darwin icon indicating copy to clipboard operation
darwin copied to clipboard

[IDEA] Be able to store additional context/data in cache

Open frikilax opened this issue 5 years ago • 0 comments

What is your feature about ? Be able to store additional context in cache.

Describe what you'd like When filters store information (aka. certitude currently) to cache, they can't store additional context about the entry they just handled, being able to store additional metadata (in the form of a string/json/whatever) could be great to give more information in logs when entries have a high certitude level.

Additional context Example : fyara_scan (first version currently on branch split_inspection) returns not only the certitude, but the matching yara rules (when applicable), tags, etc... The current cache doesn't permit to store anything else than a number (?), so the matching entries will have context in log only once, and then only the certitude next times (even if the entry needs to be exactly the same, but that WILL happen).

frikilax avatar Oct 14 '19 07:10 frikilax