search

USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.
Other
5.45k stars 1.14k forks source link

Info dictionary mods for alert() kw values #76

Closed amm3 closed 8 years ago

amm3 commented 8 years ago

Two proposed changes:

  1. Changed in how info['ts'] is determined so that if multiple files are transferred on one control-channel, we see different timestamps for each. Timestamp is now based on blob times.
  2. Breaking out keywords Direction, Path, and Filename. These were part of an earlier revision and downstream processing used by author has them as a dependency.