{"action":"created","comment":{"url":"https://api.github.com/repos/log2timeline/plaso/pulls/comments/170464763","pull_request_review_id":99153735,"id":170464763,"diff_hunk":"@@ -415,7 +433,9 @@ def _ParseFilterOptions(self, options):\n     except (IOError, ValueError) as exception:\n       raise errors.BadConfigOption(exception)\n \n-    if self._filter_file:\n+    if self._artifacts_filter_file:","path":"plaso/cli/image_export_tool.py","position":85,"original_position":85,"commit_id":"4a4d3bb88a249f1c525259468d729818437aa2bb","original_commit_id":"4a4d3bb88a249f1c525259468d729818437aa2bb","user":{"login":"jnettesheim","id":3335365,"avatar_url":"https://avatars0.githubusercontent.com/u/3335365?v=4","gravatar_id":"","url":"https://api.github.com/users/jnettesheim","html_url":"https://github.com/jnettesheim","followers_url":"https://api.github.com/users/jnettesheim/followers","following_url":"https://api.github.com/users/jnettesheim/following{/other_user}","gists_url":"https://api.github.com/users/jnettesheim/gists{/gist_id}","starred_url":"https://api.github.com/users/jnettesheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jnettesheim/subscriptions","organizations_url":"https://api.github.com/users/jnettesheim/orgs","repos_url":"https://api.github.com/users/jnettesheim/repos","events_url":"https://api.github.com/users/jnettesheim/events{/privacy}","received_events_url":"https://api.github.com/users/jnettesheim/received_events","type":"User","site_admin":false},"body":"Done","created_at":"2018-02-25T19:52:42Z","updated_at":"2018-02-25T19:52:42Z","html_url":"https://github.com/log2timeline/plaso/pull/1732#discussion_r170464763","pull_request_url":"https://api.github.com/repos/log2timeline/plaso/pulls/1732","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/comments/170464763"},"html":{"href":"https://github.com/log2timeline/plaso/pull/1732#discussion_r170464763"},"pull_request":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/1732"}},"in_reply_to_id":170457423},"pull_request":{"url":"https://api.github.com/repos/log2timeline/plaso/pulls/1732","id":171226455,"html_url":"https://github.com/log2timeline/plaso/pull/1732","diff_url":"https://github.com/log2timeline/plaso/pull/1732.diff","patch_url":"https://github.com/log2timeline/plaso/pull/1732.patch","issue_url":"https://api.github.com/repos/log2timeline/plaso/issues/1732","number":1732,"state":"open","locked":false,"title":"Issue #1313 added artifacts filter support for files and Windows regi…","user":{"login":"jnettesheim","id":3335365,"avatar_url":"https://avatars0.githubusercontent.com/u/3335365?v=4","gravatar_id":"","url":"https://api.github.com/users/jnettesheim","html_url":"https://github.com/jnettesheim","followers_url":"https://api.github.com/users/jnettesheim/followers","following_url":"https://api.github.com/users/jnettesheim/following{/other_user}","gists_url":"https://api.github.com/users/jnettesheim/gists{/gist_id}","starred_url":"https://api.github.com/users/jnettesheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jnettesheim/subscriptions","organizations_url":"https://api.github.com/users/jnettesheim/orgs","repos_url":"https://api.github.com/users/jnettesheim/repos","events_url":"https://api.github.com/users/jnettesheim/events{/privacy}","received_events_url":"https://api.github.com/users/jnettesheim/received_events","type":"User","site_admin":false},"body":"## One line description of pull request\r\n\r\nAdding forensic artifact based filters for files and Windows registry keys- issue #1313.\r\n\r\n\r\n## Description:\r\nI've added a first pass at artifacts based filters.  This will only get files and registry keys for now.  I try to log warnings to catch instances where users are including other filters that aren't fully supported yet.\r\n\r\nI'm storing the filter find_specs in the knowledge base, if you would prefer it not be there I can parse the file when needed, it would just lead to me parsing the file multiple times in some cases.\r\n\r\nThis probably also needs an end to end test and would be happy to get that in place.\r\n\r\nSincere apologies for the large PR.\r\n\r\n\r\n**Related issue (if applicable):** adds to fixes for #1313\r\n\r\n## Notes:\r\nOne thing to please look at:\r\nLIne 267 in winreg.py: win_registry._registry_files.clear() ---- I had to call this to clear file not being closed errors, but I don't think we want that.