cybercentrecanada / assemblyline-incident-manager Goto Github PK

I want to be able to specify where the report.csv will be written in the al-incident-analyzer

Downloader has an interesting case where the max_score doesn't work if the submissions jobs aren't done yet. Can be replicated by chaining the submitter -> downloader in a script and filtering for a max score where some files have a higher score and some files have a lower score. All files that were submitted in the job will be downloaded even though some files were clearly above the max_score

• Seems to be because the script is making a query before waiting for all submissions are complete, then the script proceeds to download all files that were queried in the original query. However, a score for a submission isn't valid until the submission is complete.

Maybe it might be better to wait for all submissions to complete before making the query?

Downloader's query won't match properly on wildcards if quotations are included.

For example, I submit a directory called tests/. Then I run the downloader on the job I submitted. A part of the query generated when downloading is:

metadata.filename:"*\.\/tests*"

however, this will give 0 results. Instead, what works is to remove the quotation marks:

metadata.filename:*\.\/tests*

Currently submissions are only generated per incident number and there is no way of getting more granular results.