User should be able to add their own monitor rules either programmatically from a file, or when the REPL is running.
Something like: flag if exe.deleted AND net.state == ESTABLISHED AND remote.port NOT IN [80,443]
It does not need to be a full on scripting language. Advanced query might need to be implemented first to allow for this feature
User should be able to add their own monitor rules either programmatically from a file, or when the REPL is running.
Something like:
flag if exe.deleted AND net.state == ESTABLISHED AND remote.port NOT IN [80,443]It does not need to be a full on scripting language. Advanced query might need to be implemented first to allow for this feature