google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.58k stars 589 forks source link

Support overriding/extending Plaso formatter definitions #2881

Closed berggren closed 1 year ago

berggren commented 1 year ago

Plaso has a new feature where it is possible to provide your own formatter definition file that will override/extend the build in formatters. This enable us to alter some message strings to better align with Timesketch UX goals.

For example: We can show Event Log message strings up front whenever they are available.

closes: #2880