Full-text search in submission files

[kam193]

Full-text search in submission files

[cccs-rs]

Sounds like something the Retrohunt feature could be suitable for if we can narrow the context down to a certain submission rather than against all files that exist in the system?

In this way, you can devise a YARA rule (which I understand to be pretty extensive for searching) to target the data you want to look for within a file (hopefully with a filter query on AL's side to only apply the rule against files from a certain submission)

[kam193]

It sounds nice, but I'd then focus on making it simply accessible: the idea is to quickly search in a submission, so if I needed to use API, manually look for or filter for the submission in another tab, or manually write a YARA rule, it would be rather less useful. But at the same time, if the implementation is like this, but I have to just click in the submission view and e.g. select to paste a yara rule for more advanced feature, or let UI prepare a simple rule (search for a given string) for me - it sounds very nice