Currently, eBPF sensor does not report already running processes.
Investigate use of a BPF_ITER program to enumerate all the already running tasks
(and consequently, disable the already running logic in endpoint when eBPF sensor is used)
Resources/References:
https://developers.facebook.com/blog/post/2022/03/31/bpf-iterator-retrieving-kernel-data-with-flexibility-and-efficiency/
https://elixir.bootlin.com/linux/latest/source/kernel/bpf/bpf_iter.c