--timeline-offset <OFFSET> option

[gs3cl]

Hey,

first off all what a fantastic tool and great presentation at SANS summit ! The timeline option start and end date is also quiet good during IR but it is possible to add also something like "--timeline-last-30days" or in general with an "X" for specific days
30,90 or 180 days based on experience.

I would then update my module for KAPE or add a new one
https://github.com/EricZimmerman/KapeFiles/blob/master/Modules/Apps/GitHub/Hayabusa/hayabusa_LiveResponse.mkape

Thanks in advance and please continue with more fantastic updates

Regards

[YamatoSecurity]

@gs3cl Thanks for the issue! Glad you enjoyed the presentation. I will talk to the other developers about this. It shouldn't be too difficult to implement but we also don't want to overload users with too many options.

[YamatoSecurity]

@hitenkoku What about implementing it as --timeline-last-days <NUMBER> Scan just the most recent number of days ?
I'd like to implement it for all commands that it is applicable to. (Not just csv-timeline and json-timeline but logon-summary, eid-metrics, pivot-keywords as well)

[YamatoSecurity]

@hitenkoku Sorry, I'd like to update this to --timeline-offset <OFFSET> Scan recent events based on an offset. (ex: 1y, 30d, 24h, etc..) instead.
1y for 1 year
3M for 3 months
30d for 30 days
24h for 24 hours
30m for 30 minutes

Sorry this might be a little more complex to implement but what do you think?

[gs3cl]

Thanks you are awesome!