es4forensics

此 Crates 提供了将时间线数据插入到 elasticsearch 索引中的结构和函数。

CLI 使用

Usage: es4forensics [OPTIONS] --index <INDEX_NAME> --password <PASSWORD> <COMMAND>

Commands:
  create-index  
  import        
  help          Print this message or the help of the given subcommand(s)

Options:
  -v, --verbose...           More output per occurrence
  -q, --quiet...             Less output per occurrence
      --strict               strict mode: do not only warn, but abort if an error occurs
  -I, --index <INDEX_NAME>   name of the elasticsearch index
  -H, --host <HOST>          server name or IP address of elasticsearch server [default: localhost]
  -P, --port <PORT>          API port number of elasticsearch server [default: 9200]
      --proto <PROTOCOL>     protocol to be used to connect to elasticsearch [default: https] [possible values: http, https]
  -k, --insecure             omit certificate validation
  -U, --username <USERNAME>  username for elasticsearch server [default: elastic]
  -W, --password <PASSWORD>  password for authenticating at elasticsearch
  -h, --help                 Print help information
  -V, --version              Print version information

创建索引

use es4forensics::IndexBuilder;
use es4forensics::WithHost;
use elasticsearch::auth::Credentials;

let username = "elastic";
let password = "elastic";
let credentials = Credentials::Basic(username.to_string(), password.to_string());
let mut index = IndexBuilder::with_name("elastic4forensics_test".to_string())
    .with_host("127.0.0.1")
    .with_port(9200)
    .without_certificate_validation()
    .with_credentials(credentials)
    .create_index().await;

完成此操作后，您可以使用 Index::add_timeline_object 简单地添加文档到索引

将文档添加到 elasticsearch

例如，假设我们有一个来自 bodyfile 的行。我们需要将其转换为 ecs::objects::PosixFile-对象，然后可以将其添加到索引

use es4forensics::objects::PosixFile;

let str_line = "0|/Users/Administrator ($FILE_NAME)|93552-48-2|d/drwxrwxrwx|0|0|92|1577092511|1577092511|1577092511|-1";
let posix_file: PosixFile = str_line.try_into().unwrap();

index.add_timeline_object(posix_file);

以 JSON 格式导出文档

有时您可能只想导出文档，而不是直接将其导入到 elasticsearch。

请注意，一个 bodyfile 行可能包含多个不同的时间戳（多达四个），这将产生多达四个 elasticsearch 文档。因此，[ecs::objects::ElasticObject::documents()] 返回一个 serde_json::Value 迭代器

use es4forensics::objects::PosixFile;
use es4forensics::Timestamp;
use crate::es4forensics::TimelineObject;
use serde_json::Value;

let str_line = "0|/Users/Administrator ($FILE_NAME)|93552-48-2|d/drwxrwxrwx|0|0|92|1577092511|1577092511|1577092511|-1";
let posix_file: PosixFile = str_line.try_into().unwrap();

for json_value in posix_file.into_values() {
    println!("{json_value}");
}

许可证：GPL-3.0