Added a feature extraction analyzer

[kiddinn]

This is the first version of a feature extraction analyzer.

The PR does the following things:

• Adds the /etc/timesketch folder into the deployment and stores the configuration file for the feature extraction there.
• Add a features.conf YAML file where all feature extractions can be defined
• Adds an analyzer that reads the config file and extracts the features added there
• Adds a single feature extraction for extracting email addresses from browser history.

[berggren]

Looks really good. One comment about returning the resulting object instead of just the config path.

[berggren]

Can't we do this in the interface function instead, having it return the config dictionary instead of a path? When we move other analyzers config this will get a bit repetitive to do in each one that needs to load config. WDYT?

[kiddinn]

agree

[berggren]

See earlier comment, but consider returning the resulting object after yaml.safe_load here instead?

[kiddinn]

agree, dome

[berggren]

Note: You can override the get_kwargs() method from the interface to have the system create individual tasks for you here. Example from the similarity scorer:

    def get_kwargs(cls):
        """Keyword arguments needed to instantiate the class.
        In addition to the index_name passed to the constructor by default we
        need the data_type name as well. Furthermore we want to instantiate
        one task per data_type in order to run the analyzer in parallel. To
        achieve this we override this method and return a list of keyword
        argument dictionaries.
        Returns:
            List of keyword arguments (dict), one per data_type.
        """
        kwargs_list = []
        try:
            data_types = current_app.config['SIMILARITY_DATA_TYPES']
            if data_types:
                for data_type in data_types:
                    kwargs_list.append({'data_type': data_type})
        except KeyError:
            return None
        return kwargs_list

No need to do that here if you don't want to, but good to know it exists.

[kiddinn]

yes, I don't think we need that here... not necessarily

[berggren]

Looks good, just a last small comment/nit then this is ready to merge.

[berggren]

Isn't this an email address that is extracted? A username is a bit misleading I think.

[kiddinn]

done

[berggren]

LGTM