Rename ransomware telem #1273
Rename ransomware telem #1273
Conversation
Ransomware will soon do more than just encrypt files. We should give the telemetry that's related to encrypting files a more descriptive name that better describes what it is reporting.
475596c to
49eb1cd
Compare
Codecov Report
@@ Coverage Diff @@
## batchable-telemetry #1273 +/- ##
====================================================
Coverage 30.59% 30.59%
====================================================
Files 448 448
Lines 13417 13417
====================================================
Hits 4105 4105
Misses 9312 9312
Continue to review full report at Codecov.
|
|
|
||
| def get_data(self): | ||
| return {"ransomware_attempts": self._telemetry_entries} | ||
| return {"files": self._telemetry_entries} |
There was a problem hiding this comment.
Wouldn't something like encryption_attempts better explain this? The telem contains files and their encryption attempt results, not just files.
There was a problem hiding this comment.
I don't think so. I feel like encryption_attempts assumes failure, while files assumes success. encryption_attempts isn't really clear about what it contains. What does an "encryption attempt" involve? Timestamps? Scope? "file_encryption -> files" seems pretty clear to me: it contains information about the files that were encrypted.
I'm no UX expert, though, and I'm not the best at naming. We can have a longer debate about this.
There was a problem hiding this comment.
@shreyamalviya have agreed this is good enough for now, but will be revisited when we establish patterns and conventions for Action plugins (which don't exist right now).
What does this PR do?
Ransomware will soon do more than just encrypt files. We should give the telemetry that's related to encrypting files a more descriptive name that better describes what it is reporting.
PR Checklist
Was the CHANGELOG.md updated to reflect the changes?Was the documentation framework updated to reflect the changes?Testing Checklist
Screenshots