google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.58k stars 589 forks source link

Manage sketch attributes in the CLI client #2841

Closed jaegeral closed 1 year ago

jaegeral commented 1 year ago

This PR:

These attributes are e.g. used to store intelligence, but can also be used to store ticket ids etc.

The new list attributes has list, add and remove commands allow you to manage attributes in Timesketch.

For more information on these commands, please see the timesketch-cli documentation changed with this PR.

Some examples:

timesketch --sketch 2 sketch attributes list
{'intelligence': {'ontology': 'intelligence', 'value': {'data': [{'externalURI': 'google.com', 'ioc': '1.2.3.4', 'tags': ['foo'], 'type': 'ipv4'}, {'externalURI': 'fobar.com', 'ioc': '3.3.3.3', 'tags': ['aaaa'], 'type': 'ipv4'}]}}, 'ticket_id': {'ontology': '12345', 'value': 'text'}}
timesketch --sketch 2 sketch attributes add --name ticket_id2 --ontology text --value 12345
Attribute added: ticket_id2 text 12345

Another example:

timesketch --sketch 2 --output-format json sketch attributes list | jq '.'
{
  "intelligence": {
    "ontology": "intelligence",
    "value": {
      "data": [
        {
          "externalURI": "google.com",
          "ioc": "1.2.3.4",
          "tags": [
            "foo"
          ],
          "type": "ipv4"
        },
        {
          "externalURI": "fobar.com",
          "ioc": "3.3.3.3",
          "tags": [
            "aaaa"
          ],
          "type": "ipv4"
        }
      ]
    }
  },
  "ticket_id": {
    "ontology": "12345",
    "value": "text"
  },
  "ticket_id2": {
    "ontology": "12345",
    "value": "text"
  },
  "ticket_id3": {
    "ontology": "12345",
    "value": "text"
  }
}