Support for obseravbles in Yeti analyzers

google / timesketch

Collaborative forensic timeline analysis

Apache License 2.0

2.52k stars 577 forks source link

Closed tomchop closed 2 months ago

tomchop commented 2 months ago

This PR introduces two changes in the yetiinidicators analyzer series:

Support for observables (they are parsed into a wildcard query)
Support for unrolling Entities of type Incident (i.e. register new Analyzer subclass)