|
|
@@ -34,8 +34,8 @@ const PROCESSOR: Record<string, ((raw: string, type: string, value: string) => [
|
|
|
'SRC-IP-CIDR': (_1, _2, value) => ['source_ip_cidr', value.endsWith(',no-resolve') ? value.slice(0, -11) : value],
|
|
|
'SRC-PORT': (_1, _2, value) => toNumberTuple('source_port', value),
|
|
|
'DST-PORT': (_1, _2, value) => toNumberTuple('port', value),
|
|
|
- 'PROCESS-NAME': (_1, _2, value) => ['process_name', value],
|
|
|
- 'PROCESS-PATH': (_1, _2, value) => ['process_path', value],
|
|
|
+ 'PROCESS-NAME': (_1, _2, value) => ((value.includes('/') || value.includes('\\')) ? ['process_path', value] : ['process_name', value]),
|
|
|
+ // 'PROCESS-PATH': (_1, _2, value) => ['process_path', value],
|
|
|
'DEST-PORT': (_1, _2, value) => toNumberTuple('port', value),
|
|
|
'IN-PORT': (_1, _2, value) => toNumberTuple('source_port', value),
|
|
|
'URL-REGEX': unsupported,
|