Skip nested objects of Velociraptor records

[respondersGY]

The objects contain additional metadata that is not necessary to output as records. In addition, some of the dynamic (nested) objects result in conflicts with other plugins, which can't be determined beforehand depending on which artefacts are collected.

[Schamper]

I don't use Velociraptor so I can't measure the impact of this. Is there a lot of valuable metadata lost now? What's the recommended workflow to process that? Maybe make a note at least in the docstring.

[respondersGY]

From my experience the additional metadata does not contain useful data for most cases. For these edge cases the argument --extract has been added.

The workflow depends on the search platform that is used. I use Elasticsearch therefore I don't want to deal with nested dynamic objects.

[respondersGY]

@Schamper can you review the PR?

[Schamper]

@Schamper can you review the PR?

If you ask nicely.

[respondersGY]

@Schamper Can you please review the changes?

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.74%. Comparing base (a266fc5) to head (ab3076c).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1480      +/-   ##
==========================================
- Coverage   80.75%   80.74%   -0.02%     
==========================================
  Files         394      394              
  Lines       34644    34648       +4     
==========================================
- Hits        27977    27976       -1     
- Misses       6667     6672       +5     

Flag	Coverage Δ
unittests	80.74% <100.00%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[codspeed-hq]

CodSpeed Performance Report

Merging this PR will not alter performance

_{Comparing respondersGY:fix/dissect_velo_plugin (ab3076c) with main (a266fc5)}

Summary

✅ 11 untouched benchmarks