Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: Document new EventDetailURL keys #1361

Merged
merged 4 commits into from
May 30, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions docs/deployment/configuration.md
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,10 @@ them to. The following sequences will be replaced in the final URL:
| %file_identifier% | SHA-256 of the file that was blocked |
| %bundle\_or\_file\_identifier% | SHA-256 of the file that was blocked or the bundle containing it, if available |
| %file_sha% | Deprecated, acts like bundle\_or\_file\_identifier |
| %file\_bundle\_id% | The bundle ID that this binary is part of, if any.
| %team\_id% | The team ID that signed this binary, if any.
| %signing\_id% | The signing ID of this binary, if any.
| %cdhash% | The binary's CDHash, if any.
| %machine\_id% | ID of the machine |
| %username% | The executing user |
| %serial% | System's serial number |
Expand Down
2 changes: 1 addition & 1 deletion docs/development/sync-protocol.md
Original file line number Diff line number Diff line change
Expand Up @@ -390,7 +390,7 @@ downloading if the rules need to be downloaded in multiple batches.
| policy | YES | string | Identifies the action to perform in response to the rule matching (must be one of the examples) | "ALLOWLIST","ALLOWLIST_COMPILER", "BLOCKLIST", "REMOVE", "SILENT_BLOCKLIST" |
| rule\_type | YES | string | Identifies the type of rule (must be one of the examples) | "BINARY", "CERTIFICATE", "SIGNINGID", "TEAMID", "CDHASH" |
| custom\_msg | NO | string | A custom message to display when the rule matches | "Hello" |
| custom\_url | NO | string | A custom URL to use for the open button when the rule matches | http://lmgtfy.app/?q=dont+download+malware |
| custom\_url | NO | string | A custom URL to use for the open button when the rule matches | http://example.com |
russellhancox marked this conversation as resolved.
Show resolved Hide resolved
| creation\_time | NO | float64 | Time the rule was created | 1573543803.349378 |
| file\_bundle\_binary\_count | NO | integer | The number of binaries in a bundle | 13 |
| file\_bundle\_hash | NO | string | The SHA256 of all binaries in a bundle | "7466e3687f540bcb7792c6d14d5a186667dbe18a85021857b42effe9f0370805" |
Expand Down