Unable to use more than one tagging source

Plaso version:

1.5.0 Release

Operating system Plaso is running on:

XUbuntu 64 bit

Installation method:

Installed from GiFT

Description of problem:

I have been using the nsrlsvr analysis as well as the tagging analysis plugin. Both plugins tag events. After running both analysis plugins, tags from both plugins end up in the event_tag_data files in the dump file.

When outputting formatted data, the tags are retrieved from that dump file. When one event is tagged by both plugins, only one of the tags is exported. I’d like to see both tags in the output.

Source data:

A single tag is set in line 1565 of storage/zip_file.py:

event.tag = self._ReadEventTagByIdentifier(event.store_number, event.store_index, event.uuid)

Apart from the assignment there, _ReadEventTagByIdentifier itself would also need changes. In this function, a tag is retrieved by using event_uuid as a reference. More than one tag could be available with that reference though, so which tag would need to be read by the function is ambiguous.

[Onager]

I think this is bug, not an FR - we should be returning both tags.

[joachimmetz]

Changed tests indicate this currently working as intended: https://codereview.appspot.com/327150043