-
Notifications
You must be signed in to change notification settings - Fork 144
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Adding the Startup Application Query event class in the discovery cat…
…egory. (#1119) The Startup Application Query class captures the results of a discovery on target devices. This class was refactored from a previous submission, while incorporating feedback from Paul. #### Description of changes: Made the Startup Application object more clear by factoring out unrelated items in the type_id list. The list now describes only the type of application. A run_mode attribute was added as an array to capture the other items. Also added a run_state to capture the state of the application at the time the event was logged. --------- Signed-off-by: maxhotta <[email protected]> Co-authored-by: Rajas <[email protected]>
- Loading branch information
Showing
5 changed files
with
272 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| { | ||
| "caption": "Startup Item Query", | ||
| "description": "Startup Item Query events report information about discovered items, e.g., application components that are generally configured to run automatically.", | ||
| "extends": "discovery_result", | ||
| "name": "startup_item_query", | ||
| "uid": 22, | ||
| "attributes": { | ||
| "startup_item": { | ||
| "group": "primary", | ||
| "requirement": "required" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| { | ||
| "caption": "Startup Item", | ||
| "name": "startup_item", | ||
| "description": "The startup item object describes an application component that has associated startup criteria and configurations.", | ||
| "extends": "startup_item", | ||
| "attributes": { | ||
| "win_service": { | ||
| "description": "The startup item Windows service resource.", | ||
| "requirement": "optional" | ||
| } | ||
| }, | ||
| "constraints": { | ||
| "just_one": [ | ||
| "driver", | ||
| "job", | ||
| "process", | ||
| "win_service" | ||
| ] | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,156 @@ | ||
| { | ||
| "caption": "Startup Item", | ||
| "name": "startup_item", | ||
| "description": "The startup item object describes an application component that has associated startup criteria and configurations.", | ||
| "attributes": { | ||
| "name": { | ||
| "description": "The unique name of the startup item.", | ||
| "requirement": "required" | ||
| }, | ||
| "run_modes": { | ||
| "description": "The list of run_modes, normalized to the captions of the run_mode_id values. In the case of 'Other', they are defined by the event source.", | ||
| "requirement": "optional" | ||
| }, | ||
| "run_mode_ids": { | ||
| "description": "The list of normalized identifiers that describe the startup items' properties when it is running. Use this field to capture extended information about the process, which may depend on the type of startup item. E.g., A Windows service that interacts with the desktop.", | ||
| "requirement": "optional", | ||
| "enum": { | ||
| "1": { | ||
| "caption": "Interactive", | ||
| "description": "The startup item interacts with the desktop." | ||
| }, | ||
| "2": { | ||
| "caption": "Own Process", | ||
| "description": "The startup item runs in its own process." | ||
| }, | ||
| "3": { | ||
| "caption": "Shared Process", | ||
| "description": "The startup item runs in a shared process." | ||
| } | ||
| } | ||
| }, | ||
| "run_state": { | ||
| "description": "The run state of the startup item.", | ||
| "requirement": "optional" | ||
| }, | ||
| "run_state_id": { | ||
| "description": "The run state ID of the startup item.", | ||
| "requirement": "recommended", | ||
| "enum": { | ||
| "1": { | ||
| "caption": "Stopped", | ||
| "description": "The service is not running." | ||
| }, | ||
| "2": { | ||
| "caption": "Start Pending", | ||
| "description": "The service is starting." | ||
| }, | ||
| "3": { | ||
| "caption": "Stop Pending", | ||
| "description": "The service is stopping." | ||
| }, | ||
| "4": { | ||
| "caption": "Running", | ||
| "description": "The service is running." | ||
| }, | ||
| "5": { | ||
| "caption": "Continue Pending", | ||
| "description": "The service is pending continue." | ||
| }, | ||
| "6": { | ||
| "caption": "Pause Pending", | ||
| "description": "The service is pending pause." | ||
| }, | ||
| "7": { | ||
| "caption": "Paused", | ||
| "description": "The service is paused." | ||
| }, | ||
| "8": { | ||
| "caption": "Restart Pending", | ||
| "description": "The service is pending restart." | ||
| } | ||
| } | ||
| }, | ||
| "start_type": { | ||
| "description": "The start type of the startup item.", | ||
| "requirement": "optional" | ||
| }, | ||
| "start_type_id": { | ||
| "description": "The start type ID of the startup item.", | ||
| "requirement": "required" | ||
| }, | ||
| "type": { | ||
| "caption": "Type", | ||
| "description": "The startup item type.", | ||
| "requirement": "optional", | ||
| "type": "string_t" | ||
| }, | ||
| "type_id": { | ||
| "caption": "Type ID", | ||
| "description": "The startup item type identifier.", | ||
| "requirement": "recommended", | ||
| "enum": { | ||
| "0": { | ||
| "caption": "Unknown", | ||
| "description": "The type is unknown." | ||
| }, | ||
| "1": { | ||
| "caption": "Kernel Mode Driver", | ||
| "description": "Kernel mode driver." | ||
| }, | ||
| "2": { | ||
| "caption": "User Mode Driver", | ||
| "description": "User mode driver." | ||
| }, | ||
| "3": { | ||
| "caption": "Service", | ||
| "description": "A background process typically managed by the operating system, e.g., a service process on Windows or a systemd-managed daemon on Linux." | ||
| }, | ||
| "4": { | ||
| "caption": "User Mode Application", | ||
| "description": "An application that runs in the user space." | ||
| }, | ||
| "5": { | ||
| "caption": "Autoload", | ||
| "description": "The macOS Autoload Application." | ||
| }, | ||
| "6": { | ||
| "caption": "System Extension", | ||
| "description": "System extensions on macOS enables 3rd parties to extend the capabilities of macOS." | ||
| }, | ||
| "7": { | ||
| "caption": "Kernel Extension", | ||
| "description": "Kernel extensions on macOS includes Apple provided pre-installs and 3rd party installs which enables support for specific hardware or software features not natively supported by macOS." | ||
| }, | ||
| "8": { | ||
| "caption": "Scheduled Job, Task", | ||
| "description": "A job or task that runs on a configured schedule." | ||
| }, | ||
| "99": { | ||
| "caption": "Other", | ||
| "description": "The startup item type is not mapped. See the <code>type</code> attribute, which contains data source specific values." | ||
| } | ||
| }, | ||
| "type": "integer_t" | ||
| }, | ||
| "driver": { | ||
| "description": "The startup item kernel driver resource.", | ||
| "requirement": "optional" | ||
| }, | ||
| "job": { | ||
| "description": "The startup item job resource.", | ||
| "requirement": "optional" | ||
| }, | ||
| "process": { | ||
| "description": "The startup item process resource.", | ||
| "requirement": "optional" | ||
| } | ||
| }, | ||
| "constraints": { | ||
| "just_one": [ | ||
| "driver", | ||
| "job", | ||
| "process" | ||
| ] | ||
| } | ||
| } |