Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Intelligence subcommand in timesketch CLI #2752

Closed
jaegeral opened this issue May 15, 2023 · 1 comment
Closed

Intelligence subcommand in timesketch CLI #2752

jaegeral opened this issue May 15, 2023 · 1 comment

Comments

@jaegeral
Copy link
Collaborator

jaegeral commented May 15, 2023

Name: Intelligence subcommand

Description: A new subcommand in the Timesketch CLI client that allows users to display and add indicators to a sketch.
Benefits:
This subcommand would make it easier for users to identify and track indicators of compromise (IOCs) in their investigations.
It would also allow users to quickly and easily add IOCs to their sketches, which could help them to identify related incidents and threats.

Use cases:
This subcommand could be used by security analysts to identify and track IOCs in their investigations.
It could also be used by incident responders to quickly and easily add IOCs to their sketches, which could help them to identify related incidents and threats.

Implementation:
This subcommand could be implemented by adding a new command to the Timesketch CLI client.
The command would take a sketch name as an argument and would display a list of all indicators associated with the sketch.
The command would also allow users to add new indicators to the sketch.

Some example calls

timesketch intelligence list
timesketch intelligence add --ioc 127.0.0.1 --type ipv4 --tags foobar,localhost,suspicious
timesketch intelligence remove --ioc 127.0.0.1

@jaegeral jaegeral added this to the Q3 milestone May 15, 2023
@jaegeral jaegeral changed the title Have a "intelligence" command in CLI Intelligence subcommand in timesketch CLI May 15, 2023
@jaegeral
Copy link
Collaborator Author

#2864

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant