Feature request: Log/disc space rotation

[certrik]

I see that CIRCL/AIL-framework#524 is already an issue in https://github.com/CIRCL/AIL-framework .
I think this would be a very important feature.

[certrik]

@adulau & @Terrtia
Until this is probably integrated ... Is there a way to rotate/clean out disc space/logs manually in the meantime?

[certrik]

Hi @adulau & @Terrtia ,
is there any prediction if and/or when this feature could be implemented?

[Terrtia]

Hi @certrik !
We are working on it. We'll release the first version this month

[certrik]

Hi @Terrtia are there any news regarding this feature?
Is there already some possibility in 4.1 to address this? To somehow clean discspace?
Please. Any advice would be much appreciated.

[certrik]

Hi @Terrtia ,
Will this somehow be part of AIL-framework 5.x . It is dearly needed.

[Terrtia]

Hi @certrik !

It's definitively at the top of my priority list. I plan to add it in AIL v5.1 or v5.2.

I already added some code to add and delete metadatas, trackers, correlations, investigations...
I need to complete and test the delete function for each objects (it's almost completed).

I plan to reuse the object iterator and object filter used by the retro hunt.
This way I can create a list of object to delete.

I am currently supporting the following fields:

• tags
• items source
• items daterange
• decoded mimetype

I plan to add others filtering option like is_tracked, is_investigated, is_tagged, object daterange, domain history, domain HAR...

Let me know if you have any ideas on additional fields to add