Source designates the provenance of this event type.
()
| 608 | |
| 609 | // Source designates the provenance of this event type. |
| 610 | func (t Type) Source() Source { |
| 611 | switch t.GUID() { |
| 612 | case AuditAPIEventGUID, DNSEventGUID, ThreadpoolGUID, ProcessKernelEventGUID, RegistryKernelEventGUID: |
| 613 | return SecurityTelemetryLogger |
| 614 | default: |
| 615 | return SystemLogger |
| 616 | } |
| 617 | } |
| 618 | |
| 619 | // TypeFromParts builds the event type from provider GUID and hook ID. |
| 620 | func TypeFromParts(g windows.GUID, id uint16) Type { return pack(g, id) } |