AllthingsTimesketch
AllthingsTimesketch copied to clipboard
blueteam0ps
Timesketch Import Fail
Hello and happy new year!
I seem to be having some issues with getting the import working for timesketch.
Some background of my configuration
System: Proxmox
OS: Ubuntu 20.04.06
Node-red: Setup via npm (bash <(curl -sL https://raw.githubusercontent.com/node-red/linux-installers/master/deb/update-nodejs-and-nodered). I tried the standard npm install but there were quite a few errors....
I also tried the docker version but couldnt work out how to give the Node-Red account access to the cases folder.
TimeSketch / Log2Timeline: Installed via the recommended tsplaso_docker_install.sh script
For the script there was an error for open search so I had to remove the following items.
These are the changes I made in Node Red
Triage Artefact Processor Flow
For the process variable should I leave it as localhost or put the IP that I use to access timesketch?
Also the kape output actually has the logs in /C/Windows/System32/winevt/logs. I see from slack it says its successful so I didnt amend the path.
For log2timeline I was not sure from the documentation what to change so I left it as is.
Hayabusa Process Flow
For Hayabusa I tried the latest version which now uses a wizard prior to starting and thought that might interfere with it starting so I downgraded and used the 2.5.1 version
Slack Notifications Flow
Slack notification is configured and works fine.
Thank you for your time and help!
Warm regards,
Marc
Does the manual upload via the WebUI also fail? If it doesnt it must be a problem with the API.... i think. Im quite new to this.
Update 1: It looks like as if the login by the timesketch_importer fails. The Code seems to expect data in JSON but is most likely getting HTML-Content with denied permission from timesketch-web. Are the credentials all in line?
Update2: I have encountered the same error when uploading my plaso-timeline. I was using the timesketch container(by digest): sha256:6ebfd0b9318a1a6b46e8b5b37745fef2bc8ee11fa5ae1f5977827de69d47bacc. After i upgraded my timesketch to the latest(sha256:a1c8faf408620eb21a37d9e810af792bbb31786df68e1aa099b6d34e71870d41), the upload was successfull!
Sorry for the delay. I am working an update of the workflow project. In the meantime please checkout if this gets resolved with the latest version of Timesketch and timesketch importer.
