You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Cool module. FYI, we usually try to have modules create TSK_INTERESTING_FILE artifacts for items that they flag (and use TSK_SET to organize them based on a common set name) and leave Tags for things that are picked by the user. Then the user can have a workflow of the module flags them as INTERESTING and the user can choose to Tag the ones that are actually interesting and be reported on.
This distinction is not well documented on our part.
The text was updated successfully, but these errors were encountered:
Cool module. FYI, we usually try to have modules create TSK_INTERESTING_FILE artifacts for items that they flag (and use TSK_SET to organize them based on a common set name) and leave Tags for things that are picked by the user. Then the user can have a workflow of the module flags them as INTERESTING and the user can choose to Tag the ones that are actually interesting and be reported on.
This distinction is not well documented on our part.
The text was updated successfully, but these errors were encountered: