Warning This Repository has been moved to https://github.com/janstarke/dfir-toolkit
You can install the tools by running
cargo install dfir-toolkit
This crates provides structs and functions to insert timeline data into an elasticsearch index.
Usage: es4forensics [OPTIONS] --index <INDEX_NAME> --password <PASSWORD> <COMMAND>
Commands:
create-index
import
help Print this message or the help of the given subcommand(s)
Options:
-v, --verbose... More output per occurrence
-q, --quiet... Less output per occurrence
--strict strict mode: do not only warn, but abort if an error occurs
-I, --index <INDEX_NAME> name of the elasticsearch index
-H, --host <HOST> server name or IP address of elasticsearch server [default: localhost]
-P, --port <PORT> API port number of elasticsearch server [default: 9200]
--proto <PROTOCOL> protocol to be used to connect to elasticsearch [default: https] [possible values: http, https]
-k, --insecure omit certificate validation
-U, --username <USERNAME> username for elasticsearch server [default: elastic]
-W, --password <PASSWORD> password for authenticating at elasticsearch
-h, --help Print help information
-V, --version Print version information
use es4forensics::IndexBuilder;
use es4forensics::WithHost;
use elasticsearch::auth::Credentials;
let username = "elastic";
let password = "elastic";
let credentials = Credentials::Basic(username.to_string(), password.to_string());
let mut index = IndexBuilder::with_name("elastic4forensics_test".to_string())
.with_host("127.0.0.1")
.with_port(9200)
.without_certificate_validation()
.with_credentials(credentials)
.create_index().await;
After doing this, you can easily add documents to the index using [Index::add_timeline_object
]
For example, consider we have a line from a bodyfile. We need to convert this
into a [ecs::objects::PosixFile
]-Object, which can then be added to an Index:
use es4forensics::objects::PosixFile;
let str_line = "0|/Users/Administrator ($FILE_NAME)|93552-48-2|d/drwxrwxrwx|0|0|92|1577092511|1577092511|1577092511|-1";
let posix_file: PosixFile = str_line.try_into().unwrap();
index.add_timeline_object(posix_file);
Sometimes you might want to simply export your documents, instead of directly importing them into elasticsearch.
Keep in mind that one bodyfile line might contain multiple different timestamps (up to four),
which yields up to four elasticsearch documents. Therefore, [ecs::objects::ElasticObject::documents()
] returns an
iterator over [serde_json::Value
]
use es4forensics::objects::PosixFile;
use es4forensics::Timestamp;
use crate::es4forensics::TimelineObject;
use serde_json::Value;
let str_line = "0|/Users/Administrator ($FILE_NAME)|93552-48-2|d/drwxrwxrwx|0|0|92|1577092511|1577092511|1577092511|-1";
let posix_file: PosixFile = str_line.try_into().unwrap();
for json_value in posix_file.into_values() {
println!("{json_value}");
}
License: GPL-3.0