fibratus
fibratus copied to clipboard
New `encode` transformer
This transformer should be in charge of encoding the event params by using the specific data encoding algorithm. Users should be able to choose between hex, base64, and maybe asn1 encoders. The encode transformer should have the ability to filter out unwanted events and thus minimize the impact on performance in case of high event throughput.
Example config:
transformers:
encode:
encoder: base64
enabled: true
condition: kevt.name = 'RegSetValue' and registry.value.type = 'REG_BINARY'
kparams:
- registry.value