Skip to content

TimesketchExporter wait_for_timelines parameter #993

@elad-levi-cyberark

Description

@elad-levi-cyberark

The wait_for_timelines option in the plaso_ts recipe is implemented as a boolean flag rather than a parameter that accepts true or false. Because its default is hard-coded to true in the recipe, you can’t turn it off from the command line—you’d have to edit the recipe itself. I’d like to be able to override it via parameters so all my configuration stays outside the recipe.

usage: dftimewolf plaso_ts [-h] [--analyzers ANALYZERS] [--incident_id INCIDENT_ID] [--sketch_id SKETCH_ID] [--timesketch_endpoint TIMESKETCH_ENDPOINT]
                           [--timesketch_username TIMESKETCH_USERNAME] [--timesketch_password TIMESKETCH_PASSWORD] [--token_password TOKEN_PASSWORD]
                           [--wait_for_timelines]
                           paths

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions