Nathanael Burton comments

Results 3 comments of


                                            Nathanael Burton

Querying processes table the start time field is not always returning the same value for the same process pid and process instance

This back and forth "off by one" second issue with the `start_time` causes tons of unnecessary events for differential queries. Every time the `start_time` jumps ahead one second it triggers...

Querying processes table the start time field is not always returning the same value for the same process pid and process instance

Could a similar solution to fixing this on MacOS work for fixing this on Linux? #3853

ignoredMatches dropped from results when using both by-cve and only-fixed config or CLI args

Possibly related: #1454