google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.52k stars 577 forks source link

Analyzer output lists always all tags #3107

Closed jkppr closed 3 weeks ago

jkppr commented 3 weeks ago

Describe the bug With the new verbose analyzer output, the analyzer results show and link created tags for an analyzer session. However, there is a bug that adds all tags to the list, including the ones manually added or added by different analyzers.

To Reproduce Steps to reproduce the behavior:

  1. Upload a browser history plaso file
  2. Add some manual tags to different events
  3. Run the "Domain" analyzer
  4. See the Tags list in the Analyzer results containing also a list of manually added tags.

Expected behavior The analyzer results should only list tags that have been added by this specific analyzer.

Screenshots image