search

google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.62k stars 589 forks source link

Add json and tab output to CLI client #2818

Closed jaegeral closed 1 year ago

jaegeral commented 1 year ago

Description

This pull request adds two new output formats to the timesketch analyze list analyzers module: JSON and tabular. The JSON format will output a list of analyzers in JSON format, while the tabular format will output a list of analyzers in a tabular format.

Changes

The following changes were made:

Added two new output formats to the timesketch analyze list analyzers module: JSON and tabular. Updated the documentation to reflect the new output formats.

How to test

To test the new output formats, run the following command:

timesketch analyze list analyzers --output json

This will output a list of analyzers in JSON format.

timesketch --sketch 1 analyze list --output-format json
[{'name': 'login', 'display_name': 'Windows logon/logoff events', 'description': 'Mark Windows logon and logoff events', 'is_multi': False}, {'name': 'ntfs_timestomp', 'display_name': 'NTFS timestomp detection', 'description': 'Compares timestamps in NTFS to detect potential timestomp', 'is_multi': False},
...

To run the new output formats in tabular format, run the following command:

timesketch analyze list analyzers --output tabular

This will output a list of analyzers in a tabular format.

timesketch --sketch 1 analyze list --output-format tabular
Name    Display Name    Is Multi
login   Windows logon/logoff events False
ntfs_timestomp  NTFS timestomp detection    False
chain   Chain linked events False
tagger  Tagger  True
ssh_sessionizer SSH sessions    False
...

To just get text (the default one):

timesketch --sketch 1 analyze list --output-format text
login
ntfs_timestomp
chain
tagger
ssh_sessionizer
sigma
...

Related to https://github.com/google/timesketch/issues/2608