Is the description for this module still OK, or does it need amending to reflect the new mix of jobs in this module?

@randomuserid how would you like this to be updated?

I don't see why that description cannot apply to the new Linux jobs

great - leaving it as is

As above, is the description for the winlogbeat module still ok?

we could remove the words "process and network" because we have branched out to additional event types

@randomuserid do you want to update this? This is what a user sees when interacting with the module via the ML ui.

Why don't we leave it alone for now. When we have a decision on multi-index Windows events we can rewrite them then.

If we want to limit the job to 4 influencers for this linux_rare_kernel_module_arguments job, is it better to use process.title in place of process.working_directory? The Anomaly Explorer won't list process.title as a swim lane 'view by' option or in the left hand Top Influencers list otherwise.

It's my understanding that for this analysis, it's valuable to know the location (i.e. process.working_directory) from which the process is being executed. @randomuserid, if we had to choose between swapping either process.name or process.working_directory for process.title as an influencer, which do you think should go? Here's some example data:

"process" : {
            "title" : "/bin/sh -e /usr/share/initramfs-tools/hooks/kmod prereqs",
            "name" : "kmod",
            "working_directory" : "/"
}

Note that if we choose to swap out process.name then the two custom URLs that use process.name should be deleted (unless they also work with process.title?).

Process.name is probably the best one to cut because it will tend to show up in the process.title field & the data feed is limited to a few kernel module related processes by name so process name will always be one of those.

spoke with @randomuserid. process.name is limited to just 4 processes because of the datafeed query, so let's swap it out for process.title in the influencer list. As @peteharverson mentioned, this means we'll need to remove the custom urls that utilize process.name. I'll make the change.