Lorenzo Susini e47ece4de9 update(userspace/engine): address jasondellaluce comments ...

- avoiding inspector to be allocated for each rule
- use two boolean values for expecting macros and lists
- move items of lists alongside name, under info
- use snake case for json output, like we do for e.g alerts
- correctly retrieve evt names
- consider two levels of lists for exception operators

Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>

2023-05-19 15:56:05 +02:00

22 KiB

Raw Blame History

View Raw