Closed jaegeral closed 1 year ago
This PR:
timesketch sketch attributes
timesketch sketch describe
These attributes are e.g. used to store intelligence, but can also be used to store ticket ids etc.
The new list attributes has list, add and remove commands allow you to manage attributes in Timesketch.
attributes
list
add
remove
The attributes command lists all of the attributes related commands in Timesketch.
The list command lists all attributes in a sketch
The add command adds a new attribute to Timesketch.
The remove command removes an existing attribute from Timesketch.
[x] Make it clear if an output format is not implemented
For more information on these commands, please see the timesketch-cli documentation changed with this PR.
timesketch-cli
Some examples:
timesketch --sketch 2 sketch attributes list {'intelligence': {'ontology': 'intelligence', 'value': {'data': [{'externalURI': 'google.com', 'ioc': '1.2.3.4', 'tags': ['foo'], 'type': 'ipv4'}, {'externalURI': 'fobar.com', 'ioc': '3.3.3.3', 'tags': ['aaaa'], 'type': 'ipv4'}]}}, 'ticket_id': {'ontology': '12345', 'value': 'text'}}
timesketch --sketch 2 sketch attributes add --name ticket_id2 --ontology text --value 12345 Attribute added: ticket_id2 text 12345
Another example:
timesketch --sketch 2 --output-format json sketch attributes list | jq '.' { "intelligence": { "ontology": "intelligence", "value": { "data": [ { "externalURI": "google.com", "ioc": "1.2.3.4", "tags": [ "foo" ], "type": "ipv4" }, { "externalURI": "fobar.com", "ioc": "3.3.3.3", "tags": [ "aaaa" ], "type": "ipv4" } ] } }, "ticket_id": { "ontology": "12345", "value": "text" }, "ticket_id2": { "ontology": "12345", "value": "text" }, "ticket_id3": { "ontology": "12345", "value": "text" } }
This PR:
timesketch sketch attributes
.timesketch sketch describe
These attributes are e.g. used to store intelligence, but can also be used to store ticket ids etc.
The new list
attributes
haslist
,add
andremove
commands allow you to manage attributes in Timesketch.The
attributes
command lists all of the attributes related commands in Timesketch.The
list
command lists all attributes in a sketchThe
add
command adds a new attribute to Timesketch.The
remove
command removes an existing attribute from Timesketch.[x] Make it clear if an output format is not implemented
For more information on these commands, please see the
timesketch-cli
documentation changed with this PR.Some examples:
Another example: