google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.62k stars 589 forks source link

[todo] fix auth analyzers result_attributes #2771

Open jkppr opened 1 year ago

jkppr commented 1 year ago

Related to an open TODO introduced in PR #2769

The Analyzer output supports the field result_attributes which is by definition a dictionary with key value pairs. The current logic of the new SSHBruteforceAnalyzer seems to save an object of class AuthSummary in the result_attributes to deal with the annotations etc. Hence, the output field needs to be modified before returning the final results of the analyzer into the database: self.output.result_attributes = {}

# TODO: Have a better way to handle result_attributes
  # result_attributes is a dict containing list of objects and not required for
  # user readable output.
  self.output.result_attributes = {}