\r\n\r\nAlso, appreciate any notes on glob expansion as I currently have it.\r\n\r\nAll contributions to Plaso undergo [code\r\nreview](https://github.com/log2timeline/plaso/wiki/Codereview). This makes sure\r\nthat the code has appropriate test coverage and conforms to the Plaso [style\r\nguide](https://github.com/log2timeline/plaso/wiki/Style-guide).\r\n\r\nOne of the maintainers will examine your code, and may request changes.\r\n\r\n## Checklist:\r\n  - [Y ] Local tests pass\r\n  - [?] Tests on TravisCI pass\r\n  - [Y] Codacy passes (or flags issues that you think are acceptable) -- Used CodeFactor\r\n  - [?] Coveralls indicates test coverage is sufficient\r\n\r\nIf [new dependencies](https://github.com/log2timeline/plaso/wiki/Adding-a-new-dependency) are required:\r\n - [ ] l2tdevtools has been updated\r\n","created_at":"2018-02-25T11:56:35Z","updated_at":"2018-02-25T19:52:42Z","closed_at":null,"merged_at":null,"merge_commit_sha":"474fc1fabe40fe305ac265e41d8cfbfc7d674349","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/log2timeline/plaso/pulls/1732/commits","review_comments_url":"https://api.github.com/repos/log2timeline/plaso/pulls/1732/comments","review_comment_url":"https://api.github.com/repos/log2timeline/plaso/pulls/comments{/number}","comments_url":"https://api.github.com/repos/log2timeline/plaso/issues/1732/comments","statuses_url":"https://api.github.com/repos/log2timeline/plaso/statuses/4a4d3bb88a249f1c525259468d729818437aa2bb","head":{"label":"jnettesheim:artifact-filters-feature","ref":"artifact-filters-feature","sha":"4a4d3bb88a249f1c525259468d729818437aa2bb","user":{"login":"jnettesheim","id":3335365,"avatar_url":"https://avatars0.githubusercontent.com/u/3335365?v=4","gravatar_id":"","url":"https://api.github.com/users/jnettesheim","html_url":"https://github.com/jnettesheim","followers_url":"https://api.github.com/users/jnettesheim/followers","following_url":"https://api.github.com/users/jnettesheim/following{/other_user}","gists_url":"https://api.github.com/users/jnettesheim/gists{/gist_id}","starred_url":"https://api.github.com/users/jnettesheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jnettesheim/subscriptions","organizations_url":"https://api.github.com/users/jnettesheim/orgs","repos_url":"https://api.github.com/users/jnettesheim/repos","events_url":"https://api.github.com/users/jnettesheim/events{/privacy}","received_events_url":"https://api.github.com/users/jnettesheim/received_events","type":"User","site_admin":false},"repo":{"id":66928019,"name":"plaso","full_name":"jnettesheim/plaso","owner":{"login":"jnettesheim","id":3335365,"avatar_url":"https://avatars0.githubusercontent.com/u/3335365?v=4","gravatar_id":"","url":"https://api.github.com/users/jnettesheim","html_url":"https://github.com/jnettesheim","followers_url":"https://api.github.com/users/jnettesheim/followers","following_url":"https://api.github.com/users/jnettesheim/following{/other_user}","gists_url":"https://api.github.com/users/jnettesheim/gists{/gist_id}","starred_url":"https://api.github.com/users/jnettesheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jnettesheim/subscriptions","organizations_url":"https://api.github.com/users/jnettesheim/orgs","repos_url":"https://api.github.com/users/jnettesheim/repos","events_url":"https://api.github.com/users/jnettesheim/events{/privacy}","received_events_url":"https://api.github.com/users/jnettesheim/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jnettesheim/plaso","description":"Super timeline all the things","fork":true,"url":"https://api.github.com/repos/jnettesheim/plaso","forks_url":"https://api.github.com/repos/jnettesheim/plaso/forks","keys_url":"https://api.github.com/repos/jnettesheim/plaso/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jnettesheim/plaso/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jnettesheim/plaso/teams","hooks_url":"https://api.github.com/repos/jnettesheim/plaso/hooks","issue_events_url":"https://api.github.com/repos/jnettesheim/plaso/issues/events{/number}","events_url":"https://api.github.com/repos/jnettesheim/plaso/events","assignees_url":"https://api.github.com/repos/jnettesheim/plaso/assignees{/user}","branches_url":"https://api.github.com/repos/jnettesheim/plaso/branches{/branch