es4forensics 0.5.1

Import several timelines into elasticsearch
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

use assert_json_diff::assert_json_eq;
use es4forensics::{objects::PosixFile, TimelineObject};
use serde_json::{json, Value};

#[test]
pub fn test_bodyfile_single() {
    let str_line = "0|/Users/Administrator ($FILE_NAME)|93552-48-2|d/drwxrwxrwx|0|0|92|1577092511|1577092511|1577092511|-1";
    let pfile: PosixFile = str_line.try_into().unwrap();
    let values: Vec<Value> = pfile.into_values().collect();
    let actual = json!(values);
    let expected = json!([{
    "@timestamp":1577092511000_u64,
    "ecs":{"version":"8.4"},
    "message": "/Users/Administrator ($FILE_NAME)",
    "tags": ["bodyfile"],
    "file":{
        "accessed":1577092511000_u64,
        "ctime":1577092511000_u64,
        "gid":0,
        "inode":"93552-48-2",
        "mtime":1577092511000_u64,
        "path":"/Users/Administrator ($FILE_NAME)",
        "name":"Administrator ($FILE_NAME)",
        "directory":"/Users",
        "mode": "",
        "size":92,
        "uid":0,
        //"macb_long": ["modified", "accessed", "changed"],
        //"macb_short": "mac."
        }
    }]);
    assert_json_eq!(actual, expected);
}

//#[test]
pub fn test_bodyfile_multiple() {
    let str_line = "0|/Users/Administrator ($FILE_NAME)|93552-48-2|d/drwxrwxrwx|0|0|92|1577092511|1577092511|1577092511|1577092512";
    let pfile: PosixFile = str_line.try_into().unwrap();
    let values: Vec<Value> = pfile.into_values().collect();
    let actual = json!(values);
    let expected = json!([{
    "@timestamp":1577092511000_u64,
    "ecs":{"version":"8.4"},
    "file":{
        "accessed":1577092511000_u64,
        "ctime":1577092511000_u64,
        "created":1577092512000_u64,
        "gid":0,
        "inode":"93552-48-2",
        "mtime":1577092511000_u64,
        "path":"/Users/Administrator ($FILE_NAME)",
        "size":92,
        "uid":0}
    },
    {
        "@timestamp":1577092512000_u64,
        "ecs":{"version":"1.0.0"},
        "file":{
            "accessed":1577092511000_u64,
            "ctime":1577092511000_u64,
            "created":1577092512000_u64,
            "gid":0,
            "inode":"93552-48-2",
            "mtime":1577092511000_u64,
            "path":"/Users/Administrator ($FILE_NAME)",
            "size":92,
            "uid":0}
    }]);
    assert_json_eq!(actual, expected);
}