Any form of hook to be notified on action denied by policy in order to act instantly ?

[didier-durand]

Hi,

Is there any way to get notified in real time when a policy denies some action (network request, file access, etc.) ?

I would like to trigger some actions trying to fix the failure by extending the policy when action should be allowed.

Thaks

[johntmyers]

Hi, we don't have a notification system per se. But you can use openshell term to monitor for blocked network rules and it gives you way to approve suggested rule modifications.

[didier-durand]

@johntmyers : Hi John, thanks! Yes, I know about openshell term but I was looking for something that I can automated.
The fancy navigation of term makes it hard to scrape.

Any chance to have such hooks in the future ? Should I open a Feature Request ?

[didier-durand]

I found a simpler solution than openshell term, I'll use openshell logs to poll the logs and get
the denials

I get what I need in logs to update my policy automatically: