Merge refactor/structured-alerting into v2

Resolved conflicts:
- pyproject.toml: Used v2 pinned dependency versions
- Removed cmd_check_adb.py (deleted in refactor branch)
- Updated all command files to include disable_version_check and disable_indicator_check flags
- Adopted new AlertStore system from refactor branch
- Updated version to 3.0.0
- Kept VirusTotal functionality commented out
- Consolidated imports and module lists
- Adopted refactor branch's simplified JSON loading
- Updated iOS modules to use new alertstore approach

src/mvt/android/artifacts/dumpsys_accessibility.py

@@ -14,10 +14,10 @@ class DumpsysAccessibilityArtifact(AndroidArtifact):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_app_id(result["package_name"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
                 continue
 
     def parse(self, content: str) -> None:

src/mvt/android/artifacts/dumpsys_appops.py

@@ -4,9 +4,9 @@
 #   https://license.mvt.re/1.1/
 
 from datetime import datetime
-from typing import Any, Dict, List, Union
 
 from mvt.common.utils import convert_datetime_to_iso
+from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
 
 from .artifact import AndroidArtifact
 
@@ -20,9 +20,9 @@ class DumpsysAppopsArtifact(AndroidArtifact):
     Parser for dumpsys app ops info
     """
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, result: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
-        for perm in record["permissions"]:
+        for perm in result["permissions"]:
             if "entries" not in perm:
                 continue
 
@@ -33,7 +33,7 @@ class DumpsysAppopsArtifact(AndroidArtifact):
                             "timestamp": entry["timestamp"],
                             "module": self.__class__.__name__,
                             "event": entry["access"],
-                            "data": f"{record['package_name']} access to "
+                            "data": f"{result['package_name']} access to "
                             f"{perm['name']}: {entry['access']}",
                         }
                     )
@@ -43,48 +43,51 @@ class DumpsysAppopsArtifact(AndroidArtifact):
     def check_indicators(self) -> None:
         for result in self.results:
             if self.indicators:
-                ioc = self.indicators.check_app_id(result.get("package_name"))
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                ioc_match = self.indicators.check_app_id(result.get("package_name"))
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(), ioc_match.message, "", result
+                    )
                     continue
 
-            detected_permissions = []
+            # We use a placeholder entry to create a basic alert even without permission entries.
+            placeholder_entry = {"access": "Unknown", "timestamp": ""}
+
             for perm in result["permissions"]:
                 if (
                     perm["name"] in RISKY_PERMISSIONS
                     # and perm["access"] == "allow"
                 ):
-                    detected_permissions.append(perm)
-                    for entry in sorted(perm["entries"], key=lambda x: x["timestamp"]):
-                        self.log.warning(
-                            "Package '%s' had risky permission '%s' set to '%s' at %s",
-                            result["package_name"],
-                            perm["name"],
-                            entry["access"],
+                    for entry in sorted(
+                        perm["entries"] or [placeholder_entry],
+                        key=lambda x: x["timestamp"],
+                    ):
+                        cleaned_result = result.copy()
+                        cleaned_result["permissions"] = [perm]
+                        self.alertstore.medium(
+                            self.get_slug(),
+                            f"Package '{result['package_name']}' had risky permission '{perm['name']}' set to '{entry['access']}' at {entry['timestamp']}",
                             entry["timestamp"],
+                            cleaned_result,
                         )
 
                 elif result["package_name"] in RISKY_PACKAGES:
-                    detected_permissions.append(perm)
-                    for entry in sorted(perm["entries"], key=lambda x: x["timestamp"]):
-                        self.log.warning(
-                            "Risky package '%s' had '%s' permission set to '%s' at %s",
-                            result["package_name"],
-                            perm["name"],
-                            entry["access"],
+                    for entry in sorted(
+                        perm["entries"] or [placeholder_entry],
+                        key=lambda x: x["timestamp"],
+                    ):
+                        cleaned_result = result.copy()
+                        cleaned_result["permissions"] = [perm]
+                        self.alertstore.medium(
+                            self.get_slug(),
+                            f"Risky package '{result['package_name']}' had '{perm['name']}' permission set to '{entry['access']}' at {entry['timestamp']}",
                             entry["timestamp"],
+                            cleaned_result,
                         )
 
-            if detected_permissions:
-                # We clean the result to only include the risky permission, otherwise the timeline
-                # will be polluted with all the other irrelevant permissions
-                cleaned_result = result.copy()
-                cleaned_result["permissions"] = detected_permissions
-                self.detected.append(cleaned_result)
-
     def parse(self, output: str) -> None:
-        self.results: List[Dict[str, Any]] = []
+        # self.results: List[Dict[str, Any]] = []
         perm = {}
         package = {}
         entry = {}

src/mvt/android/artifacts/dumpsys_battery_daily.py

@@ -3,9 +3,9 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-from typing import Union
 
 from .artifact import AndroidArtifact
+from mvt.common.module_types import ModuleSerializedResult, ModuleAtomicResult
 
 
 class DumpsysBatteryDailyArtifact(AndroidArtifact):
@@ -13,7 +13,7 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact):
     Parser for dumpsys dattery daily updates.
     """
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["from"],
             "module": self.__class__.__name__,
@@ -27,10 +27,10 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_app_id(result["package_name"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
                 continue
 
     def parse(self, output: str) -> None:

src/mvt/android/artifacts/dumpsys_battery_history.py

@@ -16,10 +16,10 @@ class DumpsysBatteryHistoryArtifact(AndroidArtifact):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_app_id(result["package_name"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
                 continue
 
     def parse(self, data: str) -> None:

src/mvt/android/artifacts/dumpsys_dbinfo.py

@@ -20,10 +20,12 @@ class DumpsysDBInfoArtifact(AndroidArtifact):
         for result in self.results:
             path = result.get("path", "")
             for part in path.split("/"):
-                ioc = self.indicators.check_app_id(part)
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                ioc_match = self.indicators.check_app_id(part)
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(), ioc_match.message, "", result
+                    )
                     continue
 
     def parse(self, output: str) -> None:

src/mvt/android/artifacts/dumpsys_package_activities.py

@@ -12,10 +12,12 @@ class DumpsysPackageActivitiesArtifact(AndroidArtifact):
             return
 
         for activity in self.results:
-            ioc = self.indicators.check_app_id(activity["package_name"])
-            if ioc:
-                activity["matched_indicator"] = ioc
-                self.detected.append(activity)
+            ioc_match = self.indicators.check_app_id(activity["package_name"])
+            if ioc_match:
+                activity["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(
+                    self.get_slug(), ioc_match.message, "", activity
+                )
                 continue
 
     def parse(self, content: str):

src/mvt/android/artifacts/dumpsys_packages.py

@@ -4,35 +4,39 @@
 #   https://license.mvt.re/1.1/
 
 import re
-from typing import Any, Dict, List, Union
+from typing import Any, Dict, List
 
 from mvt.android.utils import ROOT_PACKAGES
 
 from .artifact import AndroidArtifact
+from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
 
 
 class DumpsysPackagesArtifact(AndroidArtifact):
     def check_indicators(self) -> None:
         for result in self.results:
+            # XXX: De-duplication Package detections
             if result["package_name"] in ROOT_PACKAGES:
-                self.log.warning(
-                    'Found an installed package related to rooting/jailbreaking: "%s"',
-                    result["package_name"],
+                self.alertstore.medium(
+                    self.get_slug(),
+                    f'Found an installed package related to rooting/jailbreaking: "{result["package_name"]}"',
+                    "",
+                    result,
                 )
-                self.detected.append(result)
+                self.alertstore.log_latest()
                 continue
 
             if not self.indicators:
                 continue
 
-            ioc = self.indicators.check_app_id(result.get("package_name", ""))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_app_id(result.get("package_name", ""))
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
+                self.alertstore.log_latest()
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
-
         timestamps = [
             {"event": "package_install", "timestamp": record["timestamp"]},
             {

src/mvt/android/artifacts/dumpsys_platform_compat.py

@@ -16,10 +16,10 @@ class DumpsysPlatformCompatArtifact(AndroidArtifact):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_app_id(result["package_name"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
                 continue
 
     def parse(self, data: str) -> None:

src/mvt/android/artifacts/dumpsys_receivers.py

@@ -50,10 +50,12 @@ class DumpsysReceiversArtifact(AndroidArtifact):
                 if not self.indicators:
                     continue
 
-                ioc = self.indicators.check_app_id(receiver["package_name"])
-                if ioc:
-                    receiver["matched_indicator"] = ioc
-                    self.detected.append({intent: receiver})
+                ioc_match = self.indicators.check_app_id(receiver["package_name"])
+                if ioc_match:
+                    receiver["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(), ioc_match.message, "", {intent: receiver}
+                    )
                     continue
 
     def parse(self, output: str) -> None:

src/mvt/android/artifacts/file_timestamps.py

@@ -2,13 +2,13 @@
 # Copyright (c) 2021-2023 The MVT Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
-from typing import Union
 
 from .artifact import AndroidArtifact
+from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
 
 
 class FileTimestampsArtifact(AndroidArtifact):
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
 
         for ts in set(

src/mvt/android/artifacts/getprop.py

@@ -59,13 +59,16 @@ class GetProp(AndroidArtifact):
                 self.log.info("%s: %s", entry["name"], entry["value"])
 
             if entry["name"] == "ro.build.version.security_patch":
-                warn_android_patch_level(entry["value"], self.log)
+                warning_message = warn_android_patch_level(entry["value"], self.log)
+                self.alertstore.medium(self.get_slug(), warning_message, "", entry)
 
         if not self.indicators:
             return
 
         for result in self.results:
-            ioc = self.indicators.check_android_property_name(result.get("name", ""))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_android_property_name(
+                result.get("name", "")
+            )
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)

src/mvt/android/artifacts/processes.py

@@ -58,13 +58,13 @@ class Processes(AndroidArtifact):
             if result["proc_name"] == "gatekeeperd":
                 continue
 
-            ioc = self.indicators.check_app_id(proc_name)
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_app_id(proc_name)
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
                 continue
 
-            ioc = self.indicators.check_process(proc_name)
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_process(proc_name)
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)

src/mvt/android/artifacts/tombstone_crashes.py

@@ -4,13 +4,14 @@
 #   https://license.mvt.re/1.1/
 
 import datetime
-from typing import List, Optional, Union
+from typing import List, Optional
 
 import pydantic
 import betterproto
 from dateutil import parser
 
 from mvt.common.utils import convert_datetime_to_iso
+from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
 from mvt.android.parsers.proto.tombstone import Tombstone
 from .artifact import AndroidArtifact
 
@@ -76,7 +77,7 @@ class TombstoneCrashArtifact(AndroidArtifact):
     This parser can parse both text and protobuf tombstone crash files.
     """
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["timestamp"],
             "module": self.__class__.__name__,
@@ -92,18 +93,20 @@ class TombstoneCrashArtifact(AndroidArtifact):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_process(result["process_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_process(result["process_name"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
                 continue
 
             if result.get("command_line", []):
                 command_name = result.get("command_line")[0].split("/")[-1]
-                ioc = self.indicators.check_process(command_name)
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                ioc_match = self.indicators.check_process(command_name)
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(), ioc_match.message, "", result
+                    )
                     continue
 
             SUSPICIOUS_UIDS = [
@@ -112,11 +115,15 @@ class TombstoneCrashArtifact(AndroidArtifact):
                 2000,  # shell
             ]
             if result["uid"] in SUSPICIOUS_UIDS:
-                self.log.warning(
-                    f"Potentially suspicious crash in process '{result['process_name']}' "
-                    f"running as UID '{result['uid']}' in tombstone '{result['file_name']}' at {result['timestamp']}"
+                self.alertstore.medium(
+                    self.get_slug(),
+                    (
+                        f"Potentially suspicious crash in process '{result['process_name']}' "
+                        f"running as UID '{result['uid']}' in tombstone '{result['file_name']}' at {result['timestamp']}"
+                    ),
+                    "",
+                    result,
                 )
-                self.detected.append(result)
 
     def parse_protobuf(
         self, file_name: str, file_timestamp: datetime.datetime, data: bytes

src/mvt/android/cli.py

@@ -9,42 +9,33 @@ import click
 
 from mvt.common.cmd_check_iocs import CmdCheckIOCS
 from mvt.common.help import (
-    HELP_MSG_VERSION,
-    HELP_MSG_OUTPUT,
-    HELP_MSG_SERIAL,
-    HELP_MSG_DOWNLOAD_APKS,
-    HELP_MSG_DOWNLOAD_ALL_APKS,
-    HELP_MSG_VIRUS_TOTAL,
-    HELP_MSG_APK_OUTPUT,
-    HELP_MSG_APKS_FROM_FILE,
-    HELP_MSG_VERBOSE,
-    HELP_MSG_CHECK_ADB,
+    HELP_MSG_ANDROID_BACKUP_PASSWORD,
+    HELP_MSG_CHECK_ADB_REMOVED,
+    HELP_MSG_CHECK_ADB_REMOVED_DESCRIPTION,
+    HELP_MSG_CHECK_ANDROID_BACKUP,
+    HELP_MSG_CHECK_ANDROIDQF,
+    HELP_MSG_CHECK_BUGREPORT,
+    HELP_MSG_CHECK_IOCS,
+    HELP_MSG_DISABLE_INDICATOR_UPDATE_CHECK,
+    HELP_MSG_DISABLE_UPDATE_CHECK,
+    HELP_MSG_HASHES,
     HELP_MSG_IOC,
-    HELP_MSG_FAST,
     HELP_MSG_LIST_MODULES,
     HELP_MSG_MODULE,
     HELP_MSG_NONINTERACTIVE,
-    HELP_MSG_ANDROID_BACKUP_PASSWORD,
-    HELP_MSG_CHECK_BUGREPORT,
-    HELP_MSG_CHECK_ANDROID_BACKUP,
-    HELP_MSG_CHECK_ANDROIDQF,
-    HELP_MSG_HASHES,
-    HELP_MSG_CHECK_IOCS,
+    HELP_MSG_OUTPUT,
     HELP_MSG_STIX2,
-    HELP_MSG_DISABLE_UPDATE_CHECK,
-    HELP_MSG_DISABLE_INDICATOR_UPDATE_CHECK,
+    HELP_MSG_VERBOSE,
+    HELP_MSG_VERSION,
 )
 from mvt.common.logo import logo
 from mvt.common.updates import IndicatorsUpdates
 from mvt.common.utils import init_logging, set_verbose_logging
 
-from .cmd_check_adb import CmdAndroidCheckADB
 from .cmd_check_androidqf import CmdAndroidCheckAndroidQF
 from .cmd_check_backup import CmdAndroidCheckBackup
 from .cmd_check_bugreport import CmdAndroidCheckBugreport
-from .cmd_download_apks import DownloadAPKs
-from .modules.adb import ADB_MODULES
-from .modules.adb.packages import Packages
+from .modules.androidqf import ANDROIDQF_MODULES
 from .modules.backup import BACKUP_MODULES
 from .modules.backup.helpers import cli_load_android_backup_password
 from .modules.bugreport import BUGREPORT_MODULES
@@ -97,119 +88,14 @@ def version():
 
 
 # ==============================================================================
-# Command: download-apks
+# Command: check-adb (removed)
 # ==============================================================================
 @cli.command(
-    "download-apks", context_settings=CONTEXT_SETTINGS, help=HELP_MSG_DOWNLOAD_APKS
+    "check-adb", context_settings=CONTEXT_SETTINGS, help=HELP_MSG_CHECK_ADB_REMOVED
 )
-@click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
-@click.option("--all-apks", "-a", is_flag=True, help=HELP_MSG_DOWNLOAD_ALL_APKS)
-@click.option("--virustotal", "-V", is_flag=True, help=HELP_MSG_VIRUS_TOTAL)
-@click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_APK_OUTPUT)
-@click.option(
-    "--from-file", "-f", type=click.Path(exists=True), help=HELP_MSG_APKS_FROM_FILE
-)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
 @click.pass_context
-def download_apks(ctx, all_apks, virustotal, output, from_file, serial, verbose):
-    set_verbose_logging(verbose)
-    try:
-        if from_file:
-            download = DownloadAPKs.from_json(from_file)
-        else:
-            # TODO: Do we actually want to be able to run without storing any
-            #       file?
-            if not output:
-                log.critical("You need to specify an output folder with --output!")
-                ctx.exit(1)
-
-            download = DownloadAPKs(results_path=output, all_apks=all_apks)
-            if serial:
-                download.serial = serial
-            download.run()
-
-        packages_to_lookup = []
-        if all_apks:
-            packages_to_lookup = download.packages
-        else:
-            for package in download.packages:
-                if not package.get("system", False):
-                    packages_to_lookup.append(package)
-
-            if len(packages_to_lookup) == 0:
-                return
-
-        if virustotal:
-            m = Packages()
-            m.check_virustotal(packages_to_lookup)
-    except KeyboardInterrupt:
-        print("")
-        ctx.exit(1)
-
-
-# ==============================================================================
-# Command: check-adb
-# ==============================================================================
-@cli.command("check-adb", context_settings=CONTEXT_SETTINGS, help=HELP_MSG_CHECK_ADB)
-@click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
-@click.option(
-    "--iocs",
-    "-i",
-    type=click.Path(exists=True),
-    multiple=True,
-    default=[],
-    help=HELP_MSG_IOC,
-)
-@click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
-@click.option("--fast", "-f", is_flag=True, help=HELP_MSG_FAST)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.option("--non-interactive", "-n", is_flag=True, help=HELP_MSG_NONINTERACTIVE)
-@click.option("--backup-password", "-p", help=HELP_MSG_ANDROID_BACKUP_PASSWORD)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
-@click.pass_context
-def check_adb(
-    ctx,
-    serial,
-    iocs,
-    output,
-    fast,
-    list_modules,
-    module,
-    non_interactive,
-    backup_password,
-    verbose,
-):
-    set_verbose_logging(verbose)
-    module_options = {
-        "fast_mode": fast,
-        "interactive": not non_interactive,
-        "backup_password": cli_load_android_backup_password(log, backup_password),
-    }
-
-    cmd = CmdAndroidCheckADB(
-        results_path=output,
-        ioc_files=iocs,
-        module_name=module,
-        serial=serial,
-        module_options=module_options,
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
-    )
-
-    if list_modules:
-        cmd.list_modules()
-        return
-
-    log.info("Checking Android device over debug bridge")
-
-    cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning(
-            "The analysis of the Android device produced %d detections!",
-            cmd.detected_count,
-        )
+def check_adb(ctx):
+    log.error(HELP_MSG_CHECK_ADB_REMOVED_DESCRIPTION)
 
