Method OnlyState

pkg/event/types_windows.go:524–544

OnlyState determines whether the event type is solely used for state management.

()

// OnlyState determines whether the event type is solely used for state management.
func (t Type) OnlyState() bool {
	switch t {
	case ProcessRundown,
		ProcessRundownInternal,
		CreateProcessInternal,
		ThreadRundown,
		ModuleRundown,
		LoadModuleInternal,
		FileRundown,
		RegKCBRundown,
		FileOpEnd,
		ReleaseFile,
		MapFileRundown,
		RegCreateKCB,
		RegDeleteKCB,
		RegSetValueInternal:
		return true
	default:
		return false
	}
}

// CanEnrichStack determines if the event can be enriched with a callstack.
func (t Type) CanEnrichStack() bool {