}","tags_url":"https://api.github.com/repos/jnettesheim/plaso/tags","blobs_url":"https://api.github.com/repos/jnettesheim/plaso/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jnettesheim/plaso/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jnettesheim/plaso/git/refs{/sha}","trees_url":"https://api.github.com/repos/jnettesheim/plaso/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jnettesheim/plaso/statuses/{sha}","languages_url":"https://api.github.com/repos/jnettesheim/plaso/languages","stargazers_url":"https://api.github.com/repos/jnettesheim/plaso/stargazers","contributors_url":"https://api.github.com/repos/jnettesheim/plaso/contributors","subscribers_url":"https://api.github.com/repos/jnettesheim/plaso/subscribers","subscription_url":"https://api.github.com/repos/jnettesheim/plaso/subscription","commits_url":"https://api.github.com/repos/jnettesheim/plaso/commits{/sha}","git_commits_url":"https://api.github.com/repos/jnettesheim/plaso/git/commits{/sha}","comments_url":"https://api.github.com/repos/jnettesheim/plaso/comments{/number}","issue_comment_url":"https://api.github.com/repos/jnettesheim/plaso/issues/comments{/number}","contents_url":"https://api.github.com/repos/jnettesheim/plaso/contents/{+path}","compare_url":"https://api.github.com/repos/jnettesheim/plaso/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jnettesheim/plaso/merges","archive_url":"https://api.github.com/repos/jnettesheim/plaso/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jnettesheim/plaso/downloads","issues_url":"https://api.github.com/repos/jnettesheim/plaso/issues{/number}","pulls_url":"https://api.github.com/repos/jnettesheim/plaso/pulls{/number}","milestones_url":"https://api.github.com/repos/jnettesheim/plaso/milestones{/number}","notifications_url":"https://api.github.com/repos/jnettesheim/plaso/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jnettesheim/plaso/labels{/name}","releases_url":"https://api.github.com/repos/jnettesheim/plaso/releases{/id}","deployments_url":"https://api.github.com/repos/jnettesheim/plaso/deployments","created_at":"2016-08-30T09:46:06Z","updated_at":"2016-08-30T09:46:10Z","pushed_at":"2018-02-25T11:46:16Z","git_url":"git://github.com/jnettesheim/plaso.git","ssh_url":"git@github.com:jnettesheim/plaso.git","clone_url":"https://github.com/jnettesheim/plaso.git","svn_url":"https://github.com/jnettesheim/plaso","homepage":"","size":185093,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"log2timeline:master","ref":"master","sha":"843ca4037ec8facc95f2bf9fd7800cf9a3960752","user":{"login":"log2timeline","id":8701971,"avatar_url":"https://avatars2.githubusercontent.com/u/8701971?v=4","gravatar_id":"","url":"https://api.github.com/users/log2timeline","html_url":"https://github.com/log2timeline","followers_url":"https://api.github.com/users/log2timeline/followers","following_url":"https://api.github.com/users/log2timeline/following{/other_user}","gists_url":"https://api.github.com/users/log2timeline/gists{/gist_id}","starred_url":"https://api.github.com/users/log2timeline/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/log2timeline/subscriptions","organizations_url":"https://api.github.com/users/log2timeline/orgs","repos_url":"https://api.github.com/users/log2timeline/repos","events_url":"https://api.github.com/users/log2timeline/events{/privacy}","received_events_url":"https://api.github.com/users/log2timeline/received_events","type":"Organization","site_admin":false},"repo":{"id":23812315,"name":"plaso","full_name":"log2timeline/plaso","owner":{"login":"log2timeline","id":8701971,"avatar_url":"https://avatars2.githubusercontent.com/u/8701971?v=4","gravatar_id":"","url":"https://api.github.com/users/log2timeline","html_url":"https://github.com/log2timeline","followers_url":"https://api.github.com/users/log2timeline/followers","following_url":"https://api.github.com/users/log2timeline/following{/other_user}","gists_url":"https://api.github.com/users/log2timeline/gists{/gist_id}","starred_url":"https://api.github.com/users/log2timeline/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/log2timeline/subscriptions","organizations_url":"https://api.github.com/users/log2timeline/orgs","repos_url":"https://api.github.com/users/log2timeline/repos","events_url":"https://api.github.com/users/log2timeline/events{/privacy}","received_events_url":"https://api.github.com/users/log2timeline/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/log2timeline/plaso","description":"Super