Merge pull request #1167 from Yamato-Security/1159-timeline-offset-of…

…fset-option Added timeline offset offset option
Yamato-Security · Aug 31, 2023 · ac04f59 · ac04f59
2 parents 2be94c6 + 4fe71f1
commit ac04f59
Show file tree

Hide file tree

Showing 18 changed files with 582 additions and 36 deletions.
diff --git a/CHANGELOG-Japanese.md b/CHANGELOG-Japanese.md
@@ -12,6 +12,7 @@
 
 - `search`に`-a, --and-logic`オプションを追加し、複数のキーワードをAND条件で検索できるようにした。 (#1162) (@hitenkoku)
 - 出力プロファイルに、回復されたかどうかを示す `%RecoveredRecord%` フィールドを追加した。 (#1170) (@hitenkoku)
+- `csv-timeline`、`json-timeline`、`logon-summary`、`eid-metrics`、`pivot-keywords-list`、`search` コマンドに、直近の日数だけをスキャンするための `--timeline-offset` オプションを追加した。 (#1159) (@hitenkoku)
 
 ## 2.7.0 [2023/08/03] "SANS DFIR Summit Release"
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -12,6 +12,7 @@
 
 - Added a `-a, --and-logic` option in the `search` command to search keywords with AND logic. (#1162) (@hitenkoku)
 - When using `-x, --recover-records`, an additional `%RecoveredRecord%` field will be added to the output profile and will output `Y` to indicate if a record was recovered. (#1160) (@hitenkoku)
+- Added a `--timeline-offset` option in `csv-timeline`, `json-timeline`, `logon-summary`, `eid-metrics`, `pivot-keywords-list`, `search` command to scan just the most recent number of days. (#1159) (@hitenkoku)
 
 ## 2.7.0 [2023/08/03] "SANS DFIR Summit Release"
 

diff --git a/src/afterfact.rs b/src/afterfact.rs
@@ -1869,6 +1869,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: None,
                 enable_deprecated_rules: false,
@@ -1956,6 +1957,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: None,
                 enable_deprecated_rules: false,
@@ -2191,6 +2193,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: Some("verbose-2".to_string()),
                 enable_deprecated_rules: false,
@@ -2280,6 +2283,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: Some("verbose-2".to_string()),
                 enable_deprecated_rules: false,
@@ -2501,6 +2505,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: None,
                 enable_deprecated_rules: false,
@@ -2588,6 +2593,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: None,
                 enable_deprecated_rules: false,
@@ -2820,6 +2826,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: None,
                 enable_deprecated_rules: false,
@@ -2907,6 +2914,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: None,
                 enable_deprecated_rules: false,
@@ -3223,6 +3231,7 @@ mod tests {
                 filepath: None,
                 live_analysis: false,
                 recover_records: false,
+                timeline_offset: None,
             },
             profile: None,
             enable_deprecated_rules: false,
@@ -3360,6 +3369,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: None,
                 enable_deprecated_rules: false,
@@ -3446,6 +3456,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: None,
                 enable_deprecated_rules: false,
@@ -3618,6 +3629,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: None,
                 enable_deprecated_rules: false,
@@ -3704,6 +3716,7 @@ mod tests {
                     filepath: None,
                     live_analysis: false,
                     recover_records: false,
+                    timeline_offset: None,
                 },
                 profile: None,
                 enable_deprecated_rules: false,