's serial number                                                         |

diff --git a/docs/development/sync-protocol.md b/docs/development/sync-protocol.md
@@ -390,7 +390,7 @@ downloading if the rules need to be downloaded in multiple batches.
 | policy | YES | string | Identifies the action to perform in response to the rule matching (must be one of the examples) | "ALLOWLIST","ALLOWLIST_COMPILER", "BLOCKLIST", "REMOVE",  "SILENT_BLOCKLIST" |
 | rule\_type | YES | string | Identifies the type of rule (must be one of the examples) | "BINARY", "CERTIFICATE", "SIGNINGID", "TEAMID", "CDHASH"  |
 | custom\_msg | NO | string | A custom message to display when the rule matches | "Hello" |
-| custom\_url | NO | string | A custom URL to use for the open button when the rule matches | http://lmgtfy.app/?q=dont+download+malware |
+| custom\_url | NO | string | A custom URL to use for the open button when the rule matches | http://example.com |
 | creation\_time | NO | float64 | Time the rule was created | 1573543803.349378 |
 | file\_bundle\_binary\_count | NO | integer | The number of binaries in a bundle | 13 |
 | file\_bundle\_hash | NO | string | The SHA256 of all binaries in a bundle | "7466e3687f540bcb7792c6d14d5a186667dbe18a85021857b42effe9f0370805" |