 
 # ==============================================================================
@@ -252,12 +138,8 @@ def check_bugreport(ctx, iocs, output, list_modules, module, verbose, bugreport_
     log.info("Checking Android bug report at path: %s", bugreport_path)
 
     cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning(
-            "The analysis of the Android bug report produced %d detections!",
-            cmd.detected_count,
-        )
+    cmd.show_alerts_brief()
+    cmd.show_support_message()
 
 
 # ==============================================================================
@@ -316,12 +198,8 @@ def check_backup(
     log.info("Checking Android backup at path: %s", backup_path)
 
     cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning(
-            "The analysis of the Android backup produced %d detections!",
-            cmd.detected_count,
-        )
+    cmd.show_alerts_brief()
+    cmd.show_support_message()
 
 
 # ==============================================================================
@@ -382,12 +260,9 @@ def check_androidqf(
     log.info("Checking AndroidQF acquisition at path: %s", androidqf_path)
 
     cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning(
-            "The analysis of the AndroidQF acquisition produced %d detections!",
-            cmd.detected_count,
-        )
+    cmd.show_alerts_brief()
+    cmd.show_disable_adb_warning()
+    cmd.show_support_message()
 
 
 # ==============================================================================
@@ -407,20 +282,16 @@ def check_androidqf(
 @click.argument("FOLDER", type=click.Path(exists=True))
 @click.pass_context
 def check_iocs(ctx, iocs, list_modules, module, folder):
-    cmd = CmdCheckIOCS(
-        target_path=folder,
-        ioc_files=iocs,
-        module_name=module,
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
-    )
-    cmd.modules = BACKUP_MODULES + ADB_MODULES + BUGREPORT_MODULES
+    cmd = CmdCheckIOCS(target_path=folder, ioc_files=iocs, module_name=module)
+    cmd.modules = BACKUP_MODULES + BUGREPORT_MODULES + ANDROIDQF_MODULES
 
     if list_modules:
         cmd.list_modules()
         return
 
     cmd.run()
+    cmd.show_alerts_brief()
+    cmd.show_support_message()
 
 
 # ==============================================================================

src/mvt/android/cmd_check_adb.py

@@ -1,48 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.common.command import Command
-from mvt.common.indicators import Indicators
-
-from .modules.adb import ADB_MODULES
-
-log = logging.getLogger(__name__)
-
-
-class CmdAndroidCheckADB(Command):
-    def __init__(
-        self,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        ioc_files: Optional[list] = None,
-        iocs: Optional[Indicators] = None,
-        module_name: Optional[str] = None,
-        serial: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        hashes: Optional[bool] = False,
-        sub_command: Optional[bool] = False,
-        disable_version_check: bool = False,
-        disable_indicator_check: bool = False,
-    ) -> None:
-        super().__init__(
-            target_path=target_path,
-            results_path=results_path,
-            ioc_files=ioc_files,
-            iocs=iocs,
-            module_name=module_name,
-            serial=serial,
-            module_options=module_options,
-            hashes=hashes,
-            sub_command=sub_command,
-            log=log,
-            disable_version_check=disable_version_check,
-            disable_indicator_check=disable_indicator_check,
-        )
-
-        self.name = "check-adb"
-        self.modules = ADB_MODULES

src/mvt/android/cmd_check_androidqf.py

@@ -70,6 +70,9 @@ class CmdAndroidCheckAndroidQF(Command):
         self.__files: List[str] = []
 
     def init(self):
+        if not self.target_path:
+            raise NoAndroidQFTargetPath
+
         if os.path.isdir(self.target_path):
             self.__format = "dir"
             parent_path = Path(self.target_path).absolute().parent.as_posix()
@@ -157,9 +160,11 @@ class CmdAndroidCheckAndroidQF(Command):
             cmd.from_zip(bugreport)
             cmd.run()
 
-            self.detected_count += cmd.detected_count
             self.timeline.extend(cmd.timeline)
-            self.timeline_detected.extend(cmd.timeline_detected)
+            self.alertstore.extend(cmd.alertstore.alerts)
+        finally:
+            if bugreport:
+                bugreport.close()
 
     def run_backup_cmd(self) -> bool:
         try:
@@ -182,9 +187,11 @@ class CmdAndroidCheckAndroidQF(Command):
             cmd.from_ab(backup)
             cmd.run()
 
-            self.detected_count += cmd.detected_count
             self.timeline.extend(cmd.timeline)
-            self.timeline_detected.extend(cmd.timeline_detected)
+            self.alertstore.extend(cmd.alertstore.alerts)
+        finally:
+            if backup:
+                backup.close()
 
     def finish(self) -> None:
         """

src/mvt/android/cmd_check_backup.py

@@ -11,7 +11,7 @@ import tarfile
 from pathlib import Path
 from typing import List, Optional
 
-from mvt.android.modules.backup.base import BackupExtraction
+from mvt.android.modules.backup.base import BackupModule
 from mvt.android.modules.backup.helpers import prompt_or_load_android_backup_password
 from mvt.android.parsers.backup import (
     AndroidBackupParsingError,
@@ -60,9 +60,37 @@ class CmdAndroidCheckBackup(Command):
         self.name = "check-backup"
         self.modules = BACKUP_MODULES
 
-        self.backup_type: str = ""
-        self.backup_archive: Optional[tarfile.TarFile] = None
-        self.backup_files: List[str] = []
+        self.__type: str = ""
+        self.__tar: Optional[tarfile.TarFile] = None
+        self.__files: List[str] = []
+
+    def from_ab(self, ab_file_bytes: bytes) -> None:
+        self.__type = "ab"
+        header = parse_ab_header(ab_file_bytes)
+        if not header["backup"]:
+            log.critical("Invalid backup format, file should be in .ab format")
+            sys.exit(1)
+
+        password = None
+        if header["encryption"] != "none":
+            password = prompt_or_load_android_backup_password(log, self.module_options)
+            if not password:
+                log.critical("No backup password provided.")
+                sys.exit(1)
+        try:
+            tardata = parse_backup_file(ab_file_bytes, password=password)
+        except InvalidBackupPassword:
+            log.critical("Invalid backup password")
+            sys.exit(1)
+        except AndroidBackupParsingError as exc:
+            log.critical("Impossible to parse this backup file: %s", exc)
+            log.critical("Please use Android Backup Extractor (ABE) instead")
+            sys.exit(1)
+
+        dbytes = io.BytesIO(tardata)
+        self.__tar = tarfile.open(fileobj=dbytes)
+        for member in self.__tar:
+            self.__files.append(member.name)
 
     def from_ab(self, ab_file_bytes: bytes) -> None:
         self.backup_type = "ab"
@@ -97,17 +125,17 @@ class CmdAndroidCheckBackup(Command):
             return
 
         if os.path.isfile(self.target_path):
-            self.backup_type = "ab"
+            self.__type = "ab"
             with open(self.target_path, "rb") as handle:
                 ab_file_bytes = handle.read()
             self.from_ab(ab_file_bytes)
 
         elif os.path.isdir(self.target_path):
-            self.backup_type = "folder"
+            self.__type = "folder"
             self.target_path = Path(self.target_path).absolute().as_posix()
             for root, subdirs, subfiles in os.walk(os.path.abspath(self.target_path)):
                 for fname in subfiles:
-                    self.backup_files.append(
+                    self.__files.append(
                         os.path.relpath(os.path.join(root, fname), self.target_path)
                     )
         else:
@@ -117,8 +145,12 @@ class CmdAndroidCheckBackup(Command):
             )
             sys.exit(1)
 
-    def module_init(self, module: BackupExtraction) -> None:  # type: ignore[override]
-        if self.backup_type == "folder":
-            module.from_dir(self.target_path, self.backup_files)
+    def module_init(self, module: BackupModule) -> None:  # type: ignore[override]
+        if self.__type == "folder":
+            module.from_dir(self.target_path, self.__files)
         else:
-            module.from_ab(self.target_path, self.backup_archive, self.backup_files)
+            module.from_ab(self.target_path, self.__tar, self.__files)
+
+    def finish(self) -> None:
+        if self.__tar:
+            self.__tar.close()

src/mvt/android/cmd_download_apks.py

@@ -1,184 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import json
-import logging
-import os
-from typing import Callable, Optional, Union
-
-from rich.progress import track
-
-from mvt.common.module import InsufficientPrivileges
-
-from .modules.adb.base import AndroidExtraction
-from .modules.adb.packages import Packages
-
-log = logging.getLogger(__name__)
-
-
-class DownloadAPKs(AndroidExtraction):
-    """DownloadAPKs is the main class operating the download of APKs
-    from the device.
-    """
-
-    def __init__(
-        self,
-        results_path: Optional[str] = None,
-        all_apks: bool = False,
-        packages: Optional[list] = None,
-    ) -> None:
-        """Initialize module.
-        :param results_path: Path to the folder where data should be stored
-        :param all_apks: Boolean indicating whether to download all packages
-                         or filter known-goods
-        :param packages: Provided list of packages, typically for JSON checks
-        """
-        super().__init__(results_path=results_path, log=log)
-
-        self.packages = packages
-        self.all_apks = all_apks
-        self.results_path_apks = None
-
-    @classmethod
-    def from_json(cls, json_path: str) -> Callable:
-        """Initialize this class from an existing apks.json file.
-
-        :param json_path: Path to the apks.json file to parse.
-
-        """
-        with open(json_path, "r", encoding="utf-8") as handle:
-            packages = json.load(handle)
-            return cls(packages=packages)
-
-    def pull_package_file(
-        self, package_name: str, remote_path: str
-    ) -> Union[str, None]:
-        """Pull files related to specific package from the device.
-
-        :param package_name: Name of the package to download
-        :param remote_path: Path to the file to download
-        :returns: Path to the local copy
-
-        """
-        log.info("Downloading %s ...", remote_path)
-
-        file_name = ""
-        if "==/" in remote_path:
-            file_name = "_" + remote_path.split("==/")[1].replace(".apk", "")
-
-        local_path = os.path.join(
-            self.results_path_apks, f"{package_name}{file_name}.apk"
-        )
-        name_counter = 0
-        while True:
-            if not os.path.exists(local_path):
-                break
-
-            name_counter += 1
-            local_path = os.path.join(
-                self.results_path_apks, f"{package_name}{file_name}_{name_counter}.apk"
-            )
-
-        try:
-            self._adb_download(remote_path, local_path)
-        except InsufficientPrivileges:
-            log.error(
-                "Unable to pull package file from %s: insufficient privileges, "
-                "it might be a system app",
-                remote_path,
-            )
-            self._adb_reconnect()
-            return None
-        except Exception as exc:
-            log.exception("Failed to pull package file from %s: %s", remote_path, exc)
-            self._adb_reconnect()
-            return None
-
-        return local_path
-
-    def get_packages(self) -> None:
-        """Use the Packages adb module to retrieve the list of packages.
-        We reuse the same extraction logic to then download the APKs.
-        """
-        self.log.info("Retrieving list of installed packages...")
-
-        m = Packages()
-        m.log = self.log
-        m.serial = self.serial
-        m.run()
-
-        self.packages = m.results
-
-    def pull_packages(self) -> None:
-        """Download all files of all selected packages from the device."""
-        log.info(
-            "Starting extraction of installed APKs at folder %s", self.results_path
-        )
-
-        # If the user provided the flag --all-apks we select all packages.
-        packages_selection = []
-        if self.all_apks:
-            log.info("Selected all %d available packages", len(self.packages))
-            packages_selection = self.packages
-        else:
-            # Otherwise we loop through the packages and get only those that
-            # are not marked as system.
-            for package in self.packages:
-                if not package.get("system", False):
-                    packages_selection.append(package)
-
-            log.info(
-                'Selected only %d packages which are not marked as "system"',
-                len(packages_selection),
-            )
-
-        if len(packages_selection) == 0:
-            log.info("No packages were selected for download")
-            return
-
-        log.info("Downloading packages from device. This might take some time ...")
-
-        self.results_path_apks = os.path.join(self.results_path, "apks")
-        if not os.path.exists(self.results_path_apks):
-            os.makedirs(self.results_path_apks, exist_ok=True)
-
-        for i in track(
-            range(len(packages_selection)),
-            description=f"Downloading {len(packages_selection)} packages...",
-        ):
-            package = packages_selection[i]
-
-            log.info(
-                "[%d/%d] Package: %s",
-                i,
-                len(packages_selection),
-                package["package_name"],
-            )
-
-            # Sometimes the package path contains multiple lines for multiple
-            # apks. We loop through each line and download each file.
-            for package_file in package["files"]:
-                device_path = package_file["path"]
-                local_path = self.pull_package_file(
-                    package["package_name"], device_path
-                )
-                if not local_path:
-                    continue
-
-                package_file["local_path"] = local_path
-
-        log.info("Download of selected packages completed")
-
-    def save_json(self) -> None:
-        json_path = os.path.join(self.results_path, "apks.json")
-        with open(json_path, "w", encoding="utf-8") as handle:
-            json.dump(self.packages, handle, indent=4)
-
-    def run(self) -> None:
-        self.get_packages()
-        self._adb_connect()
-        self.pull_packages()
-        self.save_json()
-        self._adb_disconnect()

