Files
mbedworth d3cbedaa8e security/wazuh-agent: Fix active response duplicate key causing false aborts (#5104)
When multiple IPs trigger the same rule simultaneously, they were
sharing the same check_keys value (only rule ID), causing the manager
to abort all but the first execution.

Changed the key to include both rule_id and srcip to make it unique
per source IP, allowing multiple simultaneous blocks while still
preventing duplicate blocks of the same IP.

Fixes #4738
2025-12-28 10:23:52 +01:00
..