google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.62k stars 589 forks source link

Add intelligence command to the CLI client #2864

Closed jaegeral closed 1 year ago

jaegeral commented 1 year ago

This pull requests adds a new command int he Timesketch CLI called intelligence.

timesketch intelligence -h
Usage: timesketch intelligence [OPTIONS] COMMAND [ARGS]...

  Manage intelligence within a sketch.

Options:
  -h, --help  Show this message and exit.

Commands:
  add   Add intelligence to a sketch.
  list  List all intelligence.

Add an ioc:

timesketch intelligence add -h
Usage: timesketch intelligence add [OPTIONS]

  Add intelligence to a sketch.

  A sketch can have multiple intelligence entries. Each entry consists of an
  indicator, a type and a list of tags.

  Reference: https://timesketch.org/guides/user/intelligence/

  Args:     ctx: Click context object.     ioc: IOC value.     inteltype: Type of
  the intelligence. This is defined in the ontology file.         If a string
  doesn't match any of the aforementioned IOC types,         the type will
  fall back to other.     tags: Comma separated list of tags.

Options:
  --ioc TEXT   IOC value.  [required]
  --inteltype TEXT  Type of the intelligence.
  --tags TEXT  Comma separated list of tags.
  -h, --help   Show this message and exit.

Example:

timesketch --sketch 2  intelligence add --ioc 8.8.4.6 --inteltype ipv4
Intelligence added: 8.8.4.6

List intelligence:

timesketch intelligence list -h
Usage: timesketch intelligence list [OPTIONS]

  List all intelligence.

  Args:     ctx: Click context object.     header: Include header in output.
  (default is to show header)     columns: Comma separated list of columns to
  show. (default: ioc,type)             Other options: externalURI, tags

Options:
  --header / --no-header  Include header in output. (default is to show
                          header))
  --columns TEXT          Comma separated list of columns to show. (default:
                          ioc,type)
  -h, --help              Show this message and exit.

Example:

timesketch --sketch 2 --output-format json intelligence list
[
    {
        "ioc": "8.8.4.6",
        "tags": [],
        "type": "ipv4"
    }
]

Or as csv:

timesketch --sketch 2 --output-format csv intelligence list --columns "ioc,tags,type"

ioc,tags,type
8.8.4.6,"",ipv4

As text:

timesketch --sketch 2 --output-format text intelligence list --columns "ioc,tags,type"
ioc tags    type
8.8.4.6     ipv4

It also adds relevant portions to the documentation.

jaegeral commented 1 year ago

This should be read for a first round of reviews. As with the attributes, we will not burry it in the sketch sub command as more or less everything has to do with a sketch. While in theory you could get anything in this PR done with the already existing timesketch attributes command group, the nesting etc make it hard to add IOCs and especially the listing of IOCs can be more specific that way (IMHO).