timeline all the things","fork":false,"url":"https://api.github.com/repos/log2timeline/plaso","forks_url":"https://api.github.com/repos/log2timeline/plaso/forks","keys_url":"https://api.github.com/repos/log2timeline/plaso/keys{/key_id}","collaborators_url":"https://api.github.com/repos/log2timeline/plaso/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/log2timeline/plaso/teams","hooks_url":"https://api.github.com/repos/log2timeline/plaso/hooks","issue_events_url":"https://api.github.com/repos/log2timeline/plaso/issues/events{/number}","events_url":"https://api.github.com/repos/log2timeline/plaso/events","assignees_url":"https://api.github.com/repos/log2timeline/plaso/assignees{/user}","branches_url":"https://api.github.com/repos/log2timeline/plaso/branches{/branch}","tags_url":"https://api.github.com/repos/log2timeline/plaso/tags","blobs_url":"https://api.github.com/repos/log2timeline/plaso/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/log2timeline/plaso/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/log2timeline/plaso/git/refs{/sha}","trees_url":"https://api.github.com/repos/log2timeline/plaso/git/trees{/sha}","statuses_url":"https://api.github.com/repos/log2timeline/plaso/statuses/{sha}","languages_url":"https://api.github.com/repos/log2timeline/plaso/languages","stargazers_url":"https://api.github.com/repos/log2timeline/plaso/stargazers","contributors_url":"https://api.github.com/repos/log2timeline/plaso/contributors","subscribers_url":"https://api.github.com/repos/log2timeline/plaso/subscribers","subscription_url":"https://api.github.com/repos/log2timeline/plaso/subscription","commits_url":"https://api.github.com/repos/log2timeline/plaso/commits{/sha}","git_commits_url":"https://api.github.com/repos/log2timeline/plaso/git/commits{/sha}","comments_url":"https://api.github.com/repos/log2timeline/plaso/comments{/number}","issue_comment_url":"https://api.github.com/repos/log2timeline/plaso/issues/comments{/number}","contents_url":"https://api.github.com/repos/log2timeline/plaso/contents/{+path}","compare_url":"https://api.github.com/repos/log2timeline/plaso/compare/{base}...{head}","merges_url":"https://api.github.com/repos/log2timeline/plaso/merges","archive_url":"https://api.github.com/repos/log2timeline/plaso/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/log2timeline/plaso/downloads","issues_url":"https://api.github.com/repos/log2timeline/plaso/issues{/number}","pulls_url":"https://api.github.com/repos/log2timeline/plaso/pulls{/number}","milestones_url":"https://api.github.com/repos/log2timeline/plaso/milestones{/number}","notifications_url":"https://api.github.com/repos/log2timeline/plaso/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/log2timeline/plaso/labels{/name}","releases_url":"https://api.github.com/repos/log2timeline/plaso/releases{/id}","deployments_url":"https://api.github.com/repos/log2timeline/plaso/deployments","created_at":"2014-09-08T23:29:28Z","updated_at":"2018-02-24T22:51:23Z","pushed_at":"2018-02-25T11:56:36Z","git_url":"git://github.com/log2timeline/plaso.git","ssh_url":"git@github.com:log2timeline/plaso.git","clone_url":"https://github.com/log2timeline/plaso.git","svn_url":"https://github.com/log2timeline/plaso","homepage":"","size":185028,"stargazers_count":503,"watchers_count":503,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":118,"mirror_url":null,"archived":false,"open_issues_count":234,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":118,"open_issues":234,"watchers":503,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/1732"},"html":{"href":"https://github.com/log2timeline/plaso/pull/1732"},"issue":{"href":"https://api.github.com/repos/log2timeline/plaso/issues/1732"},"comments":{"href":"https://api.github.com/repos/log2timeline/plaso/issues/1732/comments"},"review_comments":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/1732/comments"},"review_comment":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/1732/commits"},"statuses":{"href":"https://api.github.com/repos/log2timeline/plaso/statuses/4a4d3bb88a249f1c525259468d729818437aa2bb"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"jnettesheim"}}