Why did flag_regex, flag_hash and attack_info end up in the EnoLogMessage?

[Trolldemorted]

enochecker_core/enochecker_core/__init__.py

Lines 67 to 69 in 2f064c8

	flag_regex: Optional[str]
	flag_hash: Optional[str]
	attack_info: Optional[str]

[ldruschk]

Personally I found this useful for debugging. But it could be argued that in the cases where we are running the exploit method we are not using an ELK. Does this cause any issues in ELK?

[Trolldemorted]

Any field name also shows up in FTS results (because it is present as a substring in the raw message which contains the json string), so you want to keep the fields to a minimum