ThreatFactor NSIA

Event log hooks should probably be replaced with a system that acts on scan results directly as opposed to older method of hooking into the event log events. A system that acts on scan results would have the following benefits:

• Could aggregate on repeated failures (only report once per day, hour, etc)
• Have site-group, rule and global scopes
• Include more information about the detection in the escalation

Note, there is no built-in way to delete hooks that can no longer be loaded. You have to delete them from the database directly.

This isn't necessary though since the old hooks don't prevent the application from running correctly (just generate log messages indicating that they could not be loaded).

A couple of options for handling this:

1. Purge event log hooks that will not load during upgrade operations
2. Give users an option to purge event log hooks that fail to load (like a debug console or command-line option)