المراقبة وربط الأدلة

events = [
    {"event_id": 5136, "operation": "synthetic-op-1", "phase": "value_deleted"},
    {"event_id": 5136, "operation": "synthetic-op-1", "phase": "value_added"},
    {"event_id": 4768, "operation": "synthetic-auth-2", "phase": "ticket_request"},
]
changes = [event for event in events if event["event_id"] == 5136]
operations = {event["operation"] for event in changes}
print("events=" + str(len(changes)), "operations=" + str(len(operations)))

events=2 operations=1

السطر events=2 operations=1 دون قراءة حدث أو هوية أو دليل أو مادة مصادقة حية.

{"question":"was-the-reviewed-object-change-accountable","sources":["authorized_change_record","sanitized_directory_events","replication_context"],"excluded":["credentials","secret_attributes","unbounded_directory_dump"],"collection_action":"none"}

يحدد الفئات والاستبعاد دون تفعيل أو جلب أو ادعاء أمان حي.