When using es_mute_path_prefix to mute processes under my own app directory, I see that we are still getting AUTH_EXEC events on new processes executed from that directory.
Is that the expected behavior? Should I add a check under AUTH_EXEC to mute/ignore each new process, if it matches that prefix?
Is that the expected behavior? Should I add a check under AUTH_EXEC to mute/ignore each new process, if it matches that prefix?
