Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Increase ignore_above for a few fields that can clearly contain longer legit values #270

Open
webmat opened this issue Dec 11, 2018 · 3 comments
Labels
discuss enhancement New feature or request

Comments

@webmat
Copy link
Contributor

webmat commented Dec 11, 2018

Let's build a list here:

  • file.path (4096 chars on Linux, check for Windows)
  • file.target_path
@latundetoks
Copy link

event_data.CommandLine
event_data.ScriptBlockText

Not sure where these Windows event_data.* fields go yet. No real conclusions
#188 (comment)

@praseodym
Copy link
Contributor

Same for:

  • url.original
  • url.full
  • url.path
  • url.query
  • url.fragment

@webmat
Copy link
Contributor Author

webmat commented Dec 14, 2018

Will spend a bit more time on all of this soon.

But one thing that would be helpful, if you know off the top of your head, is also mention the desired value.

For example, I'm pretty sure the file paths on Linux are 4k. Need to check on the Windows side and pick the highest.

Same for URL, I have a vague recollection of hearing about 2k according to the specs, but I think in reality browsers and servers support longer than that.

So if you remember any off the top of your head, please include the numbers. We'll look it up before making all this official :-)

@fkelbert fkelbert self-assigned this Feb 5, 2019
@fkelbert fkelbert removed their assignment Feb 14, 2019
@jamiehynds jamiehynds added enhancement New feature or request discuss labels Oct 20, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
discuss enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

5 participants