Method narrowAccessors

pkg/filter/accessor.go:154–240

narrowAccessors dynamically disables filter accessors by walking the fields declared in the expression. The field can be expressed as a regular LHS/RHS component, used as a function parameter or referenced in the bound field.

()

// as a regular LHS/RHS component, used as a function parameter or
// referenced in the bound field.
func (f *filter) narrowAccessors() {
	var (
		removeEvtAccessor        = true
		removePsAccessor         = true
		removeThreadAccessor     = true
		removeModuleAccessor     = true
		removeFileAccessor       = true
		removeRegistryAccessor   = true
		removeNetworkAccessor    = true
		removeHandleAccessor     = true
		removePEAccessor         = true
		removeMemAccessor        = true
		removeDNSAccessor        = true
		removeThreadpoolAccessor = true
	)

	for _, field := range f.fields {
		switch {
		case field.Name.IsEvtField() || field.Name.IsKevtField():
			removeEvtAccessor = false
		case field.Name.IsPeField():
			removePEAccessor = false
		case field.Name.IsPsField():
			removePsAccessor = false
		case field.Name.IsThreadField():
			removeThreadAccessor = false
		case field.Name.IsImageField() || field.Name.IsModuleField():
			removeModuleAccessor = false
		case field.Name.IsFileField():
			removeFileAccessor = false
		case field.Name.IsRegistryField():
			removeRegistryAccessor = false
		case field.Name.IsNetworkField():
			removeNetworkAccessor = false
		case field.Name.IsHandleField():
			removeHandleAccessor = false
		case field.Name.IsMemField():
			removeMemAccessor = false
		case field.Name.IsDNSField():
			removeDNSAccessor = false
		case field.Name.IsThreadpoolField():
			removeThreadpoolAccessor = false
		}
	}

	if removeEvtAccessor {
		f.removeAccessor(&evtAccessor{})
	}
	if removePsAccessor {
		f.removeAccessor(&psAccessor{})
	}
	if removeThreadAccessor {
		f.removeAccessor(&threadAccessor{})
	}
	if removeModuleAccessor {
		f.removeAccessor(&moduleAccessor{})
	}
	if removeFileAccessor {