[CWS] add early drop of useless notifications in windows probe (#31034)

DataDog · Nov 13, 2024 · a7db6c7 · a7db6c7
1 parent acdd783
commit a7db6c7
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/pkg/security/probe/probe_windows.go b/pkg/security/probe/probe_windows.go
@@ -716,6 +716,15 @@ func (p *WindowsProbe) setupEtw(ecb etwCallback) error {
 
 }
 
+func shouldEarlyDropNotif(n interface{}) bool {
+	switch n.(type) {
+	case *closeArgs, *cleanupArgs, *createHandleArgs:
+		return true
+	default:
+		return false
+	}
+}
+
 // Start processing events
 func (p *WindowsProbe) Start() error {
 
@@ -728,6 +737,10 @@ func (p *WindowsProbe) Start() error {
 		go func() {
 			defer p.fimwg.Done()
 			err := p.setupEtw(func(n interface{}, pid uint32) {
+				if shouldEarlyDropNotif(n) {
+					return
+				}
+
 				if p.blockonchannelsend {
 					p.onETWNotification <- etwNotification{n, pid}
 				} else {