search

google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.58k stars 589 forks source link

plaso import crashes when plaso_formatters.yaml is not present #2898

Open jkppr opened 1 year ago

jkppr commented 1 year ago

Describe the bug

@wajihyassine noticed in the osdfir-infrastructure#53 that timesketch cannot import any timelines from plaso files anymore when the newly introduced plaso_formatters.yaml is not present.

This is a bug. The expected behaviour would be to fallback to normal import without any plaso messaging formatting when the config is missing.

To Reproduce

  1. On a new timesketch setup, delete the data/plaso_formatters.yaml file.
  2. Start your instance.
  3. Try to import a plaso file.
  4. See error.