aquasecurity/tracee

Events cancellation removes chosen dependencies events

AlonZivony opened this issue · 0 comments

Description

The current cancellation logic of events will remove all the dependencies events of cancelled event, regardless of the fact that they might be chosen by the user or a dependency of other events.

// cancelEventFromEventState cancels an event and all its dependencies from the eventsState map.
func (t *Tracee) cancelEventFromEventState(evtID events.ID) {
	delete(t.eventsState, evtID)
	evtDef := events.Core.GetDefinitionByID(evtID)
	for _, evtDeps := range evtDef.GetDependencies().GetIDs() {
		t.cancelEventFromEventState(evtDeps)
	}
}

Output of tracee version:

(paste your output here)

Output of uname -a:

(paste your output here)

Additional details