Feature Request: Timed Rules / TTL

[martin-langhoff]

I'd like to allow generic tools like wget for a brief period (5 minutes, or 1hr, etc) - for example during a brew install run. But I don't want to whitelist wget permanently, because a malicious execution might use it to fetch a 'next stage' binary for an attack.

Allowing 'per process' is too granular, as wget can get called a dozen times by brew. In addition, I end up with dozens of rules 'per process' that were never meant to be long-lived.

[objective-see]

Excellent idea ...this will be added in the (soon to be released) v3.0