From 0040569fa94c871684f9657b5caae57f4cca97a2 Mon Sep 17 00:00:00 2001 From: "Thibault \"bui\" Koechlin" Date: Tue, 12 Sep 2023 11:19:36 +0200 Subject: [PATCH] if 'include capi' is false, only exclude capi alerts instead of assuming they necessarily have attached decisions (#2435) --- pkg/database/alerts.go | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/pkg/database/alerts.go b/pkg/database/alerts.go index 1b1a4667e..78043c565 100644 --- a/pkg/database/alerts.go +++ b/pkg/database/alerts.go @@ -862,11 +862,7 @@ func AlertPredicatesFromFilter(filter map[string][]string) ([]predicate.Alert, e predicates = append(predicates, alert.HasDecisionsWith(decision.OriginEQ(value[0]))) case "include_capi": //allows to exclude one or more specific origins if value[0] == "false" { - predicates = append(predicates, alert.HasDecisionsWith( - decision.Or(decision.OriginEQ(types.CrowdSecOrigin), - decision.OriginEQ(types.CscliOrigin), - decision.OriginEQ(types.ConsoleOrigin), - decision.OriginEQ(types.CscliImportOrigin)))) + predicates = append(predicates, alert.Not(alert.HasDecisionsWith(decision.OriginEQ(types.CAPIOrigin)))) } else if value[0] != "true" { log.Errorf("Invalid bool '%s' for include_capi", value[0]) }