[Feature Request] File Upload Flowsint Type

[z3rodaycve]

Hello,

During my development of new Flowsint enrichers, I realized that I could really use a “File” Flowsint type, where users would be able to upload a file and use it later within enrichers.

For ex., a user could upload an output file from an earlier investigation using a third-party tool and continue their investigation in Flowsint.

Currently there are both “File” and “Document” Flowsint types, but neither of them currently allows users to upload a file.

This feature could also help finish feature request #107, but I believe it would benefit a wider range of users (myself included).

Thank you

[dextmorgn]

Hey @z3rodaycve,

Could you give me examples of what things you would do with the file ?

Something like a picture document, and extract exif info using an enricher ?

Basically that would involve creating a new file storage system, maybe using a minio service in the docker-compose

[z3rodaycve]

Hello @dextmorgn,

I had a few ideas for enrichers. Most of the time, I would be extracting the contents of the uploaded file.
The NMAP importer idea by @johanneskolik (#107) is a good example.

I think this opens up more possibilities and functionality for Flowsint enrichers.

[dextmorgn]

Let me clarify some points to make sure I understand:
Here is a scenario:

• user creates a new "Document" node type (name, metadata, etc)
• The Document form proposes for example a drop zone to add the document as blob or whatever
• the node is inserted and the actual doc is inserted in a persistant storage (s3, minio, etc.)

In parallel, there would be document enricher, maybe compatible with extension type, like NmapDocumentParser that would extract and insert results as nodes ?

[z3rodaycve]

Let me clarify some points to make sure I understand:
Here is a scenario:

• user creates a new "Document" node type (name, metadata, etc)
• The Document form proposes for example a drop zone to add the document as blob or whatever
• the node is inserted and the actual doc is inserted in a persistant storage (s3, minio, etc.)

In parallel, there would be document enricher, maybe compatible with extension type, like NmapDocumentParser that would extract and insert results as nodes ?

Yes, exactly something like that.