src/mvt/android/modules/adb/base.py

@@ -1,355 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import base64
-import logging
-import os
-import random
-import string
-import sys
-import tempfile
-import time
-from typing import Callable, Optional
-
-from adb_shell.adb_device import AdbDeviceTcp, AdbDeviceUsb
-from adb_shell.auth.keygen import keygen, write_public_keyfile
-from adb_shell.auth.sign_pythonrsa import PythonRSASigner
-from adb_shell.exceptions import (
-    AdbCommandFailureException,
-    DeviceAuthError,
-    UsbDeviceNotFoundError,
-    UsbReadFailedError,
-)
-from usb1 import USBErrorAccess, USBErrorBusy
-
-from mvt.android.modules.backup.helpers import prompt_or_load_android_backup_password
-from mvt.android.parsers.backup import (
-    InvalidBackupPassword,
-    parse_ab_header,
-    parse_backup_file,
-)
-from mvt.common.module import InsufficientPrivileges, MVTModule
-
-ADB_KEY_PATH = os.path.expanduser("~/.android/adbkey")
-ADB_PUB_KEY_PATH = os.path.expanduser("~/.android/adbkey.pub")
-
-
-class AndroidExtraction(MVTModule):
-    """This class provides a base for all Android extraction modules."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-        self.device = None
-        self.serial = None
-
-    @staticmethod
-    def _adb_check_keys() -> None:
-        """Make sure Android adb keys exist."""
-        if not os.path.isdir(os.path.dirname(ADB_KEY_PATH)):
-            os.makedirs(os.path.dirname(ADB_KEY_PATH))
-
-        if not os.path.exists(ADB_KEY_PATH):
-            keygen(ADB_KEY_PATH)
-
-        if not os.path.exists(ADB_PUB_KEY_PATH):
-            write_public_keyfile(ADB_KEY_PATH, ADB_PUB_KEY_PATH)
-
-    def _adb_connect(self) -> None:
-        """Connect to the device over adb."""
-        self._adb_check_keys()
-
-        with open(ADB_KEY_PATH, "rb") as handle:
-            priv_key = handle.read()
-
-        with open(ADB_PUB_KEY_PATH, "rb") as handle:
-            pub_key = handle.read()
-
-        signer = PythonRSASigner(pub_key, priv_key)
-
-        # If no serial was specified or if the serial does not seem to be
-        # a HOST:PORT definition, we use the USB transport.
-        if not self.serial or ":" not in self.serial:
-            try:
-                self.device = AdbDeviceUsb(serial=self.serial)
-            except UsbDeviceNotFoundError:
-                self.log.critical(
-                    "No device found. Make sure it is connected and unlocked."
-                )
-                sys.exit(-1)
-        # Otherwise we try to use the TCP transport.
-        else:
-            addr = self.serial.split(":")
-            if len(addr) < 2:
-                raise ValueError(
-                    "TCP serial number must follow the format: `address:port`"
-                )
-
-            self.device = AdbDeviceTcp(
-                addr[0], int(addr[1]), default_transport_timeout_s=30.0
-            )
-
-        while True:
-            try:
-                self.device.connect(rsa_keys=[signer], auth_timeout_s=5)
-            except (USBErrorBusy, USBErrorAccess):
-                self.log.critical(
-                    "Device is busy, maybe run `adb kill-server` and try again."
-                )
-                sys.exit(-1)
-            except DeviceAuthError:
-                self.log.error(
-                    "You need to authorize this computer on the Android device. "
-                    "Retrying in 5 seconds..."
-                )
-                time.sleep(5)
-            except UsbReadFailedError:
-                self.log.error(
-                    "Unable to connect to the device over USB. "
-                    "Try to unplug, plug the device and start again."
-                )
-                sys.exit(-1)
-            except OSError as exc:
-                if exc.errno == 113 and self.serial:
-                    self.log.critical(
-                        "Unable to connect to the device %s: "
-                        "did you specify the correct IP address?",
-                        self.serial,
-                    )
-                    sys.exit(-1)
-            else:
-                break
-
-    def _adb_disconnect(self) -> None:
-        """Close adb connection to the device."""
-        self.device.close()
-
-    def _adb_reconnect(self) -> None:
-        """Reconnect to device using adb."""
-        self.log.info("Reconnecting ...")
-        self._adb_disconnect()
-        self._adb_connect()
-
-    def _adb_command(self, command: str, decode: bool = True) -> str:
-        """Execute an adb shell command.
-
-        :param command: Shell command to execute
-        :returns: Output of command
-
-        """
-        return self.device.shell(command, read_timeout_s=200.0, decode=decode)
-
-    def _adb_check_if_root(self) -> bool:
-        """Check if we have a `su` binary on the Android device.
-
-
-        :returns: Boolean indicating whether a `su` binary is present or not
-
-        """
-        result = self._adb_command("command -v su && su -c true")
-        return bool(result) and "Permission denied" not in result
-
-    def _adb_root_or_die(self) -> None:
-        """Check if we have a `su` binary, otherwise raise an Exception."""
-        if not self._adb_check_if_root():
-            raise InsufficientPrivileges(
-                "This module is optionally available "
-                "in case the device is already rooted."
-                " Do NOT root your own device!"
-            )
-
-    def _adb_command_as_root(self, command):
-        """Execute an adb shell command.
-
-        :param command: Shell command to execute as root
-        :returns: Output of command
-
-        """
-        return self._adb_command(f"su -c {command}")
-
-    def _adb_check_file_exists(self, file: str) -> bool:
-        """Verify that a file exists.
-
-        :param file: Path of the file
-        :returns: Boolean indicating whether the file exists or not
-
-        """
-
-        # TODO: Need to support checking files without root privileges as well.
-
-        # Check if we have root, if not raise an Exception.
-        self._adb_root_or_die()
-
-        return bool(self._adb_command_as_root(f"[ ! -f {file} ] || echo 1"))
-
-    def _adb_download(
-        self,
-        remote_path: str,
-        local_path: str,
-        progress_callback: Optional[Callable] = None,
-        retry_root: Optional[bool] = True,
-    ) -> None:
-        """Download a file form the device.
-
-        :param remote_path: Path to download from the device
-        :param local_path: Path to where to locally store the copy of the file
-        :param progress_callback: Callback for download progress bar
-                                  (Default value = None)
-        :param retry_root: Default value = True)
-
-        """
-        try:
-            self.device.pull(remote_path, local_path, progress_callback)
-        except AdbCommandFailureException as exc:
-            if retry_root:
-                self._adb_download_root(remote_path, local_path, progress_callback)
-            else:
-                raise Exception(
-                    f"Unable to download file {remote_path}: {exc}"
-                ) from exc
-
-    def _adb_download_root(
-        self,
-        remote_path: str,
-        local_path: str,
-        progress_callback: Optional[Callable] = None,
-    ) -> None:
-        try:
-            # Check if we have root, if not raise an Exception.
-            self._adb_root_or_die()
-
-            # We generate a random temporary filename.
-            allowed_chars = (
-                string.ascii_uppercase + string.ascii_lowercase + string.digits
-            )
-            tmp_filename = "tmp_" + "".join(random.choices(allowed_chars, k=10))
-
-            # We create a temporary local file.
-            new_remote_path = f"/sdcard/{tmp_filename}"
-
-            # We copy the file from the data folder to /sdcard/.
-            cp_output = self._adb_command_as_root(f"cp {remote_path} {new_remote_path}")
-            if (
-                cp_output.startswith("cp: ")
-                and "No such file or directory" in cp_output
-            ):
-                raise Exception(f"Unable to process file {remote_path}: File not found")
-            if cp_output.startswith("cp: ") and "Permission denied" in cp_output:
-                raise Exception(
-                    f"Unable to process file {remote_path}: Permission denied"
-                )
-
-            # We download from /sdcard/ to the local temporary file.
-            # If it doesn't work now, don't try again (retry_root=False)
-            self._adb_download(
-                new_remote_path, local_path, progress_callback, retry_root=False
-            )
-
-            # Delete the copy on /sdcard/.
-            self._adb_command(f"rm -rf {new_remote_path}")
-
-        except AdbCommandFailureException as exc:
-            raise Exception(f"Unable to download file {remote_path}: {exc}") from exc
-
-    def _adb_process_file(self, remote_path: str, process_routine: Callable) -> None:
-        """Download a local copy of a file which is only accessible as root.
-        This is a wrapper around process_routine.
-
-        :param remote_path: Path of the file on the device to process
-        :param process_routine: Function to be called on the local copy of the
-                                downloaded file
-
-        """
-        # Connect to the device over adb.
-        # Check if we have root, if not raise an Exception.
-        self._adb_root_or_die()
-
-        # We create a temporary local file.
-        tmp = tempfile.NamedTemporaryFile()
-        local_path = tmp.name
-        local_name = os.path.basename(tmp.name)
-        new_remote_path = f"/sdcard/Download/{local_name}"
-
-        # We copy the file from the data folder to /sdcard/.
-        cp_output = self._adb_command_as_root(f"cp {remote_path} {new_remote_path}")
-        if cp_output.startswith("cp: ") and "No such file or directory" in cp_output:
-            raise Exception(f"Unable to process file {remote_path}: File not found")
-        if cp_output.startswith("cp: ") and "Permission denied" in cp_output:
-            raise Exception(f"Unable to process file {remote_path}: Permission denied")
-
-        # We download from /sdcard/ to the local temporary file.
-        self._adb_download(new_remote_path, local_path)
-
-        # Launch the provided process routine!
-        process_routine(local_path)
-
-        # Delete the local copy.
-        tmp.close()
-        # Delete the copy on /sdcard/.
-        self._adb_command(f"rm -f {new_remote_path}")
-
-    def _generate_backup(self, package_name: str) -> bytes:
-        self.log.info(
-            "Please check phone and accept Android backup prompt. "
-            "You may need to set a backup password. \a"
-        )
-
-        if self.module_options.get("backup_password", None):
-            self.log.warning(
-                "Backup password already set from command line or environment "
-                "variable. You should use the same password if enabling encryption!"
-            )
-
-        # TODO: Base64 encoding as temporary fix to avoid byte-mangling over
-        #       the shell transport...
-        cmd = f"/system/bin/bu backup -nocompress '{package_name}' | base64"
-        backup_output_b64 = self._adb_command(cmd)
-        backup_output = base64.b64decode(backup_output_b64)
-        header = parse_ab_header(backup_output)
-
-        if not header["backup"]:
-            self.log.error(
-                "Extracting SMS via Android backup failed. No valid backup data found."
-            )
-            return None
-
-        if header["encryption"] == "none":
-            return parse_backup_file(backup_output, password=None)
-
-        for _ in range(0, 3):
-            backup_password = prompt_or_load_android_backup_password(
-                self.log, self.module_options
-            )
-            if not backup_password:
-                # Fail as no backup password loaded for this encrypted backup
-                self.log.critical("No backup password provided.")
-            try:
-                decrypted_backup_tar = parse_backup_file(backup_output, backup_password)
-                return decrypted_backup_tar
-            except InvalidBackupPassword:
-                self.log.error("You provided the wrong password! Please try again...")
-
-        self.log.error("All attempts to decrypt backup with password failed!")
-
-        return None
-
-    def run(self) -> None:
-        """Run the main procedure."""
-        raise NotImplementedError

src/mvt/android/modules/adb/chrome_history.py

@@ -6,9 +6,14 @@
 import logging
 import os
 import sqlite3
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_chrometime_to_datetime, convert_datetime_to_iso
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+    ModuleResults,
+)
 
 from .base import AndroidExtraction
 
@@ -25,7 +30,7 @@ class ChromeHistory(AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -37,7 +42,7 @@ class ChromeHistory(AndroidExtraction):
         )
         self.results = []
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,
@@ -51,9 +56,10 @@ class ChromeHistory(AndroidExtraction):
             return
 
         for result in self.results:
-            if self.indicators.check_url(result["url"]):
-                self.detected.append(result)
-                continue
+            ioc_match = self.indicators.check_url(result["url"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
 
     def _parse_db(self, db_path: str) -> None:
         """Parse a Chrome History database file.

src/mvt/android/modules/adb/dumpsys_full.py

@@ -8,6 +8,7 @@ import os
 from typing import Optional
 
 from .base import AndroidExtraction
+from mvt.common.module_types import ModuleResults
 
 
 class DumpsysFull(AndroidExtraction):
@@ -20,7 +21,7 @@ class DumpsysFull(AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/adb/files.py

@@ -9,6 +9,7 @@ import stat
 from typing import Optional, Union
 
 from mvt.common.utils import convert_unix_to_iso
+from mvt.common.module_types import ModuleResults
 
 from .base import AndroidExtraction
 
@@ -32,7 +33,7 @@ class Files(AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/adb/getprop.py

@@ -9,6 +9,7 @@ from typing import Optional
 from mvt.android.artifacts.getprop import GetProp as GetPropArtifact
 
 from .base import AndroidExtraction
+from mvt.common.module_types import ModuleResults
 
 
 class Getprop(GetPropArtifact, AndroidExtraction):
@@ -21,7 +22,7 @@ class Getprop(GetPropArtifact, AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/adb/logcat.py

@@ -8,6 +8,7 @@ import os
 from typing import Optional
 
 from .base import AndroidExtraction
+from mvt.common.module_types import ModuleResults
 
 
 class Logcat(AndroidExtraction):
@@ -20,7 +21,7 @@ class Logcat(AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/adb/packages.py

@@ -4,12 +4,7 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from typing import Optional, Union
-
-from rich.console import Console
-from rich.progress import track
-from rich.table import Table
-from rich.text import Text
+from typing import Optional
 
 from mvt.android.artifacts.dumpsys_packages import DumpsysPackagesArtifact
 from mvt.android.utils import (
@@ -19,7 +14,11 @@ from mvt.android.utils import (
     SECURITY_PACKAGES,
     SYSTEM_UPDATE_PACKAGES,
 )
-from mvt.common.virustotal import VTNoKey, VTQuotaExceeded, virustotal_lookup
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+)
 
 from .base import AndroidExtraction
 
@@ -34,7 +33,7 @@ class Packages(AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -46,7 +45,7 @@ class Packages(AndroidExtraction):
         )
         self._user_needed = False
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
 
         timestamps = [
@@ -95,76 +94,71 @@ class Packages(AndroidExtraction):
             if not self.indicators:
                 continue
 
-            ioc = self.indicators.check_app_id(result.get("package_name"))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
+            ioc_match = self.indicators.check_app_id(result.get("package_name"))
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
 
             for package_file in result.get("files", []):
-                ioc = self.indicators.check_file_hash(package_file["sha256"])
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-
-    def check_virustotal(self, packages: list) -> None:
-        hashes = []
-        for package in packages:
-            for file in package.get("files", []):
-                if file["sha256"] not in hashes:
-                    hashes.append(file["sha256"])
-
-        total_hashes = len(hashes)
-        detections = {}
-
-        progress_desc = f"Looking up {total_hashes} files..."
-        for i in track(range(total_hashes), description=progress_desc):
-            try:
-                results = virustotal_lookup(hashes[i])
-            except VTNoKey:
-                return
-            except VTQuotaExceeded as exc:
-                print("Unable to continue: %s", exc)
-                break
-
-            if not results:
-                continue
-
-            positives = results["attributes"]["last_analysis_stats"]["malicious"]
-            total = len(results["attributes"]["last_analysis_results"])
-
-            detections[hashes[i]] = f"{positives}/{total}"
-
-        table = Table(title="VirusTotal Packages Detections")
-        table.add_column("Package name")
-        table.add_column("File path")
-        table.add_column("Detections")
-
-        for package in packages:
-            for file in package.get("files", []):
-                if "package_name" in package:
-                    row = [package["package_name"], file["path"]]
-                elif "name" in package:
-                    row = [package["name"], file["path"]]
-                else:
-                    self.log.error(
-                        f"Package {package} has no name or package_name. packages.json or apks.json is malformed"
+                ioc_match = self.indicators.check_file_hash(package_file["sha256"])
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(), ioc_match.message, "", result
                     )
-                    continue
-                if file["sha256"] in detections:
-                    detection = detections[file["sha256"]]
-                    positives = detection.split("/")[0]
-                    if int(positives) > 0:
-                        row.append(Text(detection, "red bold"))
-                    else:
-                        row.append(detection)
-                else:
-                    row.append("not found")
 
-                table.add_row(*row)
+    # @staticmethod
+    # def check_virustotal(packages: list) -> None:
+    #     hashes = []
+    #     for package in packages:
+    #         for file in package.get("files", []):
+    #             if file["sha256"] not in hashes:
+    #                 hashes.append(file["sha256"])
 
-        console = Console()
-        console.print(table)
+    #     total_hashes = len(hashes)
+    #     detections = {}
+
+    #     progress_desc = f"Looking up {total_hashes} files..."
+    #     for i in track(range(total_hashes), description=progress_desc):
+    #         try:
+    #             results = virustotal_lookup(hashes[i])
+    #         except VTNoKey:
+    #             return
+    #         except VTQuotaExceeded as exc:
+    #             print("Unable to continue: %s", exc)
+    #             break
+
+    #         if not results:
+    #             continue
+
+    #         positives = results["attributes"]["last_analysis_stats"]["malicious"]
+    #         total = len(results["attributes"]["last_analysis_results"])
+
+    #         detections[hashes[i]] = f"{positives}/{total}"
+
+    #     table = Table(title="VirusTotal Packages Detections")
+    #     table.add_column("Package name")
+    #     table.add_column("File path")
+    #     table.add_column("Detections")
+
+    #     for package in packages:
+    #         for file in package.get("files", []):
+    #             row = [package["package_name"], file["path"]]
+
+    #             if file["sha256"] in detections:
+    #                 detection = detections[file["sha256"]]
+    #                 positives = detection.split("/")[0]
+    #                 if int(positives) > 0:
+    #                     row.append(Text(detection, "red bold"))
+    #                 else:
+    #                     row.append(detection)
+    #             else:
+    #                 row.append("not found")
+
+    #             table.add_row(*row)
+
+    #     console = Console()
+    #     console.print(table)
 
     @staticmethod
     def parse_package_for_details(output: str) -> dict:

src/mvt/android/modules/adb/processes.py

@@ -9,6 +9,7 @@ from typing import Optional
 from mvt.android.artifacts.processes import Processes as ProcessesArtifact
 
 from .base import AndroidExtraction
+from mvt.common.module_types import ModuleResults
 
 
 class Processes(ProcessesArtifact, AndroidExtraction):
@@ -21,7 +22,7 @@ class Processes(ProcessesArtifact, AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/adb/root_binaries.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from .base import AndroidExtraction
+from mvt.common.module_types import ModuleResults
 
 
 class RootBinaries(AndroidExtraction):
@@ -19,7 +20,7 @@ class RootBinaries(AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/adb/selinux_status.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from .base import AndroidExtraction
+from mvt.common.module_types import ModuleResults
 
 
 class SELinuxStatus(AndroidExtraction):
@@ -21,7 +22,7 @@ class SELinuxStatus(AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/adb/settings.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from mvt.android.artifacts.settings import Settings as SettingsArtifact
+from mvt.common.module_types import ModuleResults
 
 from .base import AndroidExtraction
 
@@ -21,7 +22,7 @@ class Settings(SettingsArtifact, AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/adb/sms.py

@@ -6,11 +6,16 @@
 import logging
 import os
 import sqlite3
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.android.parsers.backup import AndroidBackupParsingError, parse_tar_for_sms
 from mvt.common.module import InsufficientPrivileges
 from mvt.common.utils import check_for_links, convert_unix_to_iso
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+)
 
 from .base import AndroidExtraction
 
@@ -51,7 +56,7 @@ class SMS(AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -64,7 +69,7 @@ class SMS(AndroidExtraction):
 
         self.sms_db_type = 0
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         body = record["body"].replace("\n", "\\n")
         return {
             "timestamp": record["isodate"],
@@ -85,9 +90,12 @@ class SMS(AndroidExtraction):
             if message_links == []:
                 message_links = check_for_links(message["body"])
 
-            if self.indicators.check_urls(message_links):
-                self.detected.append(message)
-                continue
+            ioc_match = self.indicators.check_urls(message_links)
+            if ioc_match:
+                message["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(
+                    self.get_slug(), ioc_match.message, "", message
+                )
 
     def _parse_db(self, db_path: str) -> None:
         """Parse an Android bugle_db SMS database file.

src/mvt/android/modules/adb/whatsapp.py

@@ -7,11 +7,16 @@ import base64
 import logging
 import os
 import sqlite3
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import check_for_links, convert_unix_to_iso
 
 from .base import AndroidExtraction
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+    ModuleResults,
+)
 
 WHATSAPP_PATH = "data/data/com.whatsapp/databases/msgstore.db"
 
@@ -26,7 +31,7 @@ class Whatsapp(AndroidExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -37,7 +42,7 @@ class Whatsapp(AndroidExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         text = record["data"].replace("\n", "\\n")
         return {
             "timestamp": record["isodate"],

src/mvt/android/modules/androidqf/aqf_files.py

@@ -10,10 +10,15 @@ import logging
 try:
     import zoneinfo
 except ImportError:
-    from backports import zoneinfo
-from typing import Optional, Union
+    from backports import zoneinfo  # type: ignore
+from typing import Optional
 
 from mvt.android.modules.androidqf.base import AndroidQFModule
+from mvt.common.module_types import (
+    ModuleResults,
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+)
 from mvt.common.utils import convert_datetime_to_iso
 
 SUSPICIOUS_PATHS = [
@@ -36,7 +41,7 @@ class AQFFiles(AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -47,7 +52,7 @@ class AQFFiles(AndroidQFModule):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
 
         for ts in set(
@@ -82,10 +87,11 @@ class AQFFiles(AndroidQFModule):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_file_path(result["path"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_file_path(result["path"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
+                self.alertstore.log_latest()
                 continue
 
             # NOTE: Update with final path used for Android collector.
@@ -98,20 +104,17 @@ class AQFFiles(AndroidQFModule):
                     if self.file_is_executable(result["mode"]):
                         file_type = "executable "
 
-                    self.log.warning(
-                        'Found %sfile at suspicious path "%s".',
-                        file_type,
-                        result["path"],
-                    )
-                    self.detected.append(result)
+                    msg = f'Found {file_type}file at suspicious path "{result["path"]}"'
+                    self.alertstore.high(self.get_slug(), msg, "", result)
+                    self.alertstore.log_latest()
 
             if result.get("sha256", "") == "":
                 continue
 
-            ioc = self.indicators.check_file_hash(result["sha256"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_file_hash(result["sha256"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
 
             # TODO: adds SHA1 and MD5 when available in MVT
 

src/mvt/android/modules/androidqf/aqf_getprop.py

@@ -9,6 +9,7 @@ from typing import Optional
 from mvt.android.artifacts.getprop import GetProp as GetPropArtifact
 
 from .base import AndroidQFModule
+from mvt.common.module_types import ModuleResults
 
 
 class AQFGetProp(GetPropArtifact, AndroidQFModule):
@@ -21,7 +22,7 @@ class AQFGetProp(GetPropArtifact, AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/androidqf/aqf_log_timestamps.py

@@ -9,6 +9,7 @@ import logging
 from typing import Optional
 
 from mvt.common.utils import convert_datetime_to_iso
+from mvt.common.module_types import ModuleResults
 from .base import AndroidQFModule
 from mvt.android.artifacts.file_timestamps import FileTimestampsArtifact
 
