log2timeline / plaso

Sometimes during the import of timelines into timesketch I see the following error message:

[2024-06-19 18:15:10,883] timesketch.tasks/ERROR Error: 'str' object has no attribute 'get'
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/dist-packages/timesketch/lib/tasks.py", line 668, in run_plaso
    pinfo._CalculateStorageCounters(  # pylint: disable=protected-access
  File "/usr/lib/python3/dist-packages/plaso/cli/pinfo_tool.py", line 150, in _CalculateStorageCounters
    for warning in storage_reader.GetAttributeContainers(
  File "/usr/lib/python3/dist-packages/acstore/sqlite_store.py", line 484, in _GetAttributeContainersWithFilter
    container = self._CreateAttributeContainerFromRow(
  File "/usr/lib/python3/dist-packages/plaso/storage/sqlite/sqlite_file.py", line 89, in _CreateAttributeContainerFromRow
    return super(SQLiteStorageFile, self)._CreateAttributeContainerFromRow(
  File "/usr/lib/python3/dist-packages/acstore/sqlite_store.py", line 368, in _CreateAttributeContainerFromRow
    attribute_value = self._schema_helper.DeserializeValue(
  File "/usr/lib/python3/dist-packages/acstore/sqlite_store.py", line 126, in DeserializeValue
    value = serializer.DeserializeValue(json_dict)
  File "/usr/lib/python3/dist-packages/plaso/storage/serializers.py", line 55, in DeserializeValue
    value['parent'] = self.DeserializeValue(value['parent'])
  File "/usr/lib/python3/dist-packages/plaso/storage/serializers.py", line 50, in DeserializeValue
    type_indicator = value.get('type_indicator', None)
AttributeError: 'str' object has no attribute 'get'

I guess it´ s related to the recent changes in 04c3f1a

plaso/plaso/storage/serializers.py

Line 50 in 2ad42e3

type_indicator = value.get('type_indicator', None)

it would be great to support also older timelines by adding a simple check like this:

if isinstance(value, str):
    value = json.loads(value)

That has worked for me as a quick&dirty workaround.

Can you provide the details requested in the issue template?

Would be good to understand what versions of plaso are your running? What version of dependencies? What attribute container is causing this exception? etc.

Also see: https://plaso.readthedocs.io/en/latest/sources/Troubleshooting.html

Version of plaso in the timesketch container is:

>>> import plaso
>>> plaso.__version__
'20240308'
>>>

The timeline was generated with plaso: 20230717

So technically we no longer support 20230717 and the storage format is undergoing some changes. I opt to make the patch to your local installation if you need it, but not going to integrate it into the current version.

AttributeError: 'str' object has no attribute 'get' in DeserializeValue