Skip to content

Latest commit

 

History

History
32 lines (20 loc) · 1.1 KB

EnablePlasoUpload.md

File metadata and controls

32 lines (20 loc) · 1.1 KB

Enable Plaso upload via HTTP

To enable uploading and processing of Plaso storage files, there are a couple of things to do.

Install Plaso

NOTE: Due to changes in the format of the Plaso storage file you need to run the latest version of Plaso (>=1.5.0).

Following the official Plaso documentation: https://plaso.readthedocs.io/en/latest/sources/user/Ubuntu-Packaged-Release.html

$ sudo add-apt-repository universe
$ sudo add-apt-repository ppa:gift/stable
$ sudo apt-get update
$ sudo apt-get install plaso-tools

Install Redis

$ sudo apt-get install redis-server

Configure Timesketch (/etc/timesketch/timesketch.conf)

UPLOAD_ENABLED = True
UPLOAD_FOLDER = u'/path/to/where/timesketch/can/write/files'
CELERY_BROKER_URL='redis://127.0.0.1:6379',
CELERY_RESULT_BACKEND='redis://127.0.0.1:6379'

Run a Celery worker process

$ celery -A timesketch.lib.tasks worker --loglevel=info

Read on how to run the Celery worker in the background over at the official Celery documentation.