target / strelka

Real-time, container-based file scanning at enterprise scale
Other
878 stars 113 forks source link

MSI Filename and Size Support #390

Closed phutelmyer closed 1 year ago

phutelmyer commented 1 year ago

Describe the change Adding support for filename and size metadata extraction for MSI files using the ScanSevenZip scanner. This can be useful for observing additional file metadata from an MSI file rather than relying on the extracted files themselves, previously extracted by ScanLibArchive. This can be additionally useful if you're using something like Elasticsearch, where there is little relation between the records. With this approach, users can see that a file is an MSI file, the MSI file metadata, and the files that reside in the MSI file.

Includes:

Describe testing procedures All tests ran successfully on build

Sample output image

Checklist