in aucoalesce/coalesce.go [787:813]
func setHowDefaults(event *Event) {
exe, found := event.Data["exe"]
if !found {
// Fallback to comm.
exe, found = event.Data["comm"]
if !found {
return
}
}
event.Summary.How = exe
switch {
case strings.HasPrefix(exe, "/usr/bin/python"),
strings.HasPrefix(exe, "/usr/bin/sh"),
strings.HasPrefix(exe, "/usr/bin/bash"),
strings.HasPrefix(exe, "/usr/bin/perl"):
default:
return
}
// It's probably some kind of interpreted script so use "comm".
comm, found := event.Data["comm"]
if !found {
return
}
event.Summary.How = comm
}