Process arguments

[simplepad]

Hello OCSF team,

I have a question about the process object. I see that it has an attribute called cmd_line, which is said to represent "The full command line used to launch an application, service, process, or job." However, using unix as an example, on the syscall level, process command line is represented as an array of strings, not as one string.

Wouldn't having an attribute like that allow us to more easily search for events with certain arguments without using complex regex?

This would be especially useful for commands with arguments that have special symbols (like spaces) that make it harder to correctly split it back into separate arguments.