.. | .. |
---|
68 | 68 | - 'd-ng': the digest of the event, calculated with an arbitrary hash |
---|
69 | 69 | algorithm (field format: [<hash algo>:]digest, where the digest |
---|
70 | 70 | prefix is shown only if the hash algorithm is not SHA1 or MD5); |
---|
| 71 | + - 'd-modsig': the digest of the event without the appended modsig; |
---|
71 | 72 | - 'n-ng': the name of the event, without size limitations; |
---|
72 | | - - 'sig': the file signature. |
---|
| 73 | + - 'sig': the file signature; |
---|
| 74 | + - 'modsig' the appended file signature; |
---|
| 75 | + - 'buf': the buffer data that was used to generate the hash without size limitations; |
---|
73 | 76 | |
---|
74 | 77 | |
---|
75 | 78 | Below, there is the list of defined template descriptors: |
---|
76 | 79 | |
---|
77 | 80 | - "ima": its format is ``d|n``; |
---|
78 | 81 | - "ima-ng" (default): its format is ``d-ng|n-ng``; |
---|
79 | | - - "ima-sig": its format is ``d-ng|n-ng|sig``. |
---|
80 | | - |
---|
| 82 | + - "ima-sig": its format is ``d-ng|n-ng|sig``; |
---|
| 83 | + - "ima-buf": its format is ``d-ng|n-ng|buf``; |
---|
| 84 | + - "ima-modsig": its format is ``d-ng|n-ng|sig|d-modsig|modsig``; |
---|
81 | 85 | |
---|
82 | 86 | |
---|
83 | 87 | Use |
---|