Refactor

Component(s) to be refactored

• Ransomware payload
• FileEncryptionTelem

Explanation

Telemetries are being replaced by events. Replace FileEncryptionTelem with FileEncryptedEvent.

FileEncryptedEvent

class FileEncryptedEvent(AbstractAgentEvent):
    file_path: PurePath
    success: bool
    error_message: str = Field(default="")

Tasks

• Create FileEncryptedEvent (0d) @ilija-lazoroski
• Publish FileEncryptedEvent from the ransomware payload (0d) @ilija-lazoroski
  • Tag with the appropriate MITRE attack technique (T1486? Others?)
• Modify the ransomware report to use events instead of telemetry (0d) - @shreyamalviya
• Remove FileEncryptionTelem (0d) @mssalvatore
  • Remove BatchingTelemetryMessenger