meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
soc:tools:velociraptor [2026/06/12 10:06] – titannetsoc:tools:velociraptor [2026/06/12 10:53] (current) – titannet
Line 25: Line 25:
 docker run -it --rm --entrypoint=/bin/bash -v ./:/data log2timeline/plaso docker run -it --rm --entrypoint=/bin/bash -v ./:/data log2timeline/plaso
  
 +log2timeline.py --storage-file /tmp/out.plaso /data/<folder>
 +psort.py -o json_line -w /data/out.jsonl /tmp/out.plaso
  
 +# psort.py -o json_line -w /data/out.jsonl /data/out.plaso
 # #
 docker exec -it ir-velociraptor /opt/velociraptor/linux/velociraptor config repack --msi /velociraptor/msi/#.msi client.config.yaml /velociraptor/msi/velociraptor-repack.msi docker exec -it ir-velociraptor /opt/velociraptor/linux/velociraptor config repack --msi /velociraptor/msi/#.msi client.config.yaml /velociraptor/msi/velociraptor-repack.msi
  
  
 +
 +
 +# sudo chmod -R a+rwX ./splunk/
 +sudo cp props.conf etc/system/local/props.conf
  
 docker image load -i ./splunk.tar docker image load -i ./splunk.tar
 docker compose up docker compose up
 +
 +# settings -> add -> monitor -> plaso.conf -> ...
 +
 +index="pc_plaso"
  
 </code> </code>