The comparison tool seems to consider blocks that contain the same values as different
Problem description
Occasionally differences in policies are highlighted, but it is not actually clear what the difference is. I suspect some spacing differences in the JSON file, but I am not sure.
Attached are two policies that are virtually identical, but in which differences are highlighted. Attached below also the screenshot.
Step to reproduce
Steps to reproduce the behavior:
- Download and unzip policies.zip
- Import policy1.policy
- Import policy2.policy
- Compare the policies
- Check some events are considered different, but they have actually the same values
Expected behavior
In the case of non-relevant differences, the block is considered equal.
Screenshots
@Neurone Guardian treats events as different if they 'go' to different blocks. Which is the case in this situation (see screenshot below). As you see the other policy has additional description and name fields into the block, which are absent from the original definition. Perhaps someone edited it via JSON editor/view?
To summarise, this is be design and not a bug. If a change in behaviour is needed let's please create a feature ticket.
Perhaps there is another bug to do with how name and description happen to appear in the block definition?
tagging @Neurone for visibility
@Neurone Just wanted to check if we can close this issue?
Hi @prernaadev01 @anvabr I understand the behavior, and I understand it can be useful in some contexts, but I would say it would be more useful if this can be configured in the UI (default = disabled), so I can only see the real differences, and not consider as different part of the policies that are not technically different.
In addition to letting users decide this comparison option, it would be useful to show it differently than the normal difference. Maybe a dedicated icon or color for the section?
As a side note, I think this has also an impact on the equality percentage summary shown for the comparison.
Team brainstormed the approach, the proposal is to add an additional option (alongside already existing ones) enabling users to switch between the following comparison modes:
- strict comparison - includes exact matching of events their sources/destinations
- loose comparison - matching events but not their sources/destinations
- exclude events - events and their differences are ignored for the purposes of comparison
It sounds good to me!