velociraptor
velociraptor copied to clipboard
FR: Add a timesketch pipeline artifact
We should be able to parse the output of Windows.KapeFiles.Targets
directly into elastic in a format that Time Sketch understands
Currently people do this via moving the bulk data to another system and using plaso to parse the same data - we need to make this process smoother and faster (and also somewhat officially supported so it doesn't break in future).
This is also a good opportunity to officially support Time Sketch and investigate how to feed it data in the best way - maybe we can add a standard Velociraptor uploader?