@@ -25,7 +26,7 @@ class AQFLogTimestamps(FileTimestampsArtifact, AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/androidqf/aqf_packages.py

@@ -17,6 +17,7 @@ from mvt.android.utils import (
 )
 
 from .base import AndroidQFModule
+from mvt.common.module_types import ModuleResults
 
 
 class AQFPackages(AndroidQFModule):
@@ -29,7 +30,7 @@ class AQFPackages(AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -43,79 +44,98 @@ class AQFPackages(AndroidQFModule):
     def check_indicators(self) -> None:
         for result in self.results:
             if result["name"] in ROOT_PACKAGES:
-                self.log.warning(
-                    'Found an installed package related to rooting/jailbreaking: "%s"',
-                    result["name"],
+                self.alertstore.medium(
+                    self.get_slug(),
+                    f'Found an installed package related to rooting/jailbreaking: "{result["name"]}"',
+                    "",
+                    result,
                 )
-                self.detected.append(result)
+                self.alertstore.log_latest()
                 continue
 
-            # Detections for apps installed via unusual methods
+            # Detections for apps installed via unusual methods.
             if result["installer"] in THIRD_PARTY_STORE_INSTALLERS:
-                self.log.warning(
-                    'Found a package installed via a third party store (installer="%s"): "%s"',
-                    result["installer"],
-                    result["name"],
+                self.alertstore.info(
+                    self.get_slug(),
+                    f'Found a package installed via a third party store (installer="{result["installer"]}"): "{result["name"]}"',
+                    "",
+                    result,
                 )
+                self.alertstore.log_latest()
             elif result["installer"] in BROWSER_INSTALLERS:
-                self.log.warning(
-                    'Found a package installed via a browser (installer="%s"): "%s"',
-                    result["installer"],
-                    result["name"],
+                self.alertstore.medium(
+                    self.get_slug(),
+                    f'Found a package installed via a browser (installer="{result["installer"]}"): "{result["name"]}"',
+                    "",
+                    result,
                 )
-                self.detected.append(result)
+                self.alertstore.log_latest()
             elif result["installer"] == "null" and result["system"] is False:
-                self.log.warning(
-                    'Found a non-system package installed via adb or another method: "%s"',
-                    result["name"],
+                self.alertstore.high(
+                    self.get_slug(),
+                    f'Found a non-system package installed via adb or another method: "{result["name"]}"',
+                    "",
+                    result,
                 )
-                self.detected.append(result)
+                self.alertstore.log_latest()
             elif result["installer"] in PLAY_STORE_INSTALLERS:
                 pass
 
-            # Check for disabled security or software update packages
+            # Check for disabled security or software update packages.
             package_disabled = result.get("disabled", None)
             if result["name"] in SECURITY_PACKAGES and package_disabled:
-                self.log.warning(
-                    'Security package "%s" disabled on the phone', result["name"]
+                self.alertstore.high(
+                    self.get_slug(),
+                    f'Security package "{result["name"]}" disabled on the phone',
+                    "",
+                    result,
                 )
+                self.alertstore.log_latest()
 
             if result["name"] in SYSTEM_UPDATE_PACKAGES and package_disabled:
-                self.log.warning(
-                    'System OTA update package "%s" disabled on the phone',
-                    result["name"],
+                self.alertstore.high(
+                    self.get_slug(),
+                    f'System OTA update package "{result["name"]}" disabled on the phone',
+                    "",
+                    result,
                 )
+                self.alertstore.log_latest()
 
             if not self.indicators:
                 continue
 
-            ioc = self.indicators.check_app_id(result.get("name"))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_app_id(result.get("name"))
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
+                self.alertstore.log_latest()
 
             for package_file in result.get("files", []):
-                ioc = self.indicators.check_file_hash(package_file["sha256"])
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                ioc_match = self.indicators.check_file_hash(package_file["sha256"])
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(), ioc_match.message, "", result
+                    )
+                    self.alertstore.log_latest()
 
                 if "certificate" not in package_file:
                     continue
 
-                # The keys generated by AndroidQF have a leading uppercase character
+                # The keys generated by AndroidQF have a leading uppercase character.
                 for hash_type in ["Md5", "Sha1", "Sha256"]:
                     certificate_hash = package_file["certificate"][hash_type]
-                    ioc = self.indicators.check_app_certificate_hash(certificate_hash)
-                    if ioc:
-                        result["matched_indicator"] = ioc
-                        self.detected.append(result)
+                    ioc_match = self.indicators.check_app_certificate_hash(
+                        certificate_hash
+                    )
+                    if ioc_match:
+                        result["matched_indicator"] = ioc_match.ioc
+                        self.alertstore.critical(
+                            self.get_slug(), ioc_match.message, "", result
+                        )
+                        self.alertstore.log_latest()
                         break
 
-        # Deduplicate the detected packages
-        dedupe_detected_dict = {str(item): item for item in self.detected}
-        self.detected = list(dedupe_detected_dict.values())
-
     def run(self) -> None:
         packages = self._get_files_by_pattern("*/packages.json")
         if not packages:

src/mvt/android/modules/androidqf/aqf_processes.py

@@ -9,6 +9,7 @@ from typing import Optional
 from mvt.android.artifacts.processes import Processes as ProcessesArtifact
 
 from .base import AndroidQFModule
+from mvt.common.module_types import ModuleResults
 
 
 class AQFProcesses(ProcessesArtifact, AndroidQFModule):
@@ -21,7 +22,7 @@ class AQFProcesses(ProcessesArtifact, AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/androidqf/aqf_settings.py

@@ -9,6 +9,7 @@ from typing import Optional
 from mvt.android.artifacts.settings import Settings as SettingsArtifact
 
 from .base import AndroidQFModule
+from mvt.common.module_types import ModuleResults
 
 
 class AQFSettings(SettingsArtifact, AndroidQFModule):
@@ -21,7 +22,7 @@ class AQFSettings(SettingsArtifact, AndroidQFModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/androidqf/base.py

@@ -7,9 +7,10 @@ import fnmatch
 import logging
 import os
 import zipfile
-from typing import Any, Dict, List, Optional, Union
+from typing import List, Optional
 
 from mvt.common.module import MVTModule
+from mvt.common.module_types import ModuleResults
 
 
 class AndroidQFModule(MVTModule):
@@ -22,7 +23,7 @@ class AndroidQFModule(MVTModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Union[List[Dict[str, Any]], Dict[str, Any], None] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/androidqf/sms.py

@@ -53,8 +53,12 @@ class SMS(AndroidQFModule):
             if "body" not in message:
                 continue
 
-            if self.indicators.check_domains(message.get("links", [])):
-                self.detected.append(message)
+            ioc_match = self.indicators.check_domains(message.get("links", []))
+            if ioc_match:
+                message["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(
+                    self.get_slug(), ioc_match.message, "", message
+                )
 
     def parse_backup(self, data):
         header = parse_ab_header(data)

src/mvt/android/modules/backup/base.py

@@ -9,10 +9,10 @@ import os
 from tarfile import TarFile
 from typing import List, Optional
 
-from mvt.common.module import MVTModule
+from mvt.common.module import MVTModule, ModuleResults
 
 
-class BackupExtraction(MVTModule):
+class BackupModule(MVTModule):
     """This class provides a base for all backup extractios modules"""
 
     def __init__(
@@ -22,7 +22,7 @@ class BackupExtraction(MVTModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/backup/sms.py

@@ -6,12 +6,13 @@
 import logging
 from typing import Optional
 
-from mvt.android.modules.backup.base import BackupExtraction
+from mvt.android.modules.backup.base import BackupModule
 from mvt.android.parsers.backup import parse_sms_file
 from mvt.common.utils import check_for_links
+from mvt.common.module_types import ModuleResults
 
 
-class SMS(BackupExtraction):
+class SMS(BackupModule):
     def __init__(
         self,
         file_path: Optional[str] = None,
@@ -19,7 +20,7 @@ class SMS(BackupExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -43,8 +44,12 @@ class SMS(BackupExtraction):
             if message_links == []:
                 message_links = check_for_links(message.get("text", ""))
 
-            if self.indicators.check_urls(message_links):
-                self.detected.append(message)
+            ioc_match = self.indicators.check_urls(message_links)
+            if ioc_match:
+                message["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(
+                    self.get_slug(), ioc_match.message, "", message
+                )
                 continue
 
     def run(self) -> None:

src/mvt/android/modules/bugreport/base.py

@@ -10,7 +10,7 @@ import os
 from typing import List, Optional
 from zipfile import ZipFile
 
-from mvt.common.module import MVTModule
+from mvt.common.module import MVTModule, ModuleResults
 
 
 class BugReportModule(MVTModule):
@@ -23,7 +23,7 @@ class BugReportModule(MVTModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_accessibility.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from mvt.android.artifacts.dumpsys_accessibility import DumpsysAccessibilityArtifact
+from mvt.common.module_types import ModuleResults
 
 from .base import BugReportModule
 
@@ -21,7 +22,7 @@ class DumpsysAccessibility(DumpsysAccessibilityArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_activities.py

@@ -9,6 +9,7 @@ from typing import Optional
 from mvt.android.artifacts.dumpsys_package_activities import (
     DumpsysPackageActivitiesArtifact,
 )
+from mvt.common.module_types import ModuleResults
 
 from .base import BugReportModule
 
@@ -23,7 +24,7 @@ class DumpsysActivities(DumpsysPackageActivitiesArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_adb_state.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from mvt.android.artifacts.dumpsys_adb import DumpsysADBArtifact
+from mvt.common.module_types import ModuleResults
 
 from .base import BugReportModule
 
@@ -21,7 +22,7 @@ class DumpsysADBState(DumpsysADBArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_appops.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from mvt.android.artifacts.dumpsys_appops import DumpsysAppopsArtifact
+from mvt.common.module_types import ModuleResults
 
 from .base import BugReportModule
 
@@ -21,7 +22,7 @@ class DumpsysAppops(DumpsysAppopsArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_battery_daily.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from mvt.android.artifacts.dumpsys_battery_daily import DumpsysBatteryDailyArtifact
+from mvt.common.module_types import ModuleResults
 
 from .base import BugReportModule
 
@@ -21,7 +22,7 @@ class DumpsysBatteryDaily(DumpsysBatteryDailyArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_battery_history.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from mvt.android.artifacts.dumpsys_battery_history import DumpsysBatteryHistoryArtifact
+from mvt.common.module_types import ModuleResults
 
 from .base import BugReportModule
 
@@ -21,7 +22,7 @@ class DumpsysBatteryHistory(DumpsysBatteryHistoryArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_dbinfo.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from mvt.android.artifacts.dumpsys_dbinfo import DumpsysDBInfoArtifact
+from mvt.common.module_types import ModuleResults
 
 from .base import BugReportModule
 
@@ -23,7 +24,7 @@ class DumpsysDBInfo(DumpsysDBInfoArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_getprop.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from mvt.android.artifacts.getprop import GetProp as GetPropArtifact
+from mvt.common.module_types import ModuleResults
 
 from .base import BugReportModule
 
@@ -21,7 +22,7 @@ class DumpsysGetProp(GetPropArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_packages.py

@@ -6,6 +6,7 @@
 import logging
 from typing import Optional
 
+from mvt.common.module_types import ModuleResults
 from mvt.android.artifacts.dumpsys_packages import DumpsysPackagesArtifact
 from mvt.android.utils import DANGEROUS_PERMISSIONS, DANGEROUS_PERMISSIONS_THRESHOLD
 
@@ -22,7 +23,7 @@ class DumpsysPackages(DumpsysPackagesArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_platform_compat.py

@@ -9,6 +9,7 @@ from typing import Optional
 from mvt.android.artifacts.dumpsys_platform_compat import DumpsysPlatformCompatArtifact
 
 from mvt.android.modules.bugreport.base import BugReportModule
+from mvt.common.module_types import ModuleResults
 
 
 class DumpsysPlatformCompat(DumpsysPlatformCompatArtifact, BugReportModule):
@@ -21,7 +22,7 @@ class DumpsysPlatformCompat(DumpsysPlatformCompatArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/dumpsys_receivers.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from mvt.android.artifacts.dumpsys_receivers import DumpsysReceiversArtifact
+from mvt.common.module_types import ModuleResults
 
 from .base import BugReportModule
 
@@ -21,7 +22,7 @@ class DumpsysReceivers(DumpsysReceiversArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/fs_timestamps.py

@@ -8,6 +8,7 @@ from typing import Optional
 
 from mvt.common.utils import convert_datetime_to_iso
 from .base import BugReportModule
+from mvt.common.module_types import ModuleResults
 from mvt.android.artifacts.file_timestamps import FileTimestampsArtifact
 
 
@@ -23,7 +24,7 @@ class BugReportTimestamps(FileTimestampsArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/modules/bugreport/tombstones.py

@@ -7,6 +7,7 @@ import logging
 from typing import Optional
 
 from mvt.android.artifacts.tombstone_crashes import TombstoneCrashArtifact
+from mvt.common.module_types import ModuleResults
 from .base import BugReportModule
 
 
@@ -22,7 +23,7 @@ class Tombstones(TombstoneCrashArtifact, BugReportModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/android/utils.py

@@ -6,16 +6,16 @@ from datetime import datetime, timedelta
 from typing import List
 
 
-def warn_android_patch_level(patch_level: str, log) -> bool:
+def warn_android_patch_level(patch_level: str, log) -> str:
     """Alert if Android patch level out-of-date"""
     patch_date = datetime.strptime(patch_level, "%Y-%m-%d")
     if (datetime.now() - patch_date) > timedelta(days=6 * 31):
-        log.warning(
-            "This phone has not received security updates "
-            "for more than six months (last update: %s)",
+        warning_message = (
+            f"This phone has not received security updates "
+            f"for more than six months (last update: {patch_level}).",
             patch_level,
         )
-        return True
+        return warning_message
 
     return False
 

src/mvt/common/alerts.py

@@ -0,0 +1,181 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2025 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import csv
+import logging
+from enum import Enum
+from dataclasses import dataclass, asdict
+from typing import List, Dict, Any, Optional
+
+from .log import INFO_ALERT, LOW_ALERT, HIGH_ALERT, CRITICAL_ALERT, MEDIUM_ALERT
+from .module_types import ModuleAtomicResult
+
+
+class AlertLevel(Enum):
+    INFORMATIONAL = 0
+    LOW = 10
+    MEDIUM = 20
+    HIGH = 30
+    CRITICAL = 40
+
+
+@dataclass
+class Alert:
+    level: AlertLevel
+    module: str
+    message: str
+    event_time: str
+    event: ModuleAtomicResult
+
+
+class AlertStore:
+    def __init__(self, log: Optional[logging.Logger] = None) -> None:
+        self.__alerts: List[Alert] = []
+        self.__log = log
+
+    @property
+    def alerts(self) -> List[Alert]:
+        return self.__alerts
+
+    def add(self, alert: Alert) -> None:
+        self.__alerts.append(alert)
+
+    def extend(self, alerts: List[Alert]) -> None:
+        self.__alerts.extend(alerts)
+
+    def info(
+        self, module: str, message: str, event_time: str, event: ModuleAtomicResult
+    ):
+        self.add(
+            Alert(
+                level=AlertLevel.INFORMATIONAL,
+                module=module,
+                message=message,
+                event_time=event_time,
+                event=event,
+            )
+        )
+
+    def low(
+        self, module: str, message: str, event_time: str, event: ModuleAtomicResult
+    ):
+        self.add(
+            Alert(
+                level=AlertLevel.LOW,
+                module=module,
+                message=message,
+                event_time=event_time,
+                event=event,
+            )
+        )
+
+    def medium(
+        self, module: str, message: str, event_time: str, event: ModuleAtomicResult
+    ):
+        self.add(
+            Alert(
+                level=AlertLevel.MEDIUM,
+                module=module,
+                message=message,
+                event_time=event_time,
+                event=event,
+            )
+        )
+
+    def high(
+        self, module: str, message: str, event_time: str, event: ModuleAtomicResult
+    ):
+        self.add(
+            Alert(
+                level=AlertLevel.HIGH,
+                module=module,
+                message=message,
+                event_time=event_time,
+                event=event,
+            )
+        )
+
+    def critical(
+        self, module: str, message: str, event_time: str, event: ModuleAtomicResult
+    ):
+        self.add(
+            Alert(
+                level=AlertLevel.CRITICAL,
+                module=module,
+                message=message,
+                event_time=event_time,
+                event=event,
+            )
+        )
+
+    def log(self, alert: Alert) -> None:
+        if not self.__log:
+            return
+
+        if not alert.message:
+            return
+
+        if alert.level == AlertLevel.INFORMATIONAL:
+            self.__log.log(INFO_ALERT, alert.message)
+        elif alert.level == AlertLevel.LOW:
+            self.__log.log(LOW_ALERT, alert.message)
+        elif alert.level == AlertLevel.MEDIUM:
+            self.__log.log(MEDIUM_ALERT, alert.message)
+        elif alert.level == AlertLevel.HIGH:
+            self.__log.log(HIGH_ALERT, alert.message)
+        elif alert.level == AlertLevel.CRITICAL:
+            self.__log.log(CRITICAL_ALERT, alert.message)
+
+    def log_latest(self) -> None:
+        self.log(self.__alerts[-1])
+
+    def count(self, level: AlertLevel) -> int:
+        count = 0
+        for alert in self.__alerts:
+            if alert.level == level:
+                count += 1
+
+        return count
+
+    def as_json(self) -> List[Dict[str, Any]]:
+        alerts = []
+        for alert in self.__alerts:
+            alert_dict = asdict(alert)
+            # This is required because an Enum is not JSON serializable.
+            alert_dict["level"] = alert.level.name
+            alerts.append(alert_dict)
+
+        return alerts
+
+    def save_timeline(self, timeline_path: str) -> None:
+        with open(timeline_path, "a+", encoding="utf-8") as handle:
+            csvoutput = csv.writer(
+                handle,
+                delimiter=",",
+                quotechar='"',
+                quoting=csv.QUOTE_ALL,
+                escapechar="\\",
+            )
+            csvoutput.writerow(["Event Time", "Module", "Message", "Event"])
+
+            timed_alerts = []
+            for alert in self.alerts:
+                if not alert.event_time:
+                    continue
+
+                timed_alerts.append(asdict(alert))
+
+            for event in sorted(
+                timed_alerts,
+                key=lambda x: x["event_time"] if x["event_time"] is not None else "",
+            ):
+                csvoutput.writerow(
+                    [
+                        event.get("event_time"),
+                        event.get("module"),
+                        event.get("message"),
+                        event.get("event"),
+                    ]
+                )

src/mvt/common/artifact.py

@@ -2,27 +2,11 @@
 # Copyright (c) 2021-2023 The MVT Authors.
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
+from .module import MVTModule
 
 
-class Artifact:
+class Artifact(MVTModule):
+    """Base class for artifacts.
+
+    XXX: Inheriting from MVTModule to have the same signature as other modules. Not sure if this is a good idea.
     """
-    Main artifact class
-    """
-
-    def __init__(self, *args, **kwargs):
-        self.results = []
-        self.detected = []
-        self.indicators = None
-        super().__init__(*args, **kwargs)
-
-    def parse(self, entry: str):
-        """
-        Parse the artifact, adds the parsed information to self.results
-        """
-        raise NotImplementedError
-
-    def check_indicators(self) -> None:
-        """Check the results of this module against a provided list of
-        indicators coming from self.indicators
-        """
-        raise NotImplementedError

src/mvt/common/cmd_check_iocs.py

@@ -86,7 +86,7 @@ class CmdCheckIOCS(Command):
                 except NotImplementedError:
                     continue
                 else:
-                    total_detections += len(m.detected)
+                    total_detections += len(m.alertstore.alerts)
 
         if total_detections > 0:
             log.warning(

src/mvt/common/command.py

@@ -10,15 +10,20 @@ import sys
 from datetime import datetime
 from typing import Optional
 
-from mvt.common.indicators import Indicators
-from mvt.common.module import MVTModule, run_module, save_timeline
-from mvt.common.utils import (
+from rich.console import Console
+from rich.panel import Panel
+from rich.text import Text
+
+from .alerts import AlertLevel, AlertStore
+from .config import settings
+from .indicators import Indicators
+from .module import MVTModule, run_module, save_timeline
+from .utils import (
     convert_datetime_to_iso,
     generate_hashes_from_path,
     get_sha256_from_file_path,
 )
-from mvt.common.config import settings
-from mvt.common.version import MVT_VERSION
+from .version import MVT_VERSION
 
 
 class Command:
@@ -58,11 +63,9 @@ class Command:
         # This list will contain all executed modules.
         # We can use this to reference e.g. self.executed[0].results.
         self.executed = []
-        self.detected_count = 0
         self.hashes = hashes
         self.hash_values = []
         self.timeline = []
-        self.timeline_detected = []
 
         # Load IOCs
         self._create_storage()
@@ -74,12 +77,14 @@ class Command:
             self.iocs = Indicators(self.log)
             self.iocs.load_indicators_files(self.ioc_files)
 
+        self.alertstore = AlertStore()
+
     def _create_storage(self) -> None:
         if self.results_path and not os.path.exists(self.results_path):
             try:
                 os.makedirs(self.results_path)
             except Exception as exc:
-                self.log.critical(
+                self.log.fatal(
                     "Unable to create output folder %s: %s", self.results_path, exc
                 )
                 sys.exit(1)
@@ -98,14 +103,14 @@ class Command:
         file_handler.setLevel(logging.DEBUG)
         file_handler.setFormatter(formatter)
 
-        # MVT can be run in a loop
-        # Old file handlers stick around in subsequent loops
-        # Remove any existing logging.FileHandler instances
+        # MVT can be run in a loop.
+        # Old file handlers stick around in subsequent loops.
+        # Remove any existing logging.FileHandler instances.
         for handler in logger.handlers:
             if isinstance(handler, logging.FileHandler):
                 logger.removeHandler(handler)
 
-        # And finally add the new one
+        # And finally add the new one.
         logger.addHandler(file_handler)
 
     def _store_timeline(self) -> None:
@@ -126,12 +131,24 @@ class Command:
                 is_utc=is_utc,
             )
 
-        if len(self.timeline_detected) > 0:
-            save_timeline(
-                self.timeline_detected,
-                os.path.join(self.results_path, "timeline_detected.csv"),
-                is_utc=is_utc,
-            )
+    def _store_alerts(self) -> None:
+        if not self.results_path:
+            return
+
+        alerts = self.alertstore.as_json()
+        if not alerts:
+            return
+
+        alerts_path = os.path.join(self.results_path, "alerts.json")
+        with open(alerts_path, "w+", encoding="utf-8") as handle:
+            json.dump(alerts, handle, indent=4)
+
+    def _store_alerts_timeline(self) -> None:
+        if not self.results_path:
+            return
+
+        alerts_timeline_path = os.path.join(self.results_path, "alerts_timeline.csv")
+        self.alertstore.save_timeline(alerts_timeline_path)
 
     def _store_info(self) -> None:
         if not self.results_path:
@@ -191,26 +208,54 @@ class Command:
     def finish(self) -> None:
         raise NotImplementedError
 
-    def _show_disable_adb_warning(self) -> None:
-        """Warn if ADB is enabled"""
-        if type(self).__name__ in ["CmdAndroidCheckADB", "CmdAndroidCheckAndroidQF"]:
-            self.log.info(
-                "Please disable Developer Options and ADB (Android Debug Bridge) on the device once finished with the acquisition. "
-                "ADB is a powerful tool which can allow unauthorized access to the device."
-            )
+    def show_alerts_brief(self) -> None:
+        console = Console()
+
+        message = Text()
+        for i, level in enumerate(AlertLevel):
+            message.append(
+                f"MVT produced {self.alertstore.count(level)} {level.name} alerts."
+            )
+            if i < len(AlertLevel) - 1:
+                message.append("\n")
+
+        panel = Panel(
+            message, title="ALERTS", style="sandy_brown", border_style="sandy_brown"
+        )
+        console.print("")
+        console.print(panel)
+
+    def show_disable_adb_warning(self) -> None:
+        console = Console()
+        message = Text(
+            "Please disable Developer Options and ADB (Android Debug Bridge) on the device once finished with the acquisition. "
+            "ADB is a powerful tool which can allow unauthorized access to the device."
+        )
+        panel = Panel(message, title="NOTE", style="yellow", border_style="yellow")
+        console.print("")
+        console.print(panel)
+
+    def show_support_message(self) -> None:
+        console = Console()
+        message = Text()
 
-    def _show_support_message(self) -> None:
         support_message = "Please seek reputable expert help if you have serious concerns about a possible spyware attack. Such support is available to human rights defenders and civil society through Amnesty International's Security Lab at https://securitylab.amnesty.org/get-help/?c=mvt"
-        if self.detected_count == 0:
-            self.log.info(
-                f"[bold]NOTE:[/bold] Using MVT with public indicators of compromise (IOCs) [bold]WILL NOT[/bold] automatically detect advanced attacks.\n\n{support_message}",
-                extra={"markup": True},
+        if (
+            self.alertstore.count(AlertLevel.HIGH) > 0
+            or self.alertstore.count(AlertLevel.CRITICAL) > 0
+        ):
+            message.append(
+                f"MVT produced HIGH or CRITICAL alerts. Only expert review can confirm if the detected indicators are signs of an attack.\n\n{support_message}",
             )
+            panel = Panel(message, title="WARNING", style="red", border_style="red")
         else:
-            self.log.warning(
-                f"[bold]NOTE: Detected indicators of compromise[/bold]. Only expert review can confirm if the detected indicators are signs of an attack.\n\n{support_message}",
-                extra={"markup": True},
+            message.append(
+                f"The lack of severe alerts does not equate to a clean bill of health.\n\n{support_message}",
             )
+            panel = Panel(message, title="NOTE", style="yellow", border_style="yellow")
+
+        console.print("")
+        console.print(panel)
 
     def run(self) -> None:
         try:
@@ -222,6 +267,11 @@ class Command:
             if self.module_name and module.__name__ != self.module_name:
                 continue
 
+            if not module.enabled and not (
+                self.module_name and module.__name__ == self.module_name
+            ):
+                continue
+
             # FIXME: do we need the logger here
             module_logger = logging.getLogger(module.__module__)
 
@@ -247,11 +297,8 @@ class Command:
             run_module(m)
 
             self.executed.append(m)
-
-            self.detected_count += len(m.detected)
-
             self.timeline.extend(m.timeline)
-            self.timeline_detected.extend(m.timeline_detected)
+            self.alertstore.extend(m.alertstore.alerts)
 
         try:
             self.finish()
@@ -263,7 +310,6 @@ class Command:
             return
 
         self._store_timeline()
+        self._store_alerts_timeline()
+        self._store_alerts()
         self._store_info()
-
-        self._show_disable_adb_warning()
-        self._show_support_message()

src/mvt/common/help.py

@@ -35,19 +35,15 @@ HELP_MSG_CHECK_IOS_BACKUP = "Extract artifacts from an iTunes backup"
 HELP_MSG_CHECK_FS = "Extract artifacts from a full filesystem dump"
 
 # Android Specific
-HELP_MSG_SERIAL = "Specify a device serial number or HOST:PORT connection string"
-HELP_MSG_DOWNLOAD_APKS = "Download all or only non-system installed APKs"
 HELP_MSG_ANDROID_BACKUP_PASSWORD = "The backup password to use for an Android backup"
-HELP_MSG_DOWNLOAD_ALL_APKS = (
-    "Extract all packages installed on the phone, including system packages"
+HELP_MSG_CHECK_ADB_REMOVED = "REMOVED: Check an Android device over ADB"
+HELP_MSG_CHECK_ADB_REMOVED_DESCRIPTION = (
+    "The 'mvt-android check-adb' command has been removed from MVT. "
+    "Use AndroidQF to collect full forensic artifacts from an Android device. \n\n"
+    "The 'mvt-android check-androidqf' command in MVT can be used to fully analyze "
+    "forensic data collected with AndroidQF. Minimal checks can also be performed "
+    "on an Android bugreport using the 'mvt-android check-bugreport' command."
 )
-HELP_MSG_VIRUS_TOTAL = "Check packages on VirusTotal"
-HELP_MSG_APK_OUTPUT = "Specify a path to a folder where you want to store the APKs"
-HELP_MSG_APKS_FROM_FILE = (
-    "Instead of acquiring APKs from a phone, load an existing packages.json file for "
-    "lookups (mainly for debug purposes)"
-)
-HELP_MSG_CHECK_ADB = "Check an Android device over ADB"
 HELP_MSG_CHECK_BUGREPORT = "Check an Android Bug Report"
 HELP_MSG_CHECK_ANDROID_BACKUP = "Check an Android Backup"
 HELP_MSG_CHECK_ANDROIDQF = "Check data collected with AndroidQF"

src/mvt/common/indicators.py

@@ -8,7 +8,8 @@ import json
 import logging
 import os
 from functools import lru_cache
-from typing import Any, Dict, Iterator, List, Optional, Union
+from typing import Any, Dict, Iterator, List, Optional
+from dataclasses import dataclass
 
 import ahocorasick
 from appdirs import user_data_dir
@@ -22,6 +23,20 @@ MVT_INDICATORS_FOLDER = os.path.join(MVT_DATA_FOLDER, "indicators")
 logger = logging.getLogger(__name__)
 
 
+@dataclass
+class Indicator:
+    value: str
+    type: str
+    name: str
+    stix2_file_name: str
+
+
+@dataclass
+class IndicatorMatch:
+    ioc: Indicator
+    message: str
+
+
 class Indicators:
     """This class is used to parse indicators from a STIX2 file and provide
     functions to compare extracted artifacts to the indicators.
@@ -58,7 +73,7 @@ class Indicators:
                     self.parse_stix2(file)
             else:
                 self.log.error(
-                    "Path specified with env MVT_STIX2 is not a valid path: %s", path
+                    "Path specified with env MVT_STIX2 is not a valid path: '%s'", path
                 )
 
     def _new_collection(
@@ -197,13 +212,13 @@ class Indicators:
         :type file_path: str
 
         """
-        self.log.info("Parsing STIX2 indicators file at path %s", file_path)
+        self.log.info("Parsing STIX2 indicators file at path '%s'", file_path)
 
         with open(file_path, "r", encoding="utf-8") as handle:
             try:
                 data = json.load(handle)
             except json.decoder.JSONDecodeError:
-                self.log.critical(
+                self.log.warning(
                     "Unable to parse STIX2 indicator file. "
                     "The file is corrupted or in the wrong format!"
                 )
@@ -314,7 +329,7 @@ class Indicators:
             if os.path.isfile(file_path):
                 self.parse_stix2(file_path)
             else:
-                self.log.warning("No indicators file exists at path %s", file_path)
+                self.log.error("No indicators file exists at path %s", file_path)
 
         # Load downloaded indicators and any indicators from env variable.
         if load_default:
@@ -323,15 +338,15 @@ class Indicators:
         self._check_stix2_env_variable()
         self.log.info("Loaded a total of %d unique indicators", self.total_ioc_count)
 
-    def get_iocs(self, ioc_type: str) -> Iterator[Dict[str, Any]]:
+    def get_iocs(self, ioc_type: str) -> Iterator[Indicator]:
         for ioc_collection in self.ioc_collections:
             for ioc in ioc_collection.get(ioc_type, []):
-                yield {
-                    "value": ioc,
-                    "type": ioc_type,
-                    "name": ioc_collection["name"],
-                    "stix2_file_name": ioc_collection["stix2_file_name"],
-                }
+                yield Indicator(
+                    value=ioc,
+                    type=ioc_type,
+                    name=ioc_collection["name"],
+                    stix2_file_name=ioc_collection["stix2_file_name"],
+                )
 
     @lru_cache()
     def get_ioc_matcher(
@@ -362,12 +377,12 @@ class Indicators:
             raise ValueError("Must provide either ioc_type or ioc_list")
 
         for ioc in iocs:
-            automaton.add_word(ioc["value"], ioc)
+            automaton.add_word(ioc.value, ioc)
         automaton.make_automaton()
         return automaton
 
     @lru_cache()
-    def check_url(self, url: str) -> Union[dict, None]:
+    def check_url(self, url: str) -> Optional[IndicatorMatch]:
         """Check if a given URL matches any of the provided domain indicators.
 
         :param url: URL to match against domain indicators
@@ -375,21 +390,16 @@ class Indicators:
         :returns: Indicator details if matched, otherwise None
 
         """
-        if not url:
-            return None
-        if not isinstance(url, str):
+        if not url or not isinstance(url, str):
             return None
 
         # Check the URL first
         for ioc in self.get_iocs("urls"):
-            if ioc["value"] == url:
-                self.log.warning(
-                    'Found a known suspicious URL %s matching indicator "%s" from "%s"',
-                    url,
-                    ioc["value"],
-                    ioc["name"],
+            if ioc.value == url:
+                return IndicatorMatch(
+                    ioc=ioc,
+                    message=f'Found a known suspicious URL {url} matching indicator "{ioc.value}" from "{ioc.name}"',
                 )
-                return ioc
 
         # Then check the domain
         # Create an Aho-Corasick automaton from the list of urls
@@ -426,71 +436,41 @@ class Indicators:
         except Exception:
             # If URL parsing failed, we just try to do a simple substring
             # match.
-            for idx, ioc in domain_matcher.iter(url):
-                if ioc["value"].lower() in url:
-                    self.log.warning(
-                        "Maybe found a known suspicious domain %s "
-                        'matching indicator "%s" from "%s"',
-                        url,
-                        ioc["value"],
-                        ioc["name"],
+            for _, ioc in domain_matcher.iter(url):
+                if ioc.value.lower() in url:
+                    return IndicatorMatch(
+                        ioc=ioc,
+                        message=f'Maybe found a known suspicious domain {url} matching indicator "{ioc.value}" from "{ioc.name}"',
                     )
-                    return ioc
 
             # If nothing matched, we can quit here.
             return None
 
         # If all parsing worked, we start walking through available domain
         # indicators.
-        for idx, ioc in domain_matcher.iter(final_url.domain.lower()):
+        for _, ioc in domain_matcher.iter(final_url.domain.lower()):
             # First we check the full domain.
-            if final_url.domain.lower() == ioc["value"]:
+            if final_url.domain.lower() == ioc.value:
                 if orig_url.is_shortened and orig_url.url != final_url.url:
-                    self.log.warning(
-                        "Found a known suspicious domain %s "
-                        'shortened as %s matching indicator "%s" from "%s"',
-                        final_url.url,
-                        orig_url.url,
-                        ioc["value"],
-                        ioc["name"],
-                    )
+                    message = f'Found a known suspicious domain {final_url.url} shortened as {orig_url.url} matching indicator "{ioc.value}" from "{ioc.name}"'
                 else:
-                    self.log.warning(
-                        "Found a known suspicious domain %s "
-                        'matching indicator "%s" from "%s"',
-                        final_url.url,
-                        ioc["value"],
-                        ioc["name"],
-                    )
-                return ioc
+                    message = f'Found a known suspicious domain {final_url.url} matching indicator "{ioc.value}" from "{ioc.name}"'
+
+                return IndicatorMatch(ioc=ioc, message=message)
 
         # Then we just check the top level domain.
-        for idx, ioc in domain_matcher.iter(final_url.top_level.lower()):
-            if final_url.top_level.lower() == ioc["value"]:
+        for _, ioc in domain_matcher.iter(final_url.top_level.lower()):
+            if final_url.top_level.lower() == ioc.value:
                 if orig_url.is_shortened and orig_url.url != final_url.url:
-                    self.log.warning(
-                        "Found a sub-domain with suspicious top "
-                        "level %s shortened as %s matching "
-                        'indicator "%s" from "%s"',
-                        final_url.url,
-                        orig_url.url,
-                        ioc["value"],
-                        ioc["name"],
-                    )
+                    message = f'Found a sub-domain with suspicious top level {final_url.url} shortened as {orig_url.url} matching indicator "{ioc.value}" from "{ioc.name}"'
                 else:
-                    self.log.warning(
-                        "Found a sub-domain with a suspicious top "
-                        'level %s matching indicator "%s" from "%s"',
-                        final_url.url,
-                        ioc["value"],
-                        ioc["name"],
-                    )
+                    message = f'Found a sub-domain with a suspicious top level {final_url.url} matching indicator "{ioc.value}" from "{ioc.name}"'
 
-                return ioc
+                return IndicatorMatch(ioc=ioc, message=message)
 
         return None
 
-    def check_urls(self, urls: list) -> Union[dict, None]:
+    def check_urls(self, urls: list) -> Optional[IndicatorMatch]:
         """Check a list of URLs against the provided list of domain indicators.
 
