Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: Rename event parameters to fields #4398

Merged
merged 1 commit into from
Nov 29, 2024

Conversation

yanivagman
Copy link
Collaborator

1. Explain what the PR does

This PR renames the parameters field in event definitions to fields. This change reflects the evolving nature of Tracee, which now supports various event types beyond just syscalls.

The term "fields" more accurately describes the structured data within events, aligning with the concept of event schemas and the data section in the new event structure.

This renaming also avoids future confusion with the planned introduction of "event parameters," which will be configurable settings for modifying event behavior.

2. Explain how to test it

3. Other comments

@NDStrahilevitz
Copy link
Collaborator

What's the logical difference between the fields section and the data section? fields represents the metadata for the concrete data found in an event? If so, why not just align the names?

@yanivagman
Copy link
Collaborator Author

What's the logical difference between the fields section and the data section? fields represents the metadata for the concrete data found in an event? If so, why not just align the names?

I agree that clear terminology is crucial. Here's why I chose 'fields' for the event definition and 'data' for the output:

data in Output: This represents the actual event payload – the concrete values captured at runtime. It's the raw information associated with the event, like the arguments passed to a syscall or the contents of a network packet.

fields in Definition: This acts as the metadata or schema for the event. It defines the structure, types, and possible values within the data section.

While the complete term might be "data fields," using "data" for the output and "fields" for the definition provides contextual clarity and avoids redundancy.

Copy link
Member

@geyslan geyslan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

This commit renames the `parameters` field in event definitions to `fields`.
This change reflects the evolving nature of Tracee, which now supports various
event types beyond just syscalls.

The term "fields" more accurately describes the structured data within events,
aligning with the concept of event schemas and the `data` section in the new
event structure.

This renaming also avoids future confusion with the planned introduction of
"event parameters," which will be configurable settings for modifying event
behavior.
@yanivagman yanivagman merged commit abd8563 into aquasecurity:main Nov 29, 2024
31 checks passed
@yanivagman yanivagman deleted the refactor_event_params branch November 29, 2024 10:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants