cyberark / rpcmon Goto Github PK

Summary

When using more than one filtering rule, it will hide our include rule if the other rules are after the first one that match.

I will explain by example.
We have row that has PID=1.
We have two rules:

1. Include PID 1
2. Include PID 2

On the first rule it will mark it as visible but in the second rule it will see that PID(1) != PID(2) and therefore hide it.

Steps to Reproduce

See above for the example

Expected Results

A clear and concise description of what you expected to happen.

Actual Results

We should mark the first matched rule with a flag and prevent hiding it.

Reproducible

• Always
• Sometimes
• Non-Reproducible

Version/Tag number

What version of the product are you running? Any version info that you can
share is helpful. For example, you might give the version from Docker logs,
the Docker tag, a specific download URL, the output of the /info route, etc.

Environment setup

• Can you describe the environment in which this product is running? Is it running on a VM / in a container / in a cloud?
• Which cloud provider? Which container orchestrator (including version)?
• The more info you can share about your runtime environment, the better we may be able to reproduce the issue.

Additional Information

Add any other context about the problem here.

Is your feature request related to a problem? Please describe.

RPCMon is currently filtering only when stopping the monitoring.
We want it to remember the filtering configured and filter on runtime.

Describe the solution you would like

We first need to save the filtering in memory (maybe a file or registry for the future to allow import and export).
After that, we need to add the filtering to the function addEventToDataGridView.

Describe alternatives you have considered

None

Additional context

None