| .. | .. |
|---|
| 68 | 68 | - 'd-ng': the digest of the event, calculated with an arbitrary hash |
|---|
| 69 | 69 | algorithm (field format: [<hash algo>:]digest, where the digest |
|---|
| 70 | 70 | prefix is shown only if the hash algorithm is not SHA1 or MD5); |
|---|
| 71 | + - 'd-modsig': the digest of the event without the appended modsig; |
|---|
| 71 | 72 | - 'n-ng': the name of the event, without size limitations; |
|---|
| 72 | | - - 'sig': the file signature. |
|---|
| 73 | + - 'sig': the file signature; |
|---|
| 74 | + - 'modsig' the appended file signature; |
|---|
| 75 | + - 'buf': the buffer data that was used to generate the hash without size limitations; |
|---|
| 73 | 76 | |
|---|
| 74 | 77 | |
|---|
| 75 | 78 | Below, there is the list of defined template descriptors: |
|---|
| 76 | 79 | |
|---|
| 77 | 80 | - "ima": its format is ``d|n``; |
|---|
| 78 | 81 | - "ima-ng" (default): its format is ``d-ng|n-ng``; |
|---|
| 79 | | - - "ima-sig": its format is ``d-ng|n-ng|sig``. |
|---|
| 80 | | - |
|---|
| 82 | + - "ima-sig": its format is ``d-ng|n-ng|sig``; |
|---|
| 83 | + - "ima-buf": its format is ``d-ng|n-ng|buf``; |
|---|
| 84 | + - "ima-modsig": its format is ``d-ng|n-ng|sig|d-modsig|modsig``; |
|---|
| 81 | 85 | |
|---|
| 82 | 86 | |
|---|
| 83 | 87 | Use |
|---|