This page gives a few hints on how to develop new recipes and modules for dftimewolf. Start with the architecture page if you haven’t read it already.
Creating a recipe¶
If you’re not satisfied with the way modules are chained, or default arguments that are passed to some of the recipes, then you can create your own. See existing recipes for simple examples like local_plaso. Details on recipe keys are given here.
Recipes launch Modules with a given set of arguments. Arguments can be specified in different ways:
- Hardcoded values in the recipe’s Python code
@parameters that are dynamically changed, either:
- Through a
- Through the command line
- Through a
Parameters are declared for each Module in a recipe’s
recipe variable in the
@parameter placeholders. How these are populated is then specified in
args variable right after, as a list of
(argument, help_text, default_value) tuples that will be passed to
argparse. For example, the
public version of the
recipe specifies arguments in the following way:
args = [ ('hosts', 'Comma-separated list of hosts to process', None), ('reason', