CanEnrichStack determines if the event can be enriched with a callstack.
()
| 545 | |
| 546 | // CanEnrichStack determines if the event can be enriched with a callstack. |
| 547 | func (t Type) CanEnrichStack() bool { |
| 548 | switch t { |
| 549 | case CreateProcess, |
| 550 | CreateThread, |
| 551 | TerminateThread, |
| 552 | LoadModule, |
| 553 | RegCreateKey, |
| 554 | RegDeleteKey, |
| 555 | RegSetValue, |
| 556 | RegDeleteValue, |
| 557 | DeleteFile, |
| 558 | RenameFile, |
| 559 | VirtualAlloc, |
| 560 | SubmitThreadpoolWork, |
| 561 | SubmitThreadpoolCallback, |
| 562 | SetThreadpoolTimer: |
| 563 | return true |
| 564 | default: |
| 565 | return false |
| 566 | } |
| 567 | } |
| 568 | |
| 569 | // UnmarshalYAML converts the Type name to Type array type. |
| 570 | func (t *Type) UnmarshalYAML(unmarshal func(interface{}) error) error { |