         :param urls: List of URLs to check against domain indicators
@@ -508,7 +488,7 @@ class Indicators:
 
         return None
 
-    def check_process(self, process: str) -> Union[dict, None]:
+    def check_process(self, process: str) -> Optional[IndicatorMatch]:
         """Check the provided process name against the list of process
         indicators.
 
@@ -522,28 +502,22 @@ class Indicators:
 
         proc_name = os.path.basename(process)
         for ioc in self.get_iocs("processes"):
-            if proc_name == ioc["value"]:
-                self.log.warning(
-                    'Found a known suspicious process name "%s" '
-                    'matching indicators from "%s"',
-                    process,
-                    ioc["name"],
+            if proc_name == ioc.value:
+                return IndicatorMatch(
+                    ioc=ioc,
+                    message=f'Found a known suspicious process name "{process}" matching indicators from "{ioc.name}"',
                 )
-                return ioc
 
             if len(proc_name) == 16:
-                if ioc["value"].startswith(proc_name):
-                    self.log.warning(
-                        "Found a truncated known suspicious "
-                        'process name "%s" matching indicators from "%s"',
-                        process,
-                        ioc["name"],
+                if ioc.value.startswith(proc_name):
+                    return IndicatorMatch(
+                        ioc=ioc,
+                        message=f'Found a truncated known suspicious process name "{process}" matching indicators from "{ioc.name}"',
                     )
-                    return ioc
 
         return None
 
-    def check_processes(self, processes: list) -> Union[dict, None]:
+    def check_processes(self, processes: list) -> Optional[IndicatorMatch]:
         """Check the provided list of processes against the list of
         process indicators.
 
@@ -562,7 +536,7 @@ class Indicators:
 
         return None
 
-    def check_email(self, email: str) -> Union[dict, None]:
+    def check_email(self, email: str) -> Optional[IndicatorMatch]:
         """Check the provided email against the list of email indicators.
 
         :param email: Email address to check against email indicators
@@ -574,18 +548,15 @@ class Indicators:
             return None
 
         for ioc in self.get_iocs("emails"):
-            if email.lower() == ioc["value"].lower():
-                self.log.warning(
-                    'Found a known suspicious email address "%s" '
-                    'matching indicators from "%s"',
-                    email,
-                    ioc["name"],
+            if email.lower() == ioc.value.lower():
+                return IndicatorMatch(
+                    ioc=ioc,
+                    message=f'Found a known suspicious email address "{email}" matching indicators from "{ioc.name}"',
                 )
-                return ioc
 
         return None
 
-    def check_file_name(self, file_name: str) -> Union[dict, None]:
+    def check_file_name(self, file_name: str) -> Optional[IndicatorMatch]:
         """Check the provided file name against the list of file indicators.
 
         :param file_name: File name to check against file
@@ -598,18 +569,15 @@ class Indicators:
             return None
 
         for ioc in self.get_iocs("file_names"):
-            if ioc["value"] == file_name:
-                self.log.warning(
-                    'Found a known suspicious file name "%s" '
-                    'matching indicators from "%s"',
-                    file_name,
-                    ioc["name"],
+            if ioc.value == file_name:
+                return IndicatorMatch(
+                    ioc=ioc,
+                    message=f'Found a known suspicious file name "{file_name}" matching indicators from "{ioc.name}"',
                 )
-                return ioc
 
         return None
 
-    def check_file_path(self, file_path: str) -> Union[dict, None]:
+    def check_file_path(self, file_path: str) -> Optional[IndicatorMatch]:
         """Check the provided file path against the list of file indicators
         (both path and name).
 
@@ -622,25 +590,22 @@ class Indicators:
         if not file_path:
             return None
 
-        ioc = self.check_file_name(os.path.basename(file_path))
-        if ioc:
-            return ioc
+        ioc_match = self.check_file_name(os.path.basename(file_path))
+        if ioc_match:
+            return ioc_match
 
         for ioc in self.get_iocs("file_paths"):
             # Strip any trailing slash from indicator paths to match
             # directories.
-            if file_path.startswith(ioc["value"].rstrip("/")):
-                self.log.warning(
-                    'Found a known suspicious file path "%s" '
-                    'matching indicators form "%s"',
-                    file_path,
-                    ioc["name"],
+            if file_path.startswith(ioc.value.rstrip("/")):
+                return IndicatorMatch(
+                    ioc=ioc,
+                    message=f'Found a known suspicious file path "{file_path}" matching indicators form "{ioc.name}"',
                 )
-                return ioc
 
         return None
 
-    def check_file_path_process(self, file_path: str) -> Optional[Dict[str, Any]]:
+    def check_file_path_process(self, file_path: str) -> Optional[IndicatorMatch]:
         """Check the provided file path contains a process name from the
         list of indicators
 
@@ -655,18 +620,15 @@ class Indicators:
 
         for ioc in self.get_iocs("processes"):
             parts = file_path.split("/")
-            if ioc["value"] in parts:
-                self.log.warning(
-                    "Found known suspicious process name mentioned in file at "
-                    'path "%s" matching indicators from "%s"',
-                    file_path,
-                    ioc["name"],
+            if ioc.value in parts:
+                return IndicatorMatch(
+                    ioc=ioc,
+                    message=f'Found known suspicious process name mentioned in file at path "{file_path}" matching indicators from "{ioc.name}"',
                 )
-                return ioc
 
         return None
 
-    def check_profile(self, profile_uuid: str) -> Union[dict, None]:
+    def check_profile(self, profile_uuid: str) -> Optional[IndicatorMatch]:
         """Check the provided configuration profile UUID against the list of
         indicators.
 
@@ -680,18 +642,15 @@ class Indicators:
             return None
 
         for ioc in self.get_iocs("ios_profile_ids"):
-            if profile_uuid in ioc["value"]:
-                self.log.warning(
-                    'Found a known suspicious profile ID "%s" '
-                    'matching indicators from "%s"',
-                    profile_uuid,
-                    ioc["name"],
+            if profile_uuid in ioc.value:
+                return IndicatorMatch(
+                    ioc=ioc,
+                    message=f'Found a known suspicious profile ID "{profile_uuid}" matching indicators from "{ioc.name}"',
                 )
-                return ioc
 
         return None
 
-    def check_file_hash(self, file_hash: str) -> Union[dict, None]:
+    def check_file_hash(self, file_hash: str) -> Optional[IndicatorMatch]:
         """Check the provided file hash against the list of indicators.
 
         :param file_hash: hash to check
@@ -710,18 +669,15 @@ class Indicators:
             hash_type = "sha256"
 
         for ioc in self.get_iocs("files_" + hash_type):
-            if file_hash.lower() == ioc["value"].lower():
-                self.log.warning(
-                    'Found a known suspicious file with hash "%s" '
-                    'matching indicators from "%s"',
-                    file_hash,
-                    ioc["name"],
+            if file_hash.lower() == ioc.value.lower():
+                return IndicatorMatch(
+                    ioc=ioc,
+                    message=f'Found a known suspicious file with hash "{file_hash}" matching indicators from "{ioc.name}"',
                 )
-                return ioc
 
         return None
 
-    def check_app_certificate_hash(self, cert_hash: str) -> Union[dict, None]:
+    def check_app_certificate_hash(self, cert_hash: str) -> Optional[IndicatorMatch]:
         """Check the provided cert hash against the list of indicators.
 
         :param cert_hash: hash to check
@@ -733,18 +689,15 @@ class Indicators:
             return None
 
         for ioc in self.get_iocs("app_cert_hashes"):
-            if cert_hash.lower() == ioc["value"].lower():
-                self.log.warning(
-                    'Found a known suspicious app certfificate with hash "%s" '
-                    'matching indicators from "%s"',
-                    cert_hash,
-                    ioc["name"],
+            if cert_hash.lower() == ioc.value.lower():
+                return IndicatorMatch(
+                    ioc=ioc,
+                    message=f'Found a known suspicious app certfificate with hash "{cert_hash}" matching indicators from "{ioc.name}"',
                 )
-                return ioc
 
         return None
 
-    def check_app_id(self, app_id: str) -> Union[dict, None]:
+    def check_app_id(self, app_id: str) -> Optional[IndicatorMatch]:
         """Check the provided app identifier (typically an Android package name)
         against the list of indicators.
 
@@ -757,18 +710,17 @@ class Indicators:
             return None
 
         for ioc in self.get_iocs("app_ids"):
-            if app_id.lower() == ioc["value"].lower():
-                self.log.warning(
-                    'Found a known suspicious app with ID "%s" '
-                    'matching indicators from "%s"',
-                    app_id,
-                    ioc["name"],
+            if app_id.lower() == ioc.value.lower():
+                return IndicatorMatch(
+                    ioc=ioc,
+                    message=f'Found a known suspicious app with ID "{app_id}" matching indicators from "{ioc.name}"',
                 )
-                return ioc
 
         return None
 
-    def check_android_property_name(self, property_name: str) -> Optional[dict]:
+    def check_android_property_name(
+        self, property_name: str
+    ) -> Optional[IndicatorMatch]:
         """Check the android property name against the list of indicators.
 
         :param property_name: Name of the Android property
@@ -780,24 +732,21 @@ class Indicators:
             return None
 
         for ioc in self.get_iocs("android_property_names"):
-            if property_name.lower() == ioc["value"].lower():
-                self.log.warning(
-                    'Found a known suspicious Android property "%s" '
-                    'matching indicators from "%s"',
-                    property_name,
-                    ioc["name"],
+            if property_name.lower() == ioc.value.lower():
+                return IndicatorMatch(
+                    ioc=ioc,
+                    message=f'Found a known suspicious Android property "{property_name}" matching indicators from "{ioc.name}"',
                 )
-                return ioc
 
         return None
 
-    def check_domain(self, url: str) -> Union[dict, None]:
+    def check_domain(self, url: str) -> Optional[IndicatorMatch]:
         """
         Renamed check_url now, kept for compatibility
         """
         return self.check_url(url)
 
-    def check_domains(self, urls: list) -> Union[dict, None]:
+    def check_domains(self, urls: list) -> Optional[IndicatorMatch]:
         """
         Renamed check_domains, kept for compatibility
         """

src/mvt/common/log.py

@@ -0,0 +1,65 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2025 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from rich.console import Console
+from rich.logging import RichHandler
+from typing import Optional
+
+INFO = logging.INFO
+DEBUG = logging.DEBUG
+ERROR = logging.ERROR
+FATAL = logging.CRITICAL
+WARNING = logging.WARNING
+
+INFO_ALERT = 25
+LOW_ALERT = 35
+MEDIUM_ALERT = 45
+HIGH_ALERT = 55
+CRITICAL_ALERT = 65
+
+logging.addLevelName(INFO_ALERT, "INFO")
+logging.addLevelName(LOW_ALERT, "LOW")
+logging.addLevelName(MEDIUM_ALERT, "MEDIUM")
+logging.addLevelName(HIGH_ALERT, "HIGH")
+logging.addLevelName(CRITICAL_ALERT, "CRITICAL")
+
+
+class MVTLogHandler(RichHandler):
+    def __init__(self, console: Optional[Console] = None, level: int = logging.DEBUG):
+        super().__init__(console=console, level=level)
+
+    def __add_prefix_space(self, level: str) -> str:
+        max_length = len("CRITICAL ALERT")
+        space = max_length - len(level)
+        return f"{level}{' ' * space}"
+
+    def emit(self, record: logging.LogRecord):
+        try:
+            msg = rf"[grey50]\[{record.name}][/] {self.format(record)}"
+
+            if record.levelno == ERROR:
+                msg = f"[bold red]{self.__add_prefix_space('ERROR')}[/bold red] {msg}"
+            elif record.levelno == FATAL:
+                msg = f"[bold red]{self.__add_prefix_space('FATAL')}[/bold red] {msg}"
+            elif record.levelno == WARNING:
+                msg = f"[yellow]{self.__add_prefix_space('WARNING')}[/yellow] {msg}"
+            elif record.levelno == INFO_ALERT:
+                msg = f"[blue]{self.__add_prefix_space('INFO ALERT')}[/blue] {msg}"
+            elif record.levelno == LOW_ALERT:
+                msg = f"[yellow]{self.__add_prefix_space('LOW ALERT')}[/yellow] {msg}"
+            elif record.levelno == MEDIUM_ALERT:
+                msg = f"[sandy_brown]{self.__add_prefix_space('MEDIUM ALERT')}[/sandy_brown] {msg}"
+            elif record.levelno == HIGH_ALERT:
+                msg = f"[red]{self.__add_prefix_space('HIGH ALERT')}[/red] {msg}"
+            elif record.levelno == CRITICAL_ALERT:
+                msg = f"[bold red]{self.__add_prefix_space('CRITICAL ALERT')}[/bold red] {msg}"
+            else:
+                msg = f"{self.__add_prefix_space('')} {msg}"
+
+            self.console.print(msg)
+
+        except Exception:
+            self.handleError(record)

src/mvt/common/module.py

@@ -8,8 +8,17 @@ import json
 import logging
 import os
 import re
-from typing import Any, Dict, List, Optional, Union
+from dataclasses import asdict, is_dataclass
+from typing import Any, Dict, Optional
 
+from .alerts import AlertStore
+from .indicators import Indicators
+from .module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+    ModuleTimeline,
+)
 from .utils import CustomJSONEncoder, exec_or_profile
 
 
@@ -28,7 +37,7 @@ class InsufficientPrivileges(Exception):
 class MVTModule:
     """This class provides a base for all extraction modules."""
 
-    enabled = True
+    enabled: bool = True
     slug: Optional[str] = None
 
     def __init__(
@@ -38,7 +47,7 @@ class MVTModule:
         results_path: Optional[str] = None,
         module_options: Optional[Dict[str, Any]] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Union[List[Dict[str, Any]], Dict[str, Any], None] = None,
+        results: ModuleResults = [],
     ) -> None:
         """Initialize module.
 
@@ -46,7 +55,7 @@ class MVTModule:
         :type file_path: str
         :param target_path: Path to the target folder (backup or filesystem
                             dump)
-        :type file_path: str
+        :type target_path: str
         :param results_path: Folder where results will be stored
         :type results_path: str
         :param fast_mode: Flag to enable or disable slow modules
@@ -55,32 +64,32 @@ class MVTModule:
         :param results: Provided list of results entries
         :type results: list
         """
-        self.file_path = file_path
-        self.target_path = target_path
-        self.results_path = results_path
-        self.module_options = module_options if module_options else {}
+        self.file_path: Optional[str] = file_path
+        self.target_path: Optional[str] = target_path
+        self.results_path: Optional[str] = results_path
+        self.module_options: Optional[Dict[str, Any]] = (
+            module_options if module_options else {}
+        )
+
         self.log = log
-        self.indicators = None
-        self.results = results if results else []
-        self.detected: List[Dict[str, Any]] = []
-        self.timeline: List[Dict[str, str]] = []
-        self.timeline_detected: List[Dict[str, str]] = []
+        self.indicators: Optional[Indicators] = None
+        self.alertstore: AlertStore = AlertStore(log=log)
+
+        self.results: ModuleResults = results if results else []
+        self.timeline: ModuleTimeline = []
+        self.timeline_detected: ModuleTimeline = []
 
     @classmethod
     def from_json(cls, json_path: str, log: logging.Logger):
         with open(json_path, "r", encoding="utf-8") as handle:
-            try:
-                results = json.load(handle)
-                if log:
-                    log.info('Loaded %d results from "%s"', len(results), json_path)
-                return cls(results=results, log=log)
-            except json.decoder.JSONDecodeError as err:
-                log.error('Error to decode the json "%s" file: "%s"', json_path, err)
-                return None
+            results = json.load(handle)
+            if log:
+                log.info('Loaded %d results from "%s"', len(results), json_path)
+
+            return cls(results=results, log=log)
 
     @classmethod
     def get_slug(cls) -> str:
-        """Use the module's class name to retrieve a slug"""
         if cls.slug:
             return cls.slug
 
@@ -88,26 +97,26 @@ class MVTModule:
         return re.sub("([a-z0-9])([A-Z])", r"\1_\2", sub).lower()
 
     def check_indicators(self) -> None:
-        """Check the results of this module against a provided list of
-        indicators.
-
-
-        """
         raise NotImplementedError
 
     def save_to_json(self) -> None:
-        """Save the collected results to a json file."""
         if not self.results_path:
             return
 
         name = self.get_slug()
 
         if self.results:
+            converted_results = [
+                asdict(result) if is_dataclass(result) else result
+                for result in self.results
+            ]
             results_file_name = f"{name}.json"
             results_json_path = os.path.join(self.results_path, results_file_name)
             with open(results_json_path, "w", encoding="utf-8") as handle:
                 try:
-                    json.dump(self.results, handle, indent=4, cls=CustomJSONEncoder)
+                    json.dump(
+                        converted_results, handle, indent=4, cls=CustomJSONEncoder
+                    )
                 except Exception as exc:
                     self.log.error(
                         "Unable to store results of module %s to file %s: %s",
@@ -116,13 +125,15 @@ class MVTModule:
                         exc,
                     )
 
-        if self.detected:
+        if self.alertstore.alerts:
             detected_file_name = f"{name}_detected.json"
             detected_json_path = os.path.join(self.results_path, detected_file_name)
             with open(detected_json_path, "w", encoding="utf-8") as handle:
-                json.dump(self.detected, handle, indent=4, cls=CustomJSONEncoder)
+                json.dump(
+                    self.alertstore.alerts, handle, indent=4, cls=CustomJSONEncoder
+                )
 
-    def serialize(self, record: dict) -> Union[dict, list, None]:
+    def serialize(self, result: ModuleAtomicResult) -> ModuleSerializedResult:
         raise NotImplementedError
 
     @staticmethod
@@ -134,30 +145,38 @@ class MVTModule:
         """
         timeline_set = set()
         for record in timeline:
-            timeline_set.add(json.dumps(record, sort_keys=True))
+            timeline_set.add(
+                json.dumps(
+                    asdict(record) if is_dataclass(record) else record, sort_keys=True
+                )
+            )
+
         return [json.loads(record) for record in timeline_set]
 
     def to_timeline(self) -> None:
         """Convert results into a timeline."""
+        if not self.results:
+            return
+
         for result in self.results:
-            record = self.serialize(result)
+            record: ModuleSerializedResult = self.serialize(result)
             if record:
                 if isinstance(record, list):
                     self.timeline.extend(record)
                 else:
                     self.timeline.append(record)
 
