https://github.com/nextronsystems/finding-store
THOR Finding Filesystem Layout
https://github.com/nextronsystems/finding-store
Last synced: 10 months ago
JSON representation
THOR Finding Filesystem Layout
- Host: GitHub
- URL: https://github.com/nextronsystems/finding-store
- Owner: NextronSystems
- License: mit
- Created: 2025-05-27T10:37:40.000Z (about 1 year ago)
- Default Branch: master
- Last Pushed: 2025-05-28T14:45:51.000Z (about 1 year ago)
- Last Synced: 2025-07-12T01:41:25.828Z (12 months ago)
- Language: Go
- Size: 6.84 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# THOR Finding Store
This package provides a simple on-disk store for findings generated by THOR scans.
Both findings and the content that was matched on (typically the file content) are stored, with both referencing each other.
A finding will have none or one content item, while a content item may be referenced by multiple findings.
## Layout
The store is a directory with the following structure:
```
├── findings
│ └── ab
│ ├── abcdef1234567890
│ └── abcdef1234567890.hash
└── samples
└── 1e
├── 1edc8bf0596dcdc0ca93b6dd89e14b57d0b4faf5da534d5487f9ed7ad0eb7e06
└── 1edc8bf0596dcdc0ca93b6dd89e14b57d0b4faf5da534d5487f9ed7ad0eb7e06.metadata
```
Where:
- `findings/` contains the findings, organized by their first two characters of the finding ID.
Each finding is stored in a file named after the finding ID, with an additional `.hash` file containing the SHA256 hash of the finding.
- `samples/` contains the content matched on, organized by the first two characters of the content's SHA256 hash.
Each content item is stored in a file named after its SHA256 hash, with an additional `.metadata` file containing the findings that reference this content item in newline delimited JSON format.
Optionally, by setting `Layout.Flat` to `true`, the store can be configured to not create subdirectories under `findings/` and `samples/`, but instead store all findings and samples in a single directory each.