Open
Description
Today Tracee policies have two limitations that we need to remove:
- Only up to 64 policies are supported
- Only 1 rule of the same event type can be specified in a policy
Removing the second limitation is probably more important since it will allow a user to write rules that specify different sets of filters to the same event, thus supporting logical OR operation between the filter sets.