-        for detected in self.detected:
-            record = self.serialize(detected)
-            if record:
-                if isinstance(record, list):
-                    self.timeline_detected.extend(record)
-                else:
-                    self.timeline_detected.append(record)
+        # for detected in self.alertstore.alerts:
+        #     record = self.serialize(detected)
+        #     if record:
+        #         if isinstance(record, list):
+        #             self.timeline_detected.extend(record)
+        #         else:
+        #             self.timeline_detected.append(record)
 
         # De-duplicate timeline entries.
         self.timeline = self._deduplicate_timeline(self.timeline)
-        self.timeline_detected = self._deduplicate_timeline(self.timeline_detected)
+        # self.timeline_detected = self._deduplicate_timeline(self.timeline_detected)
 
     def run(self) -> None:
         """Run the main module procedure."""
@@ -212,7 +231,7 @@ def run_module(module: MVTModule) -> None:
             )
 
         else:
-            if module.indicators and not module.detected:
+            if module.indicators and not module.alertstore.alerts:
                 module.log.info(
                     "The %s module produced no detections!", module.__class__.__name__
                 )

src/mvt/common/module_types.py

@@ -0,0 +1,29 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2025 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from .indicators import Indicator
+from dataclasses import dataclass
+from typing import List, Union, Optional
+
+
+@dataclass
+class ModuleAtomicResult:
+    timestamp: Optional[str]
+    matched_indicator: Optional[Indicator]
+
+
+ModuleResults = List[ModuleAtomicResult]
+
+
+@dataclass
+class ModuleAtomicTimeline:
+    timestamp: str
+    module: str
+    event: str
+    data: str
+
+
+ModuleTimeline = List[ModuleAtomicTimeline]
+ModuleSerializedResult = Union[ModuleAtomicTimeline, ModuleTimeline]

src/mvt/common/utils.py

@@ -12,7 +12,7 @@ import os
 import re
 from typing import Any, Iterator, Union
 
-from rich.logging import RichHandler
+from .log import MVTLogHandler
 from mvt.common.config import settings
 
 
@@ -234,11 +234,10 @@ def init_logging(verbose: bool = False):
     """
     Initialise logging for the MVT module
     """
-    # Setup logging using Rich.
     log = logging.getLogger("mvt")
-    log.setLevel(logging.DEBUG)
-    consoleHandler = RichHandler(show_path=False, log_time_format="%X")
-    consoleHandler.setFormatter(logging.Formatter("[%(name)s] %(message)s"))
+    log.setLevel(logging.INFO)
+    consoleHandler = MVTLogHandler()
+    consoleHandler.setFormatter(logging.Formatter("%(message)s"))
     if verbose:
         consoleHandler.setLevel(logging.DEBUG)
     else:

src/mvt/common/version.py

@@ -3,4 +3,4 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-MVT_VERSION = "2.6.1"
+MVT_VERSION = "3.0.0"

src/mvt/common/virustotal.py

@@ -1,52 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import os
-
-import requests
-
-log = logging.getLogger(__name__)
-
-MVT_VT_API_KEY = "MVT_VT_API_KEY"
-
-
-class VTNoKey(Exception):
-    pass
-
-
-class VTQuotaExceeded(Exception):
-    pass
-
-
-def virustotal_lookup(file_hash: str):
-    if MVT_VT_API_KEY not in os.environ:
-        raise VTNoKey(
-            "No VirusTotal API key provided: to use VirusTotal "
-            "lookups please provide your API key with "
-            "`export MVT_VT_API_KEY=<key>`"
-        )
-
-    headers = {
-        "User-Agent": "VirusTotal",
-        "Content-Type": "application/json",
-        "x-apikey": os.environ[MVT_VT_API_KEY],
-    }
-    res = requests.get(
-        f"https://www.virustotal.com/api/v3/files/{file_hash}", headers=headers
-    )
-
-    if res.status_code == 200:
-        report = res.json()
-        return report["data"]
-
-    if res.status_code == 404:
-        log.info("Could not find results for file with hash %s", file_hash)
-    elif res.status_code == 429:
-        raise VTQuotaExceeded("You have exceeded the quota for your VirusTotal API key")
-    else:
-        raise Exception(f"Unexpected response from VirusTotal: {res.status_code}")
-
-    return None

src/mvt/ios/cli.py

@@ -257,11 +257,8 @@ def check_backup(
     log.info("Checking iTunes backup located at: %s", backup_path)
 
     cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning(
-            "The analysis of the backup produced %d detections!", cmd.detected_count
-        )
+    cmd.show_alerts_brief()
+    cmd.show_support_message()
 
 
 # ==============================================================================
@@ -306,12 +303,8 @@ def check_fs(ctx, iocs, output, fast, list_modules, module, hashes, verbose, dum
     log.info("Checking iOS filesystem located at: %s", dump_path)
 
     cmd.run()
-
-    if cmd.detected_count > 0:
-        log.warning(
-            "The analysis of the iOS filesystem produced %d detections!",
-            cmd.detected_count,
-        )
+    cmd.show_alerts_brief()
+    cmd.show_support_message()
 
 
 # ==============================================================================
@@ -345,6 +338,8 @@ def check_iocs(ctx, iocs, list_modules, module, folder):
         return
 
     cmd.run()
+    cmd.show_alerts_brief()
+    cmd.show_support_message()
 
 
 # ==============================================================================

src/mvt/ios/modules/backup/backup_info.py

@@ -9,6 +9,7 @@ import plistlib
 from typing import Optional
 
 from mvt.common.module import DatabaseNotFoundError
+from mvt.common.module_types import ModuleResults
 from mvt.ios.versions import get_device_desc_from_id, is_ios_version_outdated
 
 from ..base import IOSExtraction
@@ -24,7 +25,7 @@ class BackupInfo(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/ios/modules/backup/configuration_profiles.py

@@ -7,9 +7,14 @@ import logging
 import os
 import plistlib
 from base64 import b64encode
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_datetime_to_iso
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+    ModuleResults,
+)
 
 from ..base import IOSExtraction
 
@@ -28,7 +33,7 @@ class ConfigurationProfiles(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -39,7 +44,7 @@ class ConfigurationProfiles(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         if not record["install_date"]:
             return {}
 
@@ -63,28 +68,28 @@ class ConfigurationProfiles(IOSExtraction):
 
                 # Alert on any known malicious configuration profiles in the
                 # indicator list.
-                ioc = self.indicators.check_profile(result["plist"]["PayloadUUID"])
-                if ioc:
-                    self.log.warning(
-                        "Found a known malicious configuration "
-                        'profile "%s" with UUID %s',
-                        result["plist"]["PayloadDisplayName"],
-                        result["plist"]["PayloadUUID"],
+                ioc_match = self.indicators.check_profile(
+                    result["plist"]["PayloadUUID"]
+                )
+                if ioc_match:
+                    warning_message = (
+                        f'Found a known malicious configuration profile "{result["plist"]["PayloadDisplayName"]}" with UUID "{result["plist"]["PayloadUUID"]}"',
                     )
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(), warning_message, "", result
+                    )
+                    self.alertstore.log_latest()
                     continue
 
                 # Highlight suspicious configuration profiles which may be used
                 # to hide notifications.
                 if payload_content["PayloadType"] in ["com.apple.notificationsettings"]:
-                    self.log.warning(
-                        "Found a potentially suspicious configuration profile "
-                        '"%s" with payload type %s',
-                        result["plist"]["PayloadDisplayName"],
-                        payload_content["PayloadType"],
+                    warning_message = (
+                        f'Found a potentially suspicious configuration profile "{result["plist"]["PayloadDisplayName"]}" with payload type {payload_content["PayloadType"]}',
                     )
-                    self.detected.append(result)
+                    self.alertstore.medum(self.get_slug(), warning_message, "", result)
+                    self.alertstore.log_latest()
                     continue
 
     def run(self) -> None:

src/mvt/ios/modules/backup/manifest.py

@@ -13,6 +13,11 @@ from typing import Optional
 from mvt.common.module import DatabaseNotFoundError
 from mvt.common.url import URL
 from mvt.common.utils import convert_datetime_to_iso, convert_unix_to_iso
+from mvt.common.module_types import (
+    ModuleResults,
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+)
 
 from ..base import IOSExtraction
 
@@ -27,7 +32,7 @@ class Manifest(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -60,7 +65,7 @@ class Manifest(IOSExtraction):
 
         return convert_unix_to_iso(timestamp_or_unix_time_int)
 
-    def serialize(self, record: dict) -> []:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
         if "modified" not in record or "status_changed" not in record:
             return records
@@ -95,8 +100,10 @@ class Manifest(IOSExtraction):
             if not self.indicators:
                 continue
 
-            if self.indicators.check_file_path("/" + result["relative_path"]):
-                self.detected.append(result)
+            ioc_match = self.indicators.check_file_path("/" + result["relative_path"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.high(self.get_slug(), ioc_match.message, "", result)
                 continue
 
             rel_path = result["relative_path"].lower()
@@ -107,15 +114,15 @@ class Manifest(IOSExtraction):
                 except Exception:
                     continue
 
-                ioc = self.indicators.check_url(part)
-                if ioc:
-                    self.log.warning(
-                        'Found mention of domain "%s" in a backup file with path: %s',
-                        ioc["value"],
-                        rel_path,
+                ioc_match = self.indicators.check_url(part)
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.high(
+                        self.get_slug(),
+                        f'Found mention of domain "{ioc_match.ioc.value}" in a backup file with path: {rel_path}',
+                        "",
+                        result,
                     )
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
 
     def run(self) -> None:
         manifest_db_path = os.path.join(self.target_path, "Manifest.db")

src/mvt/ios/modules/backup/profile_events.py

@@ -5,9 +5,14 @@
 
 import logging
 import plistlib
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_datetime_to_iso
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+)
 
 from ..base import IOSExtraction
 
@@ -29,7 +34,7 @@ class ProfileEvents(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -40,7 +45,7 @@ class ProfileEvents(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record.get("timestamp"),
             "module": self.__class__.__name__,
@@ -51,20 +56,27 @@ class ProfileEvents(IOSExtraction):
         }
 
     def check_indicators(self) -> None:
+        for result in self.results:
+            message = f'On {result.get("timestamp")} process "{result.get("process")}" started operation "{result.get("operation")}" of profile "{result.get("profile_id")}"'
+            self.alertstore.low(
+                self.get_slug(), message, result.get("timestamp"), result
+            )
+            self.alertstore.log_latest()
+
         if not self.indicators:
             return
 
         for result in self.results:
-            ioc = self.indicators.check_process(result.get("process"))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_process(result.get("process"))
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
                 continue
 
-            ioc = self.indicators.check_profile(result.get("profile_id"))
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_profile(result.get("profile_id"))
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
 
     @staticmethod
     def parse_profile_events(file_data: bytes) -> list:
@@ -109,13 +121,4 @@ class ProfileEvents(IOSExtraction):
             with open(events_file_path, "rb") as handle:
                 self.results.extend(self.parse_profile_events(handle.read()))
 
-        for result in self.results:
-            self.log.info(
-                'On %s process "%s" started operation "%s" of profile "%s"',
-                result.get("timestamp"),
-                result.get("process"),
-                result.get("operation"),
-                result.get("profile_id"),
-            )
-
         self.log.info("Extracted %d profile events", len(self.results))

src/mvt/ios/modules/base.py

@@ -11,7 +11,8 @@ import sqlite3
 import subprocess
 from typing import Iterator, Optional, Union
 
-from mvt.common.module import DatabaseCorruptedError, DatabaseNotFoundError, MVTModule
+from mvt.common.module import DatabaseCorruptedError, DatabaseNotFoundError
+from mvt.common.module import MVTModule, ModuleResults
 
 
 class IOSExtraction(MVTModule):
@@ -25,7 +26,7 @@ class IOSExtraction(MVTModule):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/ios/modules/fs/analytics.py

@@ -7,9 +7,14 @@ import copy
 import logging
 import plistlib
 import sqlite3
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_mactime_to_iso
+from mvt.common.module_types import (
+    ModuleResults,
+    ModuleSerializedResult,
+    ModuleAtomicResult,
+)
 
 from ..base import IOSExtraction
 
@@ -29,7 +34,7 @@ class Analytics(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -40,7 +45,7 @@ class Analytics(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,
@@ -57,24 +62,26 @@ class Analytics(IOSExtraction):
                 if not isinstance(value, str):
                     continue
 
-                ioc = self.indicators.check_process(value)
-                if ioc:
-                    self.log.warning(
-                        'Found mention of a malicious process "%s" in %s file at %s',
-                        value,
-                        result["artifact"],
-                        result["isodate"],
+                ioc_match = self.indicators.check_process(value)
+                if ioc_match:
+                    warning_message = (
+                        f'Found mention of a malicious process "{value}" in {result["artifact"]} file at {result["isodate"]}',
                     )
                     new_result = copy.copy(result)
-                    new_result["matched_indicator"] = ioc
-                    self.detected.append(new_result)
+                    new_result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(), warning_message, "", new_result
+                    )
+                    self.alertstore.log_latest()
                     continue
 
-                ioc = self.indicators.check_url(value)
-                if ioc:
+                ioc_match = self.indicators.check_url(value)
+                if ioc_match:
                     new_result = copy.copy(result)
-                    new_result["matched_indicator"] = ioc
-                    self.detected.append(new_result)
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(), ioc_match.message, "", new_result
+                    )
 
     def _extract_analytics_data(self):
         artifact = self.file_path.split("/")[-1]

src/mvt/ios/modules/fs/analytics_ios_versions.py

@@ -5,9 +5,14 @@
 
 import logging
 from datetime import datetime
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.ios.versions import find_version_by_build
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+    ModuleResults,
+)
 
 from ..base import IOSExtraction
 from .analytics import Analytics
@@ -25,7 +30,7 @@ class AnalyticsIOSVersions(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -36,7 +41,7 @@ class AnalyticsIOSVersions(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,

src/mvt/ios/modules/fs/cache_files.py

@@ -6,8 +6,13 @@
 import logging
 import os
 import sqlite3
-from typing import Optional, Union
+from typing import Optional
 
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+    ModuleResults,
+)
 from ..base import IOSExtraction
 
 
@@ -19,7 +24,7 @@ class CacheFiles(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -30,7 +35,7 @@ class CacheFiles(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
         for item in self.results[record]:
             records.append(
@@ -48,18 +53,19 @@ class CacheFiles(IOSExtraction):
         if not self.indicators:
             return
 
-        self.detected = {}
+        self.alertstore.alerts = {}
         for key, values in self.results.items():
             for value in values:
-                ioc = self.indicators.check_url(value["url"])
-                if ioc:
-                    value["matched_indicator"] = ioc
-                    if key not in self.detected:
-                        self.detected[key] = [
+                ioc_match = self.indicators.check_url(value["url"])
+                if ioc_match:
+                    value["matched_indicator"] = ioc_match.ioc
+                    # XXX: Finish converting this method
+                    if key not in self.alertstore.alerts:
+                        self.alertstore.alerts[key] = [
                             value,
                         ]
                     else:
-                        self.detected[key].append(value)
+                        self.alertstore.alerts[key].append(value)
 
     def _process_cache_file(self, file_path):
         self.log.info("Processing cache file at path: %s", file_path)

src/mvt/ios/modules/fs/filesystem.py

@@ -5,9 +5,14 @@
 
 import logging
 import os
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_unix_to_iso
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+    ModuleResults,
+)
 
 from ..base import IOSExtraction
 
@@ -24,7 +29,7 @@ class Filesystem(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -35,7 +40,7 @@ class Filesystem(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["modified"],
             "module": self.__class__.__name__,
@@ -51,19 +56,19 @@ class Filesystem(IOSExtraction):
             if "path" not in result:
                 continue
 
-            ioc = self.indicators.check_file_path(result["path"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_file_path(result["path"])
+            if ioc_match:
+                self.alertstore.high(self.get_slug(), ioc_match.message, "", result)
+                self.alertstore.log_latest()
 
             # If we are instructed to run fast, we skip the rest.
             if self.module_options.get("fast_mode", None):
                 continue
 
-            ioc = self.indicators.check_file_path_process(result["path"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_file_path_process(result["path"])
+            if ioc_match:
+                self.alertstore.high(self.get_slug(), ioc_match.message, "", result)
+                self.alertstore.log_latest()
 
     def run(self) -> None:
         for root, dirs, files in os.walk(self.target_path):

src/mvt/ios/modules/fs/net_netusage.py

@@ -7,6 +7,7 @@ import logging
 import sqlite3
 from typing import Optional
 
+from mvt.common.module_types import ModuleResults
 from ..net_base import NetBase
 
 NETUSAGE_ROOT_PATHS = [
@@ -29,7 +30,7 @@ class Netusage(NetBase):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/ios/modules/fs/safari_favicon.py

@@ -4,9 +4,14 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_mactime_to_iso
+from mvt.common.module_types import (
+    ModuleResults,
+    ModuleSerializedResult,
+    ModuleAtomicResult,
+)
 
 from ..base import IOSExtraction
 
@@ -26,7 +31,7 @@ class SafariFavicon(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -37,7 +42,7 @@ class SafariFavicon(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,
@@ -51,13 +56,13 @@ class SafariFavicon(IOSExtraction):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_url(result["url"])
-            if not ioc:
-                ioc = self.indicators.check_url(result["icon_url"])
+            ioc_match = self.indicators.check_url(result["url"])
+            if not ioc_match:
+                ioc_match = self.indicators.check_url(result["icon_url"])
 
