Skip to content
This repository has been archived by the owner on Feb 6, 2024. It is now read-only.

janstarke/es4forensics

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

42 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Crates.io docs.rs Crates.io Crates.io (latest)

es4forensics

Warning This Repository has been moved to https://github.com/janstarke/dfir-toolkit

You can install the tools by running cargo install dfir-toolkit

This crates provides structs and functions to insert timeline data into an elasticsearch index.

CLI Usage

Usage: es4forensics [OPTIONS] --index <INDEX_NAME> --password <PASSWORD> <COMMAND>

Commands:
  create-index  
  import        
  help          Print this message or the help of the given subcommand(s)

Options:
  -v, --verbose...           More output per occurrence
  -q, --quiet...             Less output per occurrence
      --strict               strict mode: do not only warn, but abort if an error occurs
  -I, --index <INDEX_NAME>   name of the elasticsearch index
  -H, --host <HOST>          server name or IP address of elasticsearch server [default: localhost]
  -P, --port <PORT>          API port number of elasticsearch server [default: 9200]
      --proto <PROTOCOL>     protocol to be used to connect to elasticsearch [default: https] [possible values: http, https]
  -k, --insecure             omit certificate validation
  -U, --username <USERNAME>  username for elasticsearch server [default: elastic]
  -W, --password <PASSWORD>  password for authenticating at elasticsearch
  -h, --help                 Print help information
  -V, --version              Print version information

Creating Indices

use es4forensics::IndexBuilder;
use es4forensics::WithHost;
use elasticsearch::auth::Credentials;

let username = "elastic";
let password = "elastic";
let credentials = Credentials::Basic(username.to_string(), password.to_string());
let mut index = IndexBuilder::with_name("elastic4forensics_test".to_string())
    .with_host("127.0.0.1")
    .with_port(9200)
    .without_certificate_validation()
    .with_credentials(credentials)
    .create_index().await;

After doing this, you can easily add documents to the index using [Index::add_timeline_object]

Adding documents to elasticsearch

For example, consider we have a line from a bodyfile. We need to convert this into a [ecs::objects::PosixFile]-Object, which can then be added to an Index:

use es4forensics::objects::PosixFile;

let str_line = "0|/Users/Administrator ($FILE_NAME)|93552-48-2|d/drwxrwxrwx|0|0|92|1577092511|1577092511|1577092511|-1";
let posix_file: PosixFile = str_line.try_into().unwrap();

index.add_timeline_object(posix_file);

Exporting documents in JSON format

Sometimes you might want to simply export your documents, instead of directly importing them into elasticsearch.

Keep in mind that one bodyfile line might contain multiple different timestamps (up to four), which yields up to four elasticsearch documents. Therefore, [ecs::objects::ElasticObject::documents()] returns an iterator over [serde_json::Value]

use es4forensics::objects::PosixFile;
use es4forensics::Timestamp;
use crate::es4forensics::TimelineObject;
use serde_json::Value;

let str_line = "0|/Users/Administrator ($FILE_NAME)|93552-48-2|d/drwxrwxrwx|0|0|92|1577092511|1577092511|1577092511|-1";
let posix_file: PosixFile = str_line.try_into().unwrap();

for json_value in posix_file.into_values() {
    println!("{json_value}");
}

License: GPL-3.0