Feature Request: Additional Variables for EventDetailURL

[manuelnasenspray]

Summary:

I would like to request that more fields be made available for use in the EventDetailURL feature of Santa. Specifically, the following additional variables would be highly useful in constructing URLs for further event investigation:

Requested Fields:

•	Application Name: The name of the application that was blocked.
•	Application Path: The full path to the blocked application.
•	Publisher: The developer or team that signed the application.
•	Identifier: A unique identifier for the application (e.g., a hash or other identifying info related to the application).
•	Parent Process: The parent process that invoked the blocked application.

These fields would help provide more context about blocked events when linked to external investigation systems or dashboards.

Use Case:

In security environments, knowing the application name, path, publisher, and parent process involved in a blocked event provides additional clarity, especially in automated analysis or when viewing the details in a centralized security management system.

Thank you for considering this feature request!