No access to variables in knowledgebase after update
- Dominant language
- Python
- Stars
- 5.1k
- Forks
- 796
- PR merge metrics
- No merged PRs in 30d
Description
Hi all,
while debugging with @sruester on #627 , we encoutered the following behavior:
The knowledge base for users is only fully filled for currently logged in users. So amongst other things the variable `Localappdata` is only available if an user is or was logged in.
When the knowledgebase is refreshed (for example due to an "Interogate" flow) at an later point in time, these information is not shown any more in the knowledgebase and only these "default values" are visible:
- `Username`,
- `Sid`,
- `Userprofile`,
- `Homedir`.
Nevertheless the values are still available (due to the history view in full details for systems) they don't seem to be evaluated while executing flows. i.e. the default flow "WindowsUserRegistryFiles" does not provide a `UsrClass.dat`.
Changing `%%users.localappdata%%\Microsoft\Windows\UsrClass.dat` to `%%users.homedir%%\AppData\Local\Microsoft\Windows\UsrClass.dat` would fix this temporarily.
Is this the intended behavior?
Thx
Mathias
Contributor guide
Assessment
This issue has not been assessed yet.