log2timeline / dftimewolf

A framework for orchestrating forensic collection, processing and data export
Apache License 2.0
296 stars 72 forks source link

Add support for downloading osquery results with GrrFlowCollector #907

Closed sydp closed 3 months ago

sydp commented 3 months ago

Fixes #755

In addition, GRR "chunks" osquery results [0] which when being retrieved, results in multiple OsqueryResult payloads and subsequently multiple dataframes/CSVs. This PR changes the behaviour in GRROsqueryCollector and GRRHuntOsqueryDownloader to merge results into a single dataframe (as with the new method in GrrFlowCollector)

[0] https://github.com/google/grr/blob/master/grr/client/grr_response_client/client_actions/osquery.py#L81