relevance category file_event name

[frack113]

Hello,

For file category there are :

• file_change 2 (SYSMON_FILE_TIME)
• file_event 11 (SYSMON_FILE_CREATE)
• file_delete 23 (SYSMON_FILE_DELETE) missing 26

the name file_event is too generic because a event can be any of the 3 actions.
Why not change to file_create ?

in a first keep file_event and file_create to avoid break.

[Neo23x0]

Yes, we keep file_event and would then, whenever a rule for the other two cases appear use the following names

• SYSMON_FILE_TIME = file_time_event
• SYSMON_FILE_DELETE = file_delete

The other two cases are so very rare that it didn't and doesn't make sense to push that change.

[frack113]

Hi,
no worries, it's just the term "file_event" that seems too generalist to me, whereas there are "file_change" and "file_delete".
For me an "event" can be a creation, modification or deletion