{"action":"created","issue":{"url":"https://api.github.com/repos/rieck/malheur/issues/12","labels_url":"https://api.github.com/repos/rieck/malheur/issues/12/labels{/name}","comments_url":"https://api.github.com/repos/rieck/malheur/issues/12/comments","events_url":"https://api.github.com/repos/rieck/malheur/issues/12/events","html_url":"https://github.com/rieck/malheur/issues/12","id":101424336,"number":12,"title":"Inconsistent results with increment mode","user":{"login":"KillerInstinct","id":6646507,"avatar_url":"https://avatars.githubusercontent.com/u/6646507?v=3","gravatar_id":"","url":"https://api.github.com/users/KillerInstinct","html_url":"https://github.com/KillerInstinct","followers_url":"https://api.github.com/users/KillerInstinct/followers","following_url":"https://api.github.com/users/KillerInstinct/following{/other_user}","gists_url":"https://api.github.com/users/KillerInstinct/gists{/gist_id}","starred_url":"https://api.github.com/users/KillerInstinct/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/KillerInstinct/subscriptions","organizations_url":"https://api.github.com/users/KillerInstinct/orgs","repos_url":"https://api.github.com/users/KillerInstinct/repos","events_url":"https://api.github.com/users/KillerInstinct/events{/privacy}","received_events_url":"https://api.github.com/users/KillerInstinct/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-08-17T13:49:14Z","updated_at":"2015-08-23T01:53:34Z","closed_at":null,"body":"Whenever I run Malheur in increment mode and feed it one report at a time, I don't get any results, forcing me to rerun it against all previous reports. This yields a noticeable overhead of processing time that likely shouldn't need to be done I'd imagine. Using increment mode with a batch of reports seems to produce the desired results, but I am not able to do this automatically as our system (Cuckoo) feeds reports out one-by-one. Would there be any chance to support single reports in increment mode?"},"comment":{"url":"https://api.github.com/repos/rieck/malheur/issues/comments/133770023","html_url":"https://github.com/rieck/malheur/issues/12#issuecomment-133770023","issue_url":"https://api.github.com/repos/rieck/malheur/issues/12","id":133770023,"user":{"login":"KillerInstinct","id":6646507,"avatar_url":"https://avatars.githubusercontent.com/u/6646507?v=3","gravatar_id":"","url":"https://api.github.com/users/KillerInstinct","html_url":"https://github.com/KillerInstinct","followers_url":"https://api.github.com/users/KillerInstinct/followers","following_url":"https://api.github.com/users/KillerInstinct/following{/other_user}","gists_url":"https://api.github.com/users/KillerInstinct/gists{/gist_id}","starred_url":"https://api.github.com/users/KillerInstinct/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/KillerInstinct/subscriptions","organizations_url":"https://api.github.com/users/KillerInstinct/orgs","repos_url":"https://api.github.com/users/KillerInstinct/repos","events_url":"https://api.github.com/users/KillerInstinct/events{/privacy}","received_events_url":"https://api.github.com/users/KillerInstinct/received_events","type":"User","site_admin":false},"created_at":"2015-08-23T01:53:34Z","updated_at":"2015-08-23T01:53:34Z","body":"Just JSON. I can provide examples of JSON reports, or example output results from Malheur if need be. Here's the information we collect though:\r\n\r\nhttps://github.com/brad-accuvant/cuckoo-modified/blob/master/modules/reporting/malheur.py#L52"}}