** Note that this is a public ticket, please refrain from adding any sensitive data. **
Description of Problem
The Malware app works a bit differently than Remediations or Vulnerabilities app. In case of the latter two, Once the affected problem is fixed, the detected system is removed from the view or list of affected.
In case of Malware app, Once detected a system with malware, even if that is fixed, The "Status: Matched" filter will continue to list those systems resulting in anomaly in the expected behavior.
How reproducible
(Always)
Steps to Reproduce
- Register a system with insights and place a file with malware signature embedded in it.
- Run the malware scan on the system and have it displayed in https://console.redhat.com/insights/malware/systems
- Now remove the malware file from the system and re-run the scan
- Revisit the system in https://console.redhat.com/insights/malware/systems
Actual Behavior
Step 2: System is listed in "Status: Matched" filter context and Last Status is Matched
Step 4: System is still listed in "Status: Matched" filter context but the Last Status is "not Matched"
Even if we click open the system, click on the signature and Set a Match Status as Resolved, The system remains listed i.e. same as Step 4.
Expected Behavior
If no malware matches or Last Status is Not Matched, then the system should not pop-up in the list of affected\matched systems.
Business Impact / Additional info
Confusing user experience around Malware app.