search

mfesiem / msiempy

McAfee SIEM API Python wrapper
https://mfesiem.github.io/docs/msiempy/msiempy.html
MIT License
23 stars 9 forks source link

AlarmManager._event_match() only consider the first triggering events of the alarm #83

Closed tristanlatr closed 3 years ago

tristanlatr commented 3 years ago

Describe When using AlarmManager, only the first event is compared against events filters.

https://github.com/mfesiem/msiempy/blob/ad5c7547a3e3f737681ca5c2067310f733e5fd98/msiempy/alarm.py#L351

Expected behaviour would consider the filter matching if any triggering event match all passed filters.

msiempy version: msiempy : 0.3.3