accumulative profile

[itaysk]

Currently we alert any profile deviation as suspicious. This approach is noisy and possibly overly protective. I suggest we change the behavior to alert only if something that was previously unknown is now added to the profile.
For example, consider a case that the pipeline connected to domainX.com, tracee-action detected it and admin acknowledged it. Now domainX.com is in the dns profile. Then in a subsequent run, the pipeline did not connect to domainX.com for whatever reason. Today, we alert this, and this issues propose to ignore this specific case.
The rational is that pipelines can be inconsistent by design, and that the profile should be essentially a list of trusted/allowed interactions as opposed to exact interactions