refactor(filter): Make path filter fields consistent

internal/etw/processors/fs_windows.go

@@ -128,15 +128,15 @@ func (f *fsProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, error) {
 	case ktypes.FileRundown:
 		// when the file rundown event comes in we store the file info
 		// in internal state in order to augment the rest of file events
-		// that lack the file name field
-		filename := e.GetParamAsString(kparams.FileName)
+		// that lack the file path field
+		filepath := e.GetParamAsString(kparams.FilePath)
 		fileObject, err := e.Kparams.GetUint64(kparams.FileObject)
 		if err != nil {
 			return nil, err
 		}
 		if _, ok := f.files[fileObject]; !ok {
 			totalRundownFiles.Add(1)
-			f.files[fileObject] = &FileInfo{Name: filename, Type: fs.GetFileType(filename, 0)}
+			f.files[fileObject] = &FileInfo{Name: filepath, Type: fs.GetFileType(filepath, 0)}
 		}
 	case ktypes.MapFileRundown:
 		// if the memory-mapped view refers to the image/data file
@@ -166,7 +166,7 @@ func (f *fsProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, error) {
 			name := f.devMapper.Convert(sys.GetMappedFile(process, uintptr(addr)))
 			f.mmaps[e.PID][fileKey] = &MmapInfo{File: name, BaseAddr: viewBase, Size: viewSize}
 		}
-		e.AppendParam(kparams.FileName, kparams.FilePath, f.mmaps[e.PID][fileKey].File)
+		e.AppendParam(kparams.FilePath, kparams.Path, f.mmaps[e.PID][fileKey].File)
 		return e, f.psnap.AddFileMapping(e)
 	case ktypes.CreateFile:
 		// we defer the processing of the CreateFile event until we get
@@ -207,12 +207,12 @@ func (f *fsProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, error) {
 		if !ok {
 			opts := ev.Kparams.MustGetUint32(kparams.FileCreateOptions)
 			opts &= 0xFFFFFF
-			filename := ev.GetParamAsString(kparams.FileName)
-			fileinfo = f.getFileInfo(filename, opts)
+			filepath := ev.GetParamAsString(kparams.FilePath)
+			fileinfo = f.getFileInfo(filepath, opts)
 			f.files[fileObject] = fileinfo
 		}
 		if f.config.Kstream.EnableHandleKevents {
-			f.devPathResolver.AddPath(ev.GetParamAsString(kparams.FileName))
+			f.devPathResolver.AddPath(ev.GetParamAsString(kparams.FilePath))
 		}
 		ev.AppendParam(kparams.NTStatus, kparams.Status, status)
 		if fileinfo.Type != fs.Unknown {
@@ -262,7 +262,7 @@ func (f *fsProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, error) {
 		}
 		mmapinfo := f.mmaps[e.PID][fileKey]
 		if mmapinfo != nil {
-			e.AppendParam(kparams.FileName, kparams.FilePath, mmapinfo.File)
+			e.AppendParam(kparams.FilePath, kparams.Path, mmapinfo.File)
 		}
 		totalMapRundownFiles.Add(-1)
 		delete(f.mmaps[e.PID], fileKey)
@@ -300,7 +300,7 @@ func (f *fsProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, error) {
 			name := f.devMapper.Convert(sys.GetMappedFile(process, uintptr(addr)))
 			f.initMmap(e.PID)
 			f.mmaps[e.PID][fileKey] = &MmapInfo{File: name, BaseAddr: viewBase, Size: viewSize}
-			e.AppendParam(kparams.FileName, kparams.FilePath, name)
+			e.AppendParam(kparams.FilePath, kparams.Path, name)
 			return e, f.psnap.AddFileMapping(e)
 		}
 
@@ -313,15 +313,15 @@ func (f *fsProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, error) {
 		}
 		if e.IsEnumDirectory() {
 			if fileinfo != nil {
-				e.AppendParam(kparams.FileDirectory, kparams.FilePath, fileinfo.Name)
+				e.AppendParam(kparams.FileDirectory, kparams.Path, fileinfo.Name)
 			}
 			return e, nil
 		}
 		if fileinfo != nil {
 			if fileinfo.Type != fs.Unknown {
 				e.AppendEnum(kparams.FileType, uint32(fileinfo.Type), fs.FileTypes)
 			}
-			e.AppendParam(kparams.FileName, kparams.FilePath, fileinfo.Name)
+			e.AppendParam(kparams.FilePath, kparams.Path, fileinfo.Name)
 		}
 		if e.IsMapViewFile() {
 			return e, f.psnap.AddFileMapping(e)

internal/etw/processors/fs_windows_test.go

@@ -50,7 +50,7 @@ func TestFsProcessor(t *testing.T) {
 				Category: ktypes.File,
 				Kparams: kevent.Kparams{
 					kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: uint64(124567380264)},
-					kparams.FileName:   {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"},
+					kparams.FilePath:   {Name: kparams.FilePath, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"},
 				},
 			},
 			nil,
@@ -106,7 +106,7 @@ func TestFsProcessor(t *testing.T) {
 					kparams.FileObject:        {Name: kparams.FileObject, Type: kparams.Uint64, Value: uint64(18446738026482168384)},
 					kparams.ThreadID:          {Name: kparams.ThreadID, Type: kparams.Uint32, Value: uint32(1484)},
 					kparams.FileCreateOptions: {Name: kparams.FileCreateOptions, Type: kparams.Uint32, Value: uint32(1223456)},
-					kparams.FileName:          {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\kernel32.dll"},
+					kparams.FilePath:          {Name: kparams.FilePath, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\kernel32.dll"},
 					kparams.FileShareMask:     {Name: kparams.FileShareMask, Type: kparams.Uint32, Value: uint32(5)},
 					kparams.FileIrpPtr:        {Name: kparams.FileIrpPtr, Type: kparams.Uint64, Value: uint64(1234543123112321)},
 				},
@@ -143,7 +143,7 @@ func TestFsProcessor(t *testing.T) {
 					Kparams: kevent.Kparams{
 						kparams.FileObject:        {Name: kparams.FileObject, Type: kparams.Uint64, Value: uint64(12446738026482168384)},
 						kparams.FileCreateOptions: {Name: kparams.FileCreateOptions, Type: kparams.Uint32, Value: uint32(18874368)},
-						kparams.FileName:          {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "C:\\Windows\\temp\\idxx.exe"},
+						kparams.FilePath:          {Name: kparams.FilePath, Type: kparams.UnicodeString, Value: "C:\\Windows\\temp\\idxx.exe"},
 						kparams.FileShareMask:     {Name: kparams.FileShareMask, Type: kparams.Uint32, Value: uint32(5)},
 						kparams.FileIrpPtr:        {Name: kparams.FileIrpPtr, Type: kparams.Uint64, Value: uint64(1334543123112321)},
 					},
@@ -212,7 +212,7 @@ func TestFsProcessor(t *testing.T) {
 			},
 			func(e *kevent.Kevent, t *testing.T, hsnap *handle.SnapshotterMock, p Processor) {
 				fsProcessor := p.(*fsProcessor)
-				assert.True(t, e.Kparams.Contains(kparams.FileName))
+				assert.True(t, e.Kparams.Contains(kparams.FilePath))
 				assert.Nil(t, fsProcessor.mmaps[3098][124567380264])
 			},
 		},
@@ -237,8 +237,8 @@ func TestFsProcessor(t *testing.T) {
 			},
 			func(e *kevent.Kevent, t *testing.T, hsnap *handle.SnapshotterMock, p Processor) {
 				assert.Equal(t, ktypes.WriteFile, e.Type)
-				assert.Contains(t, e.Kparams, kparams.FileName, kparams.FileType)
-				assert.Equal(t, "C:\\Windows\\temp\\idxx.exe", e.GetParamAsString(kparams.FileName))
+				assert.Contains(t, e.Kparams, kparams.FilePath, kparams.FileType)
+				assert.Equal(t, "C:\\Windows\\temp\\idxx.exe", e.GetParamAsString(kparams.FilePath))
 				assert.Equal(t, "File", e.GetParamAsString(kparams.FileType))
 			},
 		},
@@ -262,8 +262,8 @@ func TestFsProcessor(t *testing.T) {
 			func(e *kevent.Kevent, t *testing.T, hsnap *handle.SnapshotterMock, p Processor) {
 				assert.Equal(t, ktypes.WriteFile, e.Type)
 				hsnap.AssertNumberOfCalls(t, "FindByObject", 1)
-				assert.Contains(t, e.Kparams, kparams.FileName, kparams.FileType)
-				assert.Equal(t, "C:\\Windows\\temp\\doc.docx", e.GetParamAsString(kparams.FileName))
+				assert.Contains(t, e.Kparams, kparams.FilePath, kparams.FileType)
+				assert.Equal(t, "C:\\Windows\\temp\\doc.docx", e.GetParamAsString(kparams.FilePath))
 				assert.Equal(t, "File", e.GetParamAsString(kparams.FileType))
 			},
 		},
@@ -275,7 +275,7 @@ func TestFsProcessor(t *testing.T) {
 				Kparams: kevent.Kparams{
 					kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: uint64(18446738026482168384)},
 					kparams.FileKey:    {Name: kparams.FileKey, Type: kparams.Uint64, Value: uint64(14446538026482168384)},
-					kparams.FileName:   {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "*"},
+					kparams.FilePath:   {Name: kparams.FilePath, Type: kparams.UnicodeString, Value: "*"},
 				},
 			},
 			func(p Processor) {
@@ -288,7 +288,7 @@ func TestFsProcessor(t *testing.T) {
 			},
 			func(e *kevent.Kevent, t *testing.T, hsnap *handle.SnapshotterMock, p Processor) {
 				assert.Equal(t, ktypes.EnumDirectory, e.Type)
-				assert.Contains(t, e.Kparams, kparams.FileName, kparams.FileDirectory)
+				assert.Contains(t, e.Kparams, kparams.FilePath, kparams.FileDirectory)
 				assert.Equal(t, "C:\\Windows\\temp", e.GetParamAsString(kparams.FileDirectory))
 			},
 		},

internal/etw/processors/handle_windows.go

@@ -64,7 +64,7 @@ func (h *handleProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, error)
 		pid := e.Kparams.MustGetPid()
 		proc := h.psnap.FindAndPut(pid)
 		if proc != nil {
-			e.AppendParam(kparams.Exe, kparams.FilePath, proc.Exe)
+			e.AppendParam(kparams.Exe, kparams.Path, proc.Exe)
 			e.AppendParam(kparams.ProcessName, kparams.AnsiString, proc.Name)
 		}
 		return e, nil
@@ -93,7 +93,7 @@ func (h *handleProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, error)
 				driverPath = driverName
 			}
 			h.devPathResolver.RemovePath(driverName)
-			e.Kparams.Append(kparams.ImageFilename, kparams.FilePath, driverPath)
+			e.Kparams.Append(kparams.ImagePath, kparams.Path, driverPath)
 		}
 		// assign the formatted handle name
 		if err := e.Kparams.SetValue(kparams.HandleObjectName, name); err != nil {

internal/etw/processors/image_windows.go

@@ -44,7 +44,7 @@ func (m *imageProcessor) ProcessEvent(e *kevent.Kevent) (*kevent.Kevent, bool, e
 	}
 	if e.IsUnloadImage() {
 		pid := e.Kparams.MustGetPid()
-		mod := e.GetParamAsString(kparams.ImageFilename)
+		mod := e.GetParamAsString(kparams.ImagePath)
 		if pid == 0 {
 			pid = e.PID
 		}

