Description
Summary
Findings include an argument named "triggeredBy" which encodes a summary of the triggering event in the signature.
Previously, the encoded arguments would be parsed if the parse-arguments
flag was enabled. Since (#4544) moving to disabling the flag by default, and moving the parse stage, if enabled, to occur only after the signature stage, the encoded events consequently do not have parsed arguments.
Usecase
Clients may want to receive the arguments:
- Entirely parsed in all events
- Parsed only in the output events(?) - probably not necessary but could be implemented in addition
- Parsed only in the triggering events
- Raw in all events
I think this should be configured via the parse-arguments flag. Maybe its time to promote it from option to full subflag in output
.
Further, analyze should support this usecase. As such parse-arguments may be relevant for analyze too (this could be resolved in #4425 just as well, so support in analyze depends on the priority of that issue).