dissect.target icon indicating copy to clipboard operation
dissect.target copied to clipboard

Create plugin category system for target-query

Open DissectBot opened this issue 1 year ago • 0 comments

The category system is created to serve two adjacent goals:

  1. Define a “killchain” category with a number of sub-categories (defined in the questionaire spreadsheet).
  2. Have the user define their own categories specific for their investigation (e.g. plugins that output artifacts that hold clues to persistency)

Note that the words tags/categories can be used interchangeably: plugins are given a tag, while categories are sets of plugins. The difference is in the technical implementation.

In this case we go for the category implementation. A category is a list of strings of plugin (wildcard) names, which can be selected using a commandline parameter like --category <category_name>. This is then fed into the default plugin selection and execution mechanism. It should except wildcards (using the fnmatch()functionality), to be able to do sub-categories. E.g. when a user has defined some tags but only wants to run the plugins related to the build-in killchain categories, it can do: killchain.*.

The default categories should be defined somewhere in query.py or a related file. The user defined categories can go into .targetcfg.py as variables. These variables must be prefixed with a well known prefix, like plugin_category_<category_name>.

DissectBot avatar Mar 18 '24 14:03 DissectBot