internal/etw/processors/image_windows_test.go

@@ -44,7 +44,7 @@ func TestImageProcessor(t *testing.T) {
 			&kevent.Kevent{
 				Type: ktypes.LoadImage,
 				Kparams: kevent.Kparams{
-					kparams.ImageFilename:       {Name: kparams.ImageFilename, Type: kparams.UnicodeString, Value: filepath.Join(os.Getenv("windir"), "System32", "kernel32.dll")},
+					kparams.ImagePath:           {Name: kparams.ImagePath, Type: kparams.UnicodeString, Value: filepath.Join(os.Getenv("windir"), "System32", "kernel32.dll")},
 					kparams.ProcessID:           {Name: kparams.ProcessID, Type: kparams.PID, Value: uint32(1023)},
 					kparams.ImageCheckSum:       {Name: kparams.ImageCheckSum, Type: kparams.Uint32, Value: uint32(2323432)},
 					kparams.ImageBase:           {Name: kparams.ImageBase, Type: kparams.Address, Value: uint64(0x7ffb313833a3)},
@@ -69,7 +69,7 @@ func TestImageProcessor(t *testing.T) {
 			&kevent.Kevent{
 				Type: ktypes.UnloadImage,
 				Kparams: kevent.Kparams{
-					kparams.ImageFilename:       {Name: kparams.ImageFilename, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\kernel32.dll"},
+					kparams.ImagePath:           {Name: kparams.ImagePath, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\kernel32.dll"},
 					kparams.ProcessName:         {Name: kparams.ProcessName, Type: kparams.AnsiString, Value: "csrss.exe"},
 					kparams.ProcessID:           {Name: kparams.ProcessID, Type: kparams.PID, Value: uint32(676)},
 					kparams.ImageBase:           {Name: kparams.ImageBase, Type: kparams.Address, Value: uint64(0xfffb313833a3)},

internal/etw/processors/mem_windows.go

@@ -60,7 +60,7 @@ func (m memProcessor) ProcessEvent(e *kevent.Kevent) (*kevent.Kevent, bool, erro
 			region := m.regionProber.Query(pid, addr)
 			if region != nil {
 				if region.IsMapped() {
-					e.AppendParam(kparams.FileName, kparams.FileDosPath, region.GetMappedFile())
+					e.AppendParam(kparams.FilePath, kparams.DOSPath, region.GetMappedFile())
 				}
 				e.AppendEnum(kparams.MemPageType, region.Type, MemPageTypes)
 				e.AppendFlags(kparams.MemProtect, region.Protect, kevent.MemProtectionFlags)
@@ -69,7 +69,7 @@ func (m memProcessor) ProcessEvent(e *kevent.Kevent) (*kevent.Kevent, bool, erro
 		}
 		proc := m.psnap.FindAndPut(pid)
 		if proc != nil {
-			e.AppendParam(kparams.Exe, kparams.FilePath, proc.Exe)
+			e.AppendParam(kparams.Exe, kparams.Path, proc.Exe)
 			e.AppendParam(kparams.ProcessName, kparams.AnsiString, proc.Name)
 		}
 		return e, false, nil

internal/etw/processors/processor.go

@@ -93,7 +93,7 @@ func (typ ProcessorType) String() string {
 // executable image, or a Windows driver.
 func parseImageFileCharacteristics(e *kevent.Kevent) error {
 	var pefile *pe.PE
-	filename := e.GetParamAsString(kparams.FileName)
+	filename := e.GetParamAsString(kparams.FilePath)
 	f, err := os.Open(filename)
 	if err != nil {
 		// read file data blob from raw device

internal/etw/processors/ps_windows.go

@@ -73,7 +73,7 @@ func (p psProcessor) ProcessEvent(e *kevent.Kevent) (*kevent.Kevent, bool, error
 		}
 		proc := p.psnap.FindAndPut(pid)
 		if proc != nil {
-			e.AppendParam(kparams.Exe, kparams.FilePath, proc.Exe)
+			e.AppendParam(kparams.Exe, kparams.Path, proc.Exe)
 			e.AppendParam(kparams.ProcessName, kparams.AnsiString, proc.Name)
 		}
 		return e, false, nil
@@ -97,7 +97,7 @@ func (p psProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, error) {
 	if exe == "" {
 		exe = e.GetParamAsString(kparams.ProcessName)
 	}
-	e.AppendParam(kparams.Exe, kparams.FilePath, exe)
+	e.AppendParam(kparams.Exe, kparams.Path, exe)
 
