| Name | Type | Description | Notes |
|---|---|---|---|
| calleeName | String | Name of the called function | |
| category | CategoryEnum | Filesystem category of the match | |
| how | HowEnum | Detection tier that produced the match | |
| matchedName | String | Name or token that matched | |
| source | SourceEnum | Filesystem source the match belongs to |
| Name | Value |
|---|---|
| DIR_READ | "dir-read" |
| DIR_WRITE | "dir-write" |
| ENVIRONMENT | "environment" |
| FILE_DELETE | "file-delete" |
| FILE_OPEN | "file-open" |
| FILE_PERMS | "file-perms" |
| FILE_READ | "file-read" |
| FILE_STAT | "file-stat" |
| FILE_WRITE | "file-write" |
| MODULE | "module" |
| PATH_WRITE | "path-write" |
| PROCESS | "process" |
| REGISTRY_READ | "registry-read" |
| REGISTRY_WRITE | "registry-write" |
| SERVICE | "service" |
| SYSTEM | "system" |
| UNKNOWN_DEFAULT_OPEN_API | "unknown_default_open_api" |
| Name | Value |
|---|---|
| API | "api" |
| CPP_CLASS_TOKEN | "cpp-class-token" |
| GENERIC_KEYWORD | "generic-keyword" |
| UNKNOWN_DEFAULT_OPEN_API | "unknown_default_open_api" |
| Name | Value |
|---|---|
| BOOST | "boost" |
| CPP | "cpp" |
| CPP_STDLIB | "cpp-stdlib" |
| GENERIC | "generic" |
| LIBC | "libc" |
| QT | "qt" |
| WINDOWS | "windows" |
| UNKNOWN_DEFAULT_OPEN_API | "unknown_default_open_api" |