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            if ioc_match:
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
+                self.alertstore.log_latest()
 
     def _process_favicon_db(self, file_path):
         conn = self._open_sqlite_db(file_path)

src/mvt/ios/modules/fs/shutdownlog.py

@@ -4,9 +4,14 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_mactime_to_iso
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+)
 
 from ..base import IOSExtraction
 
@@ -25,7 +30,7 @@ class ShutdownLog(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -36,7 +41,7 @@ class ShutdownLog(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,
@@ -50,22 +55,23 @@ class ShutdownLog(IOSExtraction):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_file_path(result["client"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_file_path(result["client"])
+            if ioc_match:
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
+                self.alertstore.log_latest()
                 continue
 
             for ioc in self.indicators.get_iocs("processes"):
                 parts = result["client"].split("/")
-                if ioc in parts:
-                    self.log.warning(
-                        'Found mention of a known malicious process "%s" in '
-                        "shutdown.log",
-                        ioc,
-                    )
+                if ioc.value in parts:
                     result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                    self.alertstore.critical(
+                        self.get_slug(),
+                        f'Found mention of a known malicious process "{ioc.value}" in shutdown.log',
+                        "",
+                        result,
+                    )
+                    self.alertstore.log_latest()
                     continue
 
     def process_shutdownlog(self, content):

src/mvt/ios/modules/fs/version_history.py

@@ -6,9 +6,14 @@
 import datetime
 import json
 import logging
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_datetime_to_iso
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+)
 
 from ..base import IOSExtraction
 
@@ -27,7 +32,7 @@ class IOSVersionHistory(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -38,7 +43,7 @@ class IOSVersionHistory(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,

src/mvt/ios/modules/fs/webkit_base.py

@@ -18,10 +18,11 @@ class WebkitBase(IOSExtraction):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_url(result["url"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_url(result["url"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
+                continue
 
     def _process_webkit_folder(self, root_paths):
         for found_path in self._get_fs_files_from_patterns(root_paths):

src/mvt/ios/modules/fs/webkit_indexeddb.py

@@ -4,8 +4,13 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from typing import Optional, Union
+from typing import Optional
 
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+)
 from .webkit_base import WebkitBase
 
 WEBKIT_INDEXEDDB_ROOT_PATHS = [
@@ -29,7 +34,7 @@ class WebkitIndexedDB(WebkitBase):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -40,7 +45,7 @@ class WebkitIndexedDB(WebkitBase):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,

src/mvt/ios/modules/fs/webkit_localstorage.py

@@ -4,8 +4,13 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from typing import Optional, Union
+from typing import Optional
 
+from mvt.common.module_types import (
+    ModuleResults,
+    ModuleSerializedResult,
+    ModuleAtomicResult,
+)
 from .webkit_base import WebkitBase
 
 WEBKIT_LOCALSTORAGE_ROOT_PATHS = [
@@ -27,7 +32,7 @@ class WebkitLocalStorage(WebkitBase):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -38,7 +43,7 @@ class WebkitLocalStorage(WebkitBase):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,

src/mvt/ios/modules/fs/webkit_safariviewservice.py

@@ -6,6 +6,7 @@
 import logging
 from typing import Optional
 
+from mvt.common.module_types import ModuleResults
 from .webkit_base import WebkitBase
 
 WEBKIT_SAFARIVIEWSERVICE_ROOT_PATHS = [
@@ -27,7 +28,7 @@ class WebkitSafariViewService(WebkitBase):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/ios/modules/mixed/applications.py

@@ -8,11 +8,13 @@ import logging
 import os
 import plistlib
 from datetime import datetime, timezone
-from typing import Any, Dict, Optional, Union
+from typing import Any, Dict, Optional
 
 from mvt.common.module import DatabaseNotFoundError
 from mvt.common.utils import convert_datetime_to_iso
 from mvt.ios.modules.base import IOSExtraction
+from mvt.common.module import ModuleResults, ModuleAtomicResult, ModuleSerializedResult
+
 
 APPLICATIONS_DB_PATH = [
     "private/var/containers/Bundle/Application/*/iTunesMetadata.plist"
@@ -35,7 +37,7 @@ class Applications(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -46,7 +48,7 @@ class Applications(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         if "isodate" in record:
             return {
                 "timestamp": record["isodate"],
@@ -60,41 +62,51 @@ class Applications(IOSExtraction):
         for result in self.results:
             if self.indicators:
                 if "softwareVersionBundleId" not in result:
-                    self.log.warning(
-                        "Suspicious application identified without softwareVersionBundleId"
+                    self.alertstore.high(
+                        self.get_slug(),
+                        "Suspicious application identified without softwareVersionBundleId",
+                        "",
+                        result,
                     )
-                    self.detected.append(result)
                     continue
 
-                ioc = self.indicators.check_process(result["softwareVersionBundleId"])
-                if ioc:
-                    self.log.warning(
-                        "Malicious application %s identified",
-                        result["softwareVersionBundleId"],
+                ioc_match = self.indicators.check_process(
+                    result["softwareVersionBundleId"]
+                )
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(),
+                        f"Malicious application {result['softwareVersionBundleId']} identified",
+                        "",
+                        result,
                     )
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
                     continue
 
-                ioc = self.indicators.check_app_id(result["softwareVersionBundleId"])
-                if ioc:
-                    self.log.warning(
-                        "Malicious application %s identified",
-                        result["softwareVersionBundleId"],
+                ioc_match = self.indicators.check_app_id(
+                    result["softwareVersionBundleId"]
+                )
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(),
+                        f"Malicious application {result['softwareVersionBundleId']} identified",
+                        "",
+                        result,
                     )
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
                     continue
+
             # Some apps installed from apple store with sourceApp "com.apple.AppStore.ProductPageExtension"
             if (
                 result.get("sourceApp", "com.apple.AppStore")
                 not in KNOWN_APP_INSTALLERS
             ):
-                self.log.warning(
-                    "Suspicious app not installed from the App Store or MDM: %s",
-                    result["softwareVersionBundleId"],
+                self.alertstore.medium(
+                    self.get_slug(),
+                    f"Suspicious app not installed from the App Store or MDM: {result['softwareVersionBundleId']}",
+                    "",
+                    result,
                 )
-                self.detected.append(result)
 
     def _parse_itunes_timestamp(self, entry: Dict[str, Any]) -> None:
         """

src/mvt/ios/modules/mixed/calendar.py

@@ -4,9 +4,14 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_mactime_to_iso
+from mvt.common.module_types import (
+    ModuleResults,
+    ModuleSerializedResult,
+    ModuleAtomicResult,
+)
 
 from ..base import IOSExtraction
 
@@ -26,7 +31,7 @@ class Calendar(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -44,7 +49,7 @@ class Calendar(IOSExtraction):
             "participant_last_modified",
         ]
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
         for timestamp in self.timestamps:
             if timestamp not in record or not record[timestamp]:
@@ -64,18 +69,23 @@ class Calendar(IOSExtraction):
     def check_indicators(self) -> None:
         for result in self.results:
             if result["participant_email"] and self.indicators:
-                ioc = self.indicators.check_email(result["participant_email"])
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                ioc_match = self.indicators.check_email(result["participant_email"])
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(), ioc_match.message, "", result
+                    )
                     continue
 
             # Custom check for Quadream exploit
             if result["summary"] == "Meeting" and result["description"] == "Notes":
-                self.log.warning(
-                    "Potential Quadream exploit event identified: %s", result["uuid"]
+                self.alertstore.high(
+                    self.get_slug(),
+                    f"Potential Quadream exploit event identified: {result['uuid']}",
+                    "",
+                    result,
                 )
-                self.detected.append(result)
+                self.alertstore.log_latest()
 
     def _parse_calendar_db(self):
         """

src/mvt/ios/modules/mixed/calls.py

@@ -4,9 +4,10 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_mactime_to_iso
+from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
 
 from ..base import IOSExtraction
 
@@ -37,7 +38,7 @@ class Calls(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,

src/mvt/ios/modules/mixed/chrome_favicon.py

@@ -4,9 +4,14 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_chrometime_to_datetime, convert_datetime_to_iso
+from mvt.common.module_types import (
+    ModuleResults,
+    ModuleSerializedResult,
+    ModuleAtomicResult,
+)
 
 from ..base import IOSExtraction
 
@@ -27,7 +32,7 @@ class ChromeFavicon(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -38,7 +43,7 @@ class ChromeFavicon(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,
@@ -51,12 +56,13 @@ class ChromeFavicon(IOSExtraction):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_url(result["url"])
-            if not ioc:
-                ioc = self.indicators.check_url(result["icon_url"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_url(result["url"])
+            if not ioc_match:
+                ioc_match = self.indicators.check_url(result["icon_url"])
+
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
                 continue
 
     def run(self) -> None:

src/mvt/ios/modules/mixed/chrome_history.py

@@ -4,9 +4,14 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_chrometime_to_datetime, convert_datetime_to_iso
+from mvt.common.module_types import (
+    ModuleResults,
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+)
 
 from ..base import IOSExtraction
 
@@ -29,7 +34,7 @@ class ChromeHistory(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -40,7 +45,7 @@ class ChromeHistory(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,
@@ -55,10 +60,10 @@ class ChromeHistory(IOSExtraction):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_url(result["url"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_url(result["url"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
 
     def run(self) -> None:
         self._find_ios_database(

src/mvt/ios/modules/mixed/contacts.py

@@ -7,6 +7,7 @@ import logging
 import sqlite3
 from typing import Optional
 
+from mvt.common.module_types import ModuleResults
 from ..base import IOSExtraction
 
 CONTACTS_BACKUP_IDS = [
@@ -27,7 +28,7 @@ class Contacts(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/ios/modules/mixed/firefox_favicon.py

@@ -4,9 +4,14 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_unix_to_iso
+from mvt.common.module_types import (
+    ModuleResults,
+    ModuleSerializedResult,
+    ModuleAtomicResult,
+)
 
 from ..base import IOSExtraction
 
@@ -28,7 +33,7 @@ class FirefoxFavicon(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -39,7 +44,7 @@ class FirefoxFavicon(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,
@@ -53,13 +58,13 @@ class FirefoxFavicon(IOSExtraction):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_url(result.get("url", ""))
-            if not ioc:
-                ioc = self.indicators.check_url(result.get("history_url", ""))
+            ioc_match = self.indicators.check_url(result.get("url", ""))
+            if not ioc_match:
+                ioc_match = self.indicators.check_url(result.get("history_url", ""))
 
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
 
     def run(self) -> None:
         self._find_ios_database(

src/mvt/ios/modules/mixed/firefox_history.py

@@ -4,9 +4,14 @@
 #   https://license.mvt.re/1.1/
 
 import logging
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_unix_to_iso
+from mvt.common.module_types import (
+    ModuleResults,
+    ModuleSerializedResult,
+    ModuleAtomicResult,
+)
 
 from ..base import IOSExtraction
 
@@ -32,7 +37,7 @@ class FirefoxHistory(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -43,7 +48,7 @@ class FirefoxHistory(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,
@@ -56,10 +61,10 @@ class FirefoxHistory(IOSExtraction):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_url(result["url"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_url(result["url"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
 
     def run(self) -> None:
         self._find_ios_database(

src/mvt/ios/modules/mixed/global_preferences.py

@@ -7,6 +7,8 @@ import logging
 import plistlib
 from typing import Optional
 
+from mvt.common.module_types import ModuleResults
+
 from ..base import IOSExtraction
 
 GLOBAL_PREFERENCES_BACKUP_IDS = ["0dc926a1810f7aee4e8f38793ed788701f93bf9d"]
@@ -25,7 +27,7 @@ class GlobalPreferences(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -40,11 +42,15 @@ class GlobalPreferences(IOSExtraction):
         for entry in self.results:
             if entry["entry"] == "LDMGlobalEnabled":
                 if entry["value"]:
-                    self.log.warning("Lockdown mode enabled")
+                    self.alertstore.info(
+                        self.get_slug(), "Lockdown mode enabled", "", None
+                    )
                 else:
-                    self.log.warning("Lockdown mode disabled")
-                return
-        self.log.warning("Lockdown mode disabled")
+                    self.alertstore.low(
+                        self.get_slug(), "Lockdown mode disabled", "", None
+                    )
+                    self.alertstore.log_latest()
+                    continue
 
     def process_file(self, file_path: str) -> None:
         with open(file_path, "rb") as handle:

src/mvt/ios/modules/mixed/idstatuscache.py

@@ -6,9 +6,14 @@
 import collections
 import logging
 import plistlib
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_mactime_to_iso
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleResults,
+    ModuleSerializedResult,
+)
 
 from ..base import IOSExtraction
 
@@ -31,7 +36,7 @@ class IDStatusCache(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -42,7 +47,7 @@ class IDStatusCache(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["isodate"],
             "module": self.__class__.__name__,
@@ -58,18 +63,21 @@ class IDStatusCache(IOSExtraction):
         for result in self.results:
             if result.get("user", "").startswith("mailto:"):
                 email = result["user"][7:].strip("'")
-                ioc = self.indicators.check_email(email)
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                ioc_match = self.indicators.check_email(email)
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.critical(
+                        self.get_slug(), ioc_match.message, "", result
+                    )
                     continue
 
             if "\\x00\\x00" in result.get("user", ""):
-                self.log.warning(
-                    "Found an ID Status Cache entry with suspicious patterns: %s",
-                    result.get("user"),
+                self.alertstore.high(
+                    self.get_slug(),
+                    f"Found an ID Status Cache entry with suspicious patterns: {result.get('user')}",
+                    "",
+                    result,
                 )
-                self.detected.append(result)
 
     def _extract_idstatuscache_entries(self, file_path):
         with open(file_path, "rb") as handle:

src/mvt/ios/modules/mixed/interactionc.py

@@ -5,9 +5,14 @@
 
 import logging
 import sqlite3
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_mactime_to_iso
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+    ModuleResults,
+)
 
 from ..base import IOSExtraction
 
@@ -223,7 +228,7 @@ class InteractionC(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -247,7 +252,7 @@ class InteractionC(IOSExtraction):
             "last_outgoing_recipient_date",
         ]
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
         processed = []
         for timestamp in self.timestamps:

src/mvt/ios/modules/mixed/locationd.py

@@ -6,9 +6,14 @@
 import base64
 import logging
 import plistlib
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_mactime_to_iso
+from mvt.common.module_types import (
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+    ModuleResults,
+)
 
 from ..base import IOSExtraction
 
@@ -31,7 +36,7 @@ class LocationdClients(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -54,7 +59,7 @@ class LocationdClients(IOSExtraction):
             "BeaconRegionTimeStopped",
         ]
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         records = []
         for timestamp in self.timestamps:
             if timestamp in record.keys():
@@ -77,59 +82,71 @@ class LocationdClients(IOSExtraction):
             parts = result["package"].split("/")
             proc_name = parts[len(parts) - 1]
 
-            ioc = self.indicators.check_process(proc_name)
-            if ioc:
-                self.log.warning(
-                    "Found a suspicious process name in LocationD entry %s",
-                    result["package"],
+            ioc_match = self.indicators.check_process(proc_name)
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.high(
+                    self.get_slug(),
+                    f"Found a suspicious process name in LocationD entry {result['package']}",
+                    "",
+                    result,
                 )
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+                self.alertstore.log_latest()
                 continue
 
             if "BundleId" in result:
-                ioc = self.indicators.check_process(result["BundleId"])
-                if ioc:
-                    self.log.warning(
-                        "Found a suspicious process name in LocationD entry %s",
-                        result["package"],
+                ioc_match = self.indicators.check_process(result["BundleId"])
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.high(
+                        self.get_slug(),
+                        f"Found a suspicious process name in LocationD entry {result['package']}",
+                        "",
+                        result,
                     )
-                    result["matched_indicator"] = ioc
+                    self.alertstore.log_latest()
 
             if "BundlePath" in result:
-                ioc = self.indicators.check_file_path(result["BundlePath"])
-                if ioc:
-                    self.log.warning(
-                        "Found a suspicious file path in Location D: %s",
-                        result["BundlePath"],
+                ioc_match = self.indicators.check_file_path(result["BundlePath"])
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.high(
+                        self.get_slug(),
+                        f"Found a suspicious file path in LocationD entry {result['BundlePath']}",
+                        "",
+                        result,
                     )
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                    self.alertstore.log_latest()
                     continue
 
             if "Executable" in result:
-                ioc = self.indicators.check_file_path(result["Executable"])
-                if ioc:
-                    self.log.warning(
-                        "Found a suspicious file path in Location D: %s",
-                        result["Executable"],
+                ioc_match = self.indicators.check_file_path(result["Executable"])
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.high(
+                        self.get_slug(),
+                        f"Found a suspicious file path in LocationD entry {result['Executable']}",
+                        "",
+                        result,
                     )
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                    self.alertstore.log_latest()
                     continue
 
             if "Registered" in result:
                 # Sometimes registered is a bool
                 if isinstance(result["Registered"], bool):
                     continue
-                ioc = self.indicators.check_file_path(result["Registered"])
-                if ioc:
-                    self.log.warning(
-                        "Found a suspicious file path in Location D: %s",
-                        result["Registered"],
+
+                ioc_match = self.indicators.check_file_path(result["Registered"])
+                if ioc_match:
+                    result["matched_indicator"] = ioc_match.ioc
+                    self.alertstore.high(
+                        self.get_slug(),
+                        f"Found a suspicious file path in LocationD entry {result['Registered']}",
+                        "",
+                        result,
                     )
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
+                    self.alertstore.log_latest()
                     continue
 
     def _extract_locationd_entries(self, file_path):

src/mvt/ios/modules/mixed/net_datausage.py

@@ -6,6 +6,7 @@
 import logging
 from typing import Optional
 
+from mvt.common.module_types import ModuleResults
 from ..net_base import NetBase
 
 DATAUSAGE_BACKUP_IDS = [
@@ -30,7 +31,7 @@ class Datausage(NetBase):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,

src/mvt/ios/modules/mixed/osanalytics_addaily.py

@@ -5,9 +5,14 @@
 
 import logging
 import plistlib
-from typing import Optional, Union
+from typing import Optional
 
 from mvt.common.utils import convert_datetime_to_iso
+from mvt.common.module_types import (
+    ModuleResults,
+    ModuleAtomicResult,
+    ModuleSerializedResult,
+)
 
 from ..base import IOSExtraction
 
@@ -30,7 +35,7 @@ class OSAnalyticsADDaily(IOSExtraction):
         results_path: Optional[str] = None,
         module_options: Optional[dict] = None,
         log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
+        results: ModuleResults = [],
     ) -> None:
         super().__init__(
             file_path=file_path,
@@ -41,7 +46,7 @@ class OSAnalyticsADDaily(IOSExtraction):
             results=results,
         )
 
-    def serialize(self, record: dict) -> Union[dict, list]:
+    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
         return {
             "timestamp": record["ts"],
             "module": self.__class__.__name__,
@@ -57,10 +62,10 @@ class OSAnalyticsADDaily(IOSExtraction):
             return
 
         for result in self.results:
-            ioc = self.indicators.check_process(result["package"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
+            ioc_match = self.indicators.check_process(result["package"])
+            if ioc_match:
+                result["matched_indicator"] = ioc_match.ioc
+                self.alertstore.critical(self.get_slug(), ioc_match.message, "", result)
 
     def run(self) -> None:
         self._find_ios_database(