-
Notifications
You must be signed in to change notification settings - Fork 2
Description
When creating two identically named modules (e.g "hash_collect") but on different folders, both are listed when only one is selected:
>>> find . -name "hash_collect.yml"
./unix/hash_collect.yml
./windows/hash_collect.yml
[DEBUG] [2025-08-24 15:21:23,570] - ⚡_Processor.py:321 - main_tab() () - Module ADD[]
[DEBUG] [2025-08-24 15:21:23,571] - ⚡_Processor.py:455 - process_submission() () - Processing job with profile:
[DEBUG] [2025-08-24 15:21:23,571] - ⚡_Processor.py:456 - process_submission() () - Selected modules: ['hash_collect.yml']
[DEBUG] [2025-08-24 15:21:23,571] - ⚡_Processor.py:457 - process_submission() () - Modules to add: []
[DEBUG] [2025-08-24 15:21:23,571] - ⚡_Processor.py:458 - process_submission() () - Modules to remove: []
[DEBUG] [2025-08-24 15:21:23,571] - ⚡_Processor.py:459 - process_submission() () - Case path: /OSIR/share/cases/DFIR_ORC
[DEBUG] [2025-08-24 15:21:23,571] - task_manager.py:55 - _get_modules_selected() () - Final list of modules: ['hash_collect.yml']
[DEBUG] [2025-08-24 15:21:23,571] - task_manager.py:56 - _get_modules_selected() () - List of module to ADD: []
[DEBUG] [2025-08-24 15:21:23,571] - task_manager.py:57 - _get_modules_selected() () - List of module to REMOVE: []
[DEBUG] [2025-08-24 15:21:23,576] - task_manager.py:80 - _validate_modules_configs() - All module instances have the same OS.
[DEBUG] [2025-08-24 15:21:23,577] - task_manager.py:55 - _get_modules_selected() () - Final list of modules: ['hash_collect.yml']
[DEBUG] [2025-08-24 15:21:23,577] - task_manager.py:56 - _get_modules_selected() () - List of module to ADD: []
[DEBUG] [2025-08-24 15:21:23,577] - task_manager.py:57 - _get_modules_selected() () - List of module to REMOVE: []
[DEBUG] [2025-08-24 15:21:23,594] - DbOSIR.py:372 - _create_case_snapshot_tab() - Table `case_snapshot` ensured.
[DEBUG] [2025-08-24 15:21:23,596] - DbOSIR.py:226 - store_master_status() () - Updated master_status record for case_path: /OSIR/share/cases/DFIR_ORC
[DEBUG] [2025-08-24 15:21:23,604] - DbOSIR.py:372 - _create_case_snapshot_tab() - Table `case_snapshot` ensured.
[DEBUG] [2025-08-24 15:21:23,605] - ModuleHandler.py:133 - monitor_directory() () - Scanning for new files/folders
[DEBUG] [2025-08-24 15:21:23,770] - ModuleHandler.py:139 - monitor_directory() () - Time taken to scan case: 0.1648 seconds.
[DEBUG] [2025-08-24 15:21:23,775] - ModuleHandler.py:143 - monitor_directory() () - New files/folders detected : 120733 new items
[DEBUG] [2025-08-24 15:21:24,061] - ModuleHandler.py:153 - monitor_directory() () - Time taken to process new items: 0.286 seconds
[DEBUG] [2025-08-24 15:21:34,062] - ModuleHandler.py:133 - monitor_directory() () - Scanning for new files/folders
[DEBUG] [2025-08-24 15:21:34,230] - ModuleHandler.py:139 - monitor_directory() () - Time taken to scan case: 0.1677 seconds.
[DEBUG] [2025-08-24 15:21:34,270] - ModuleHandler.py:155 - monitor_directory() () - No new item detected. Checking if a task is still ongoing before exiting...
[DEBUG] [2025-08-24 15:21:34,274] - ModuleHandler.py:159 - monitor_directory() () - Case snaphost is being saved before exiting...
[DEBUG] [2025-08-24 15:21:39,583] - DbOSIR.py:226 - store_master_status() () - Updated master_status record for case_path: /OSIR/share/cases/DFIR_ORC
[DEBUG] [2025-08-24 15:21:39,583] - MonitorCase.py:41 - on_inactivity() () - Updated database status to processing_done due to inactivity.
The first found module seems to be launched (./unix/hash_collect.yml in this case surely because of the alphabetical order).
A solution may be to append folder to module so that x/a.yml is recognized as different compared to y/a.yml.
In this case, since unix/hash_collect.yml is a bit different with windows/hash_collect.yml, splitting its functionality into separated modules seemed to be a better solution compared to creating a single all/hash_collect.yml with multiple regex and comparison to satisfy both OS for clarity purpose and future proofing.
We can face another issue with splunk, thus both modules would need to have the same json structure.