google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.52k stars 577 forks source link

Improve analyzer result querying performance #3012

Open jkppr opened 6 months ago

jkppr commented 6 months ago

The analyzer results are currently requested per timeline when a sketch is loaded. This results in some scaling issues when working with a sketch that has many timelines.

This PR improves the loading performance by adding a new API endpoint that returns only the latest analyzer session for each timeline and analyzer on a given sketch.