 	if e.IsTerminateProcess() {
 		return e, nil

internal/etw/processors/registry_windows.go

@@ -88,7 +88,7 @@ func (r *registryProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, erro
 	case ktypes.RegKCBRundown, ktypes.RegCreateKCB:
 		khandle := e.Kparams.MustGetUint64(kparams.RegKeyHandle)
 		if _, ok := r.keys[khandle]; !ok {
-			r.keys[khandle], _ = e.Kparams.GetString(kparams.RegKeyName)
+			r.keys[khandle], _ = e.Kparams.GetString(kparams.RegPath)
 		}
 		kcbCount.Add(1)
 	case ktypes.RegDeleteKCB:
@@ -106,15 +106,15 @@ func (r *registryProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, erro
 		// last resort is to scan process' handles and check if any of the
 		// key handles contain the partial key name. In this case we assume
 		// the correct key is encountered.
-		keyName := e.Kparams.MustGetString(kparams.RegKeyName)
+		keyName := e.Kparams.MustGetString(kparams.RegPath)
 		if khandle != 0 {
 			if baseKey, ok := r.keys[khandle]; ok {
 				keyName = baseKey + "\\" + keyName
 			} else {
 				kcbMissCount.Add(1)
 				keyName = r.findMatchingKey(e.PID, keyName)
 			}
-			if err := e.Kparams.SetValue(kparams.RegKeyName, keyName); err != nil {
+			if err := e.Kparams.SetValue(kparams.RegPath, keyName); err != nil {
 				return e, err
 			}
 		}

internal/etw/processors/registry_windows_test.go

@@ -43,7 +43,7 @@ func TestRegistryProcessor(t *testing.T) {
 				Type:     ktypes.RegKCBRundown,
 				Category: ktypes.Registry,
 				Kparams: kevent.Kparams{
-					kparams.RegKeyName:   {Name: kparams.RegKeyName, Type: kparams.UnicodeString, Value: `\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bthserv\Parameters`},
+					kparams.RegPath:      {Name: kparams.RegPath, Type: kparams.UnicodeString, Value: `\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bthserv\Parameters`},
 					kparams.RegKeyHandle: {Name: kparams.RegKeyHandle, Type: kparams.Uint64, Value: uint64(18446666033549154696)},
 				},
 			},
@@ -64,7 +64,7 @@ func TestRegistryProcessor(t *testing.T) {
 				Type:     ktypes.RegDeleteKCB,
 				Category: ktypes.Registry,
 				Kparams: kevent.Kparams{
-					kparams.RegKeyName:   {Name: kparams.RegKeyName, Type: kparams.UnicodeString, Value: `\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bthserv\Parameters`},
+					kparams.RegPath:      {Name: kparams.RegPath, Type: kparams.UnicodeString, Value: `\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bthserv\Parameters`},
 					kparams.RegKeyHandle: {Name: kparams.RegKeyHandle, Type: kparams.Uint64, Value: uint64(18446666033549154696)},
 				},
 			},
@@ -86,7 +86,7 @@ func TestRegistryProcessor(t *testing.T) {
 				Type:     ktypes.RegOpenKey,
 				Category: ktypes.Registry,
 				Kparams: kevent.Kparams{
-					kparams.RegKeyName:   {Name: kparams.RegKeyName, Type: kparams.Key, Value: `\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bthserv\Parameters`},
+					kparams.RegPath:      {Name: kparams.RegPath, Type: kparams.Key, Value: `\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bthserv\Parameters`},
 					kparams.RegKeyHandle: {Name: kparams.RegKeyHandle, Type: kparams.Uint64, Value: uint64(0)},
 				},
 			},
@@ -96,7 +96,7 @@ func TestRegistryProcessor(t *testing.T) {
 				return hsnap
 			},
 			func(e *kevent.Kevent, t *testing.T, hsnap *handle.SnapshotterMock, p Processor) {
-				assert.Equal(t, `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bthserv\Parameters`, e.GetParamAsString(kparams.RegKeyName))
+				assert.Equal(t, `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bthserv\Parameters`, e.GetParamAsString(kparams.RegPath))
 			},
 		},
 		{
@@ -105,7 +105,7 @@ func TestRegistryProcessor(t *testing.T) {
 				Type:     ktypes.RegOpenKey,
 				Category: ktypes.Registry,
 				Kparams: kevent.Kparams{
-					kparams.RegKeyName:   {Name: kparams.RegKeyName, Type: kparams.Key, Value: `Pid`},
+					kparams.RegPath:      {Name: kparams.RegPath, Type: kparams.Key, Value: `Pid`},
 					kparams.RegKeyHandle: {Name: kparams.RegKeyHandle, Type: kparams.Uint64, Value: uint64(18446666033549154696)},
 				},
 			},
@@ -117,7 +117,7 @@ func TestRegistryProcessor(t *testing.T) {
 				return hsnap
 			},
 			func(e *kevent.Kevent, t *testing.T, hsnap *handle.SnapshotterMock, p Processor) {
-				assert.Equal(t, `HKEY_LOCAL_MACHINE\SYSTEM\Setup\Pid`, e.GetParamAsString(kparams.RegKeyName))
+				assert.Equal(t, `HKEY_LOCAL_MACHINE\SYSTEM\Setup\Pid`, e.GetParamAsString(kparams.RegPath))
 			},
 		},
 		{
@@ -127,7 +127,7 @@ func TestRegistryProcessor(t *testing.T) {
 				Category: ktypes.Registry,
 				PID:      23234,
 				Kparams: kevent.Kparams{
-					kparams.RegKeyName:   {Name: kparams.RegKeyName, Type: kparams.Key, Value: `Pid`},
+					kparams.RegPath:      {Name: kparams.RegPath, Type: kparams.Key, Value: `Pid`},
 					kparams.RegKeyHandle: {Name: kparams.RegKeyHandle, Type: kparams.Uint64, Value: uint64(18446666033549154696)},
 				},
 			},
@@ -140,7 +140,7 @@ func TestRegistryProcessor(t *testing.T) {
 			},
 			func(e *kevent.Kevent, t *testing.T, hsnap *handle.SnapshotterMock, p Processor) {
 				hsnap.AssertNumberOfCalls(t, "FindHandles", 1)
-				assert.Equal(t, `HKEY_LOCAL_MACHINE\SYSTEM\Setup\Pid`, e.GetParamAsString(kparams.RegKeyName))
+				assert.Equal(t, `HKEY_LOCAL_MACHINE\SYSTEM\Setup\Pid`, e.GetParamAsString(kparams.RegPath))
 			},
 		},
 		{
@@ -150,7 +150,7 @@ func TestRegistryProcessor(t *testing.T) {
 				Category: ktypes.Registry,
 				PID:      23234,
 				Kparams: kevent.Kparams{
-					kparams.RegKeyName:   {Name: kparams.RegKeyName, Type: kparams.Key, Value: `\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control\Windows\Directory`},
+					kparams.RegPath:      {Name: kparams.RegPath, Type: kparams.Key, Value: `\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control\Windows\Directory`},
 					kparams.RegKeyHandle: {Name: kparams.RegKeyHandle, Type: kparams.Uint64, Value: uint64(0)},
 				},
 			},
@@ -160,7 +160,7 @@ func TestRegistryProcessor(t *testing.T) {
 				return hsnap
 			},
 			func(e *kevent.Kevent, t *testing.T, hsnap *handle.SnapshotterMock, p Processor) {
-				assert.Equal(t, `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows\Directory`, e.GetParamAsString(kparams.RegKeyName))
+				assert.Equal(t, `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows\Directory`, e.GetParamAsString(kparams.RegPath))
 				assert.Equal(t, `REG_EXPAND_SZ`, e.GetParamAsString(kparams.RegValueType))
 				assert.Equal(t, `%SystemRoot%`, e.GetParamAsString(kparams.RegValue))
 			},