Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add intelligence command to the CLI client #2864

Merged
merged 11 commits into from
Oct 4, 2023

Conversation

jaegeral
Copy link
Collaborator

@jaegeral jaegeral commented Aug 9, 2023

This pull requests adds a new command int he Timesketch CLI called intelligence.

timesketch intelligence -h
Usage: timesketch intelligence [OPTIONS] COMMAND [ARGS]...

  Manage intelligence within a sketch.

Options:
  -h, --help  Show this message and exit.

Commands:
  add   Add intelligence to a sketch.
  list  List all intelligence.

Add an ioc:

timesketch intelligence add -h
Usage: timesketch intelligence add [OPTIONS]

  Add intelligence to a sketch.

  A sketch can have multiple intelligence entries. Each entry consists of an
  indicator, a type and a list of tags.

  Reference: https://timesketch.org/guides/user/intelligence/

  Args:     ctx: Click context object.     ioc: IOC value.     inteltype: Type of
  the intelligence. This is defined in the ontology file.         If a string
  doesn't match any of the aforementioned IOC types,         the type will
  fall back to other.     tags: Comma separated list of tags.

Options:
  --ioc TEXT   IOC value.  [required]
  --inteltype TEXT  Type of the intelligence.
  --tags TEXT  Comma separated list of tags.
  -h, --help   Show this message and exit.

Example:

timesketch --sketch 2  intelligence add --ioc 8.8.4.6 --inteltype ipv4
Intelligence added: 8.8.4.6

List intelligence:

timesketch intelligence list -h
Usage: timesketch intelligence list [OPTIONS]

  List all intelligence.

  Args:     ctx: Click context object.     header: Include header in output.
  (default is to show header)     columns: Comma separated list of columns to
  show. (default: ioc,type)             Other options: externalURI, tags

Options:
  --header / --no-header  Include header in output. (default is to show
                          header))
  --columns TEXT          Comma separated list of columns to show. (default:
                          ioc,type)
  -h, --help              Show this message and exit.

Example:

timesketch --sketch 2 --output-format json intelligence list
[
    {
        "ioc": "8.8.4.6",
        "tags": [],
        "type": "ipv4"
    }
]

Or as csv:

timesketch --sketch 2 --output-format csv intelligence list --columns "ioc,tags,type"

ioc,tags,type
8.8.4.6,"",ipv4

As text:

timesketch --sketch 2 --output-format text intelligence list --columns "ioc,tags,type"
ioc	tags	type
8.8.4.6		ipv4

It also adds relevant portions to the documentation.

@jaegeral jaegeral marked this pull request as ready for review August 9, 2023 14:56
@jaegeral
Copy link
Collaborator Author

jaegeral commented Aug 9, 2023

This should be read for a first round of reviews. As with the attributes, we will not burry it in the sketch sub command as more or less everything has to do with a sketch. While in theory you could get anything in this PR done with the already existing timesketch attributes command group, the nesting etc make it hard to add IOCs and especially the listing of IOCs can be more specific that way (IMHO).

@jaegeral jaegeral requested a review from tomchop August 9, 2023 14:58
@berggren berggren self-requested a review September 7, 2023 08:17
@berggren berggren changed the title [CLI] adding a intelligence sub command to the Timesketch CLI + documentation Add intelligence command to the CLI client Sep 7, 2023
@berggren berggren self-assigned this Sep 7, 2023
@jaegeral jaegeral merged commit 84865e3 into google:master Oct 4, 2023
24 checks passed
@jaegeral jaegeral deleted the 2023-05-15_cli_intelligence branch October 4, 2023 14:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants