CSV export fails when results contain additional fields (ValueError: dict contains fields not in fieldnames)

## Environment - **OS**: Ubuntu 24.04.3 LTS - **Python version**: 3.12.3 - **Zircolite version**: 3.5.0 ## Steps to reproduce There’s an inconsistency between the JSON output (`-o out.json`) and CSV output (`--csv -o out.csv`). The root cause lies in the `_write_result_to_output` function in `zircolite/core.py` (around line 533). The CSV writer is initialized only once using the keys from the first result as the field names. However, later results coming from different rules may contain additional or different keys, leading to mismatches or missing data in the CSV. ## Expected behavior Zircolite runs without errors and produces consistent output. ## Actual behavior Zircolite throws the following error: ``` [+] Auto-detected log type: windows_evtx (evtx) - confidence: high [+] Auto-detected timestamp field: SystemTime [+] Database mode: UNIFIED (forced) [+] Loading all 277 file(s) into a single unified database [+] Processing events (streaming mode) [+] Creating dynamic model [+] Creating indexes [+] Total events processed: 31,170 (6,187 events filtered out) [+] Executing ruleset against unified database (31,170 events) - 22 rules Traceback (most recent call last): File "/home/lab/Desktop/Zircolite/zircolite.py", line 1269, in <module> main() File "/home/lab/Desktop/Zircolite/zircolite.py", line 1212, in main _run_processing(ctx, args, logger, memory_tracker) File "/home/lab/Desktop/Zircolite/zircolite.py", line 988, in _run_processing zircolite_core, all_results = process_unified_streaming( ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/lab/Desktop/Zircolite/zircolite/processing.py", line 291, in process_unified_streaming zircolite_core.execute_ruleset( File "/home/lab/Desktop/Zircolite/zircolite/core.py", line 706, in execute_ruleset csv_writer, needs_comma_prefix = self._write_result_to_output( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/lab/Desktop/Zircolite/zircolite/core.py", line 533, in _write_result_to_output csv_writer.writerow(dict_csv) File "/usr/lib/python3.12/csv.py", line 164, in writerow return self.writer.writerow(self._dict_to_list(rowdict)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/csv.py", line 159, in _dict_to_list raise ValueError("dict contains fields not in fieldnames: " ValueError: dict contains fields not in fieldnames: 'PrivilegeList' ``` ## Suggested Patch: ```python # In core.py where DictWriter is constructed, change: csv_writer = csv.DictWriter(f, fieldnames=fieldnames) # To: csv_writer = csv.DictWriter(f, fieldnames=fieldnames, extrasaction='ignore') ```