def __init__(self, verbose):
"""Initialize the base artifact collector object.
Args:
verbose (Optional[bool]): whether verbose output is desired.
"""
super(BaseCollector, self).__init__()
self.console_out = timewolf_utils.TimewolfConsoleOutput(
sender=self.__class__.__name__, verbose=verbose)
self.results = []
u'Comma separated list of usernames to approve GRR _client access')
gflags.DEFINE_boolean(u'open_in_browser', False,
u'Open the resulting sketch in a browser window')
gflags.DEFINE_integer(u'sketch_id', None, u'Timesketch sketch to append to')
gflags.DEFINE_boolean(u'verbose', False, u'Show extended output')
gflags.DEFINE_string(u'username', None, u'GRR/Timesketch username')
def main(argv):
"""Timewolf tool."""
try:
_ = FLAGS(argv) # parse flags
except gflags.FlagsError, e:
sys.exit(e)
# Console output helper
console_out = timewolf_utils.TimewolfConsoleOutput(
sender=u'TimewolfCli', verbose=FLAGS.verbose)
if not (FLAGS.paths or FLAGS.hosts or FLAGS.hunt_id):
console_out.StdErr(u'paths or hosts must be specified', die=True)
ts_host = re.search(r'://(\S+):\d+', FLAGS.timesketch_server_url).group(1)
username, password = timewolf_utils.GetCredentials(FLAGS.username, ts_host)
timesketch_api = timesketch_utils.TimesketchApiClient(
FLAGS.timesketch_server_url, username, password)
grr_host = re.search(r'://(\S+):\d+', FLAGS.grr_server_url).group(1)
username, password = timewolf_utils.GetCredentials(FLAGS.username, grr_host)
# Collect artifacts
try:
FLAGS = gflags.FLAGS
gflags.DEFINE_string(u'path', None, u'Path to artifacts to process')
gflags.DEFINE_string(u'name', None, u'Name the timeline')
gflags.DEFINE_string(u'timezone', None, u'Timezone to use for Plaso processing')
gflags.DEFINE_boolean(u'verbose', False, u'Show extended output')
def main(argv):
"""Timewolf process tool."""
try:
_ = FLAGS(argv) # parse flags
except gflags.FlagsError, e:
sys.exit(e)
# Console output helper
console_out = utils.TimewolfConsoleOutput(
sender=u'TimewolfProcessCli', verbose=FLAGS.verbose)
if FLAGS.path:
# Collect the artifacts with the filesystem collector
collector = collectors.FilesystemCollector(FLAGS.path, FLAGS.name,
FLAGS.verbose)
collected_artifacts = [(collector.Collect(), collector.collection_name)]
else:
# Read from stdin, expects space delimited lines with path and name
collected_artifacts = ((path, name) for path, name in utils.ReadFromStdin())
# Process the artifacts
if FLAGS.timezone:
if not utils.IsValidTimezone(FLAGS.timezone):
console_out.StdErr(u'Unknown timezone', die=True)
def __init__(self, verbose):
super(BaseArtifactProcessor, self).__init__()
self.console_out = utils.TimewolfConsoleOutput(
sender=self.__class__.__name__, verbose=verbose)