search

Security-Onion-Solutions / securityonion-capme

11 stars 9 forks source link

Convert date/time to epoch timestamp::Search records with date/time in CapMe #11

Closed weslambert closed 8 years ago

weslambert commented 8 years ago

Reference: https://groups.google.com/forum/#!topic/security-onion/7kB8tA0andU

I was researching the ability to allow manual search for transcripts via a more traditional date/time format.

I took a look at /var/www/so/capme/.js/capme.js and added some lines of JavaScript to convert the date/time (Ex. 2016/02/11 10:01:34) to an epoch timestamp to be used for the backend lookup (Ex. 1455184894) .

I have been able to successfully use the date/time (using known timespans) to access transcripts, and it has not yet impacted normal operation.

To clarify, this has been tested through navigating directly to CapMe and entering the date/time value(s), and does not convert the values presented to CapMe by ELSA, which I'm not sure would be necessary right now.

I would like to possibly include toggle functionality for the start/end time if you think it would be beneficial.

weslambert commented 8 years ago

Updated capme.js and index.php to include toggling between epoch and human-readable date/time. Will update the branch with the changes when I get chance.