google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.58k stars 589 forks source link

Feature Extraction analyzer cannot create views #3046

Closed jkppr closed 6 months ago

jkppr commented 6 months ago

Describe the bug The feature extraction analyzer is supposed to be able to allow the creation of views/saved searches. However, this feature is bugged and will result in an error message when attempted to be executed.

To Reproduce Steps to reproduce the behavior:

  1. Upload a Timeline that contains email addresses that would be extracted by the email_address regex definition.
  2. Run the Feature Extractions analyzer on this Timeline
  3. See the error messages in the analyzer results.

Solution The creation of aggregations with the feature extractions is not yet supported anyway. But it is linked to the creation of a saved search/view at the moment in this code. A similar result can already be archived using the tags option. In combination with the new UI this results in a very similar result (one easy way to see what was found by the extraction). Therefore I propose to remove the create_view and aggregate options from the feature extraction for now.