Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Corresponding timeline option for directory input #145

Merged
merged 9 commits into from
Mar 29, 2024
Merged

Corresponding timeline option for directory input #145

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
ee7ab07
feat: adjusted directory input in timeline option #133
hitenkoku Mar 23, 2024
82cd2c8
test(testsubmodule): due to changed getTargetExtFileLists function ar…
hitenkoku Mar 23, 2024
fc4bf60
fix(general): fixed checkArgs quit condition #133
hitenkoku Mar 26, 2024
1c02961
fix(general): modified to adapt directory path #133
hitenkoku Mar 26, 2024
b816f9c
fix: fixed overwrite result file when timeline option is directory #133
hitenkoku Mar 28, 2024
2251ac0
fix: fixed bug split-csv-timeline caused by directory processing #133
hitenkoku Mar 28, 2024
1741ef5
fix: fixed bug caused by selected wrong extension #133
hitenkoku Mar 28, 2024
636cbcd
updated changelog
YamatoSecurity Mar 29, 2024
5c2dd77
update wording
YamatoSecurity Mar 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG-Japanese.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
- `stack-computers`コマンド: `Computer`(デフォルト)または`SrcComp`フィールドのスタック分析をしながら、アラート情報も提供する。(#125) (@fukusuket)
- `stack-ip-addresses`コマンド: `SrcIP`(デフォルト)または`TgtIP`フィールドのスタック分析をしながら、アラート情報も提供する。(#129) (@fukusuket)
- `stack-users`コマンド: `TgtUser`(デフォルト)または`SrcUser`フィールドのスタック分析をしながら、アラート情報も提供する。(#130) (@fukusuket)
- スキャン時に複数の`.jsonl`ファイルが入っているディレクトリを指定できるようになった。 #133 (@hitenkoku)

**改善:**

Expand Down
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
- `stack-computers` command: stack the `Computer` (default) or `SrcComp` fields as well as provide alert information. (#125) (@fukusuket)
- `stack-ip-addresses` command: stack the `SrcIP` (default) or `TgtIP` fields as well as provide alert information. (#129) (@fukusuket)
- `stack-users` command: stack the `TgtUser` (default) or `SrcUser` fields as well as provide alert information. (#130) (@fukusuket)
- You can now specify a directory of `.jsonl` files to scan. #133 (@hitenkoku)

**Enhancements:**

Expand Down
10 changes: 5 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ Takajō means ["Falconer"](https://en.wikipedia.org/wiki/Falconry) in Japanese a
- [`ttp-visualize` command examples](#ttp-visualize-command-examples)
- [`ttp-visualize` screenshot](#ttp-visualize-screenshot)
- [`ttp-visualize-sigma` command](#ttp-visualize-sigma-command)
- [`ttp-visualize-simga` command examples](#ttp-visualize-sigma-command-examples)
- [`ttp-visualize-sigma` command examples](#ttp-visualize-sigma-command-examples)
- [VirusTotal Commands](#virustotal-commands-1)
- [`vt-domain-lookup` command](#vt-domain-lookup-command)
- [`vt-domain-lookup` command examples](#vt-domain-lookup-command-examples)
Expand Down Expand Up @@ -212,7 +212,7 @@ Extracts and reassemles PowerShell EID 4104 script block logs.

Required options:

- `-t, --timeline <JSONL-FILE>`: Hayabusa JSONL timeline
- `-t, --timeline <JSONL-FILE>`: Hayabusa JSONL timeline file or directory

Options:

Expand Down Expand Up @@ -252,7 +252,7 @@ Currently it will only check queried domains in Sysmon EID 22 logs but will be u
Required options:

- `-o, --output <TXT-FILE>`: save results to a text file.
- `-t, --timeline <JSONL-FILE>`: Hayabusa JSONL timeline.
- `-t, --timeline <JSONL-FILE>`: Hayabusa JSONL timeline file or directory.

Options:

Expand Down Expand Up @@ -326,7 +326,7 @@ It will extract the `TgtIP` fields for target IP addresses and `SrcIP` fields fo
Required options:

- `-o, --output <TXT-FILE>`: save results to a text file.
- `-t, --timeline <JSONL-FILE>`: Hayabusa JSONL timeline.
- `-t, --timeline <JSONL-FILE>`: Hayabusa JSONL timeline file or directory.

Options:

Expand Down Expand Up @@ -496,7 +496,7 @@ Split up a large JSONL timeline into smaller ones based on the computer name.

Required options:

- `-t, --timeline <JSONL-FILE>`: Hayabusa JSONL timeline.
- `-t, --timeline <JSONL-FILE>`: Hayabusa JSONL timeline file or directory.

Options:

Expand Down
44 changes: 22 additions & 22 deletions src/takajo.nim
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ when isMainModule:
"displayTable": "display the result table",
"output": "output directory (default: scriptblock-logs)",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any)",
}
],
[
Expand All @@ -125,7 +125,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "output directory (default: scriptblock-logs)",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any)",
}
],
[
Expand All @@ -137,7 +137,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a text file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
},
short = {
"includeSubdomains": 'd',
Expand All @@ -152,7 +152,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "specify the base name to save results to text files (ex: -o case-1)",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
}
],
[
Expand All @@ -165,7 +165,7 @@ when isMainModule:
"output": "save results to a text file",
"privateIp": "include private IP addresses",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
},
short = {
"output": 'o',
Expand Down Expand Up @@ -210,7 +210,7 @@ when isMainModule:
help = {
"output": "output directory (default: output)",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any)",
}
],
[
Expand All @@ -222,7 +222,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
},
short = {
"sourceComputers": 'c'
Expand All @@ -238,7 +238,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
},
short = {
"ignoreSysmon": 'y',
Expand All @@ -253,7 +253,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
}
],
[
Expand All @@ -265,7 +265,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any)",
},
short = {
"targetIpAddresses": 'a'
Expand All @@ -279,7 +279,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
}
],
[
Expand All @@ -292,7 +292,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
},
short = {
"ignoreSysmon": 'y',
Expand All @@ -307,7 +307,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
},
short = {
"ignoreSystem": 'y',
Expand All @@ -322,7 +322,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
}
],
[
Expand All @@ -336,7 +336,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any)",
},
short = {
"filterComputerAccounts": 'c',
Expand All @@ -350,7 +350,7 @@ when isMainModule:
"output": "save results to a text file",
"processGuid": "sysmon process GUID",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
}
],
[
Expand All @@ -363,7 +363,7 @@ when isMainModule:
"outputLogoffEvents": "output logoff events as separate entries",
"skipProgressBar": "do not display the progress bar",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
},
short = {
"outputLogoffEvents": 'l',
Expand All @@ -377,7 +377,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any)",
}
],
[
Expand All @@ -388,7 +388,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any besides all-field-info*)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any besides all-field-info*)",
}
],
[
Expand All @@ -398,7 +398,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a CSV file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any)",
}
],
[
Expand All @@ -408,7 +408,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a csv file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any verbose profile)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any verbose profile)",
}
],
[
Expand All @@ -418,7 +418,7 @@ when isMainModule:
"skipProgressBar": "do not display the progress bar",
"output": "save results to a json file",
"quiet": "do not display the launch banner",
"timeline": "Hayabusa JSONL timeline (profile: any verbose profile)",
"timeline": "Hayabusa JSONL timeline file or directory (profile: any verbose profile)",
}
],
[
Expand Down
Loading
Loading