procMapValuer returns the map valuer with process attributes.
(segments []*BoundSegmentLiteral, proc *pstypes.PS)
| 467 | |
| 468 | // procMapValuer returns the map valuer with process attributes. |
| 469 | func (f *Foreach) procMapValuer(segments []*BoundSegmentLiteral, proc *pstypes.PS) MapValuer { |
| 470 | var valuer = MapValuer{} |
| 471 | for _, seg := range segments { |
| 472 | key := seg.Value |
| 473 | switch seg.Segment { |
| 474 | case fields.PIDSegment: |
| 475 | valuer[key] = proc.PID |
| 476 | case fields.NameSegment: |
| 477 | valuer[key] = proc.Name |
| 478 | case fields.ExeSegment: |
| 479 | valuer[key] = proc.Exe |
| 480 | case fields.CmdlineSegment: |
| 481 | valuer[key] = proc.Cmdline |
| 482 | case fields.ArgsSegment: |
| 483 | valuer[key] = proc.Args |
| 484 | case fields.CwdSegment: |
| 485 | valuer[key] = proc.Cwd |
| 486 | case fields.SIDSegment: |
| 487 | valuer[key] = proc.SID |
| 488 | case fields.SessionIDSegment: |
| 489 | valuer[key] = proc.SessionID |
| 490 | case fields.UsernameSegment: |
| 491 | valuer[key] = proc.Username |
| 492 | case fields.DomainSegment: |
| 493 | valuer[key] = proc.Domain |
| 494 | case fields.TokenIntegrityLevelSegment: |
| 495 | valuer[key] = proc.TokenIntegrityLevel |
| 496 | case fields.TokenIsElevatedSegment: |
| 497 | valuer[key] = proc.IsTokenElevated |
| 498 | case fields.TokenElevationTypeSegment: |
| 499 | valuer[key] = proc.TokenElevationType |
| 500 | } |
| 501 | } |
| 502 | return valuer |
| 503 | } |
| 504 | |
| 505 | // threadMapValuer returns the map valuer with thread information. |
| 506 | func (f *Foreach) threadMapValuer(segments []*BoundSegmentLiteral, thread pstypes.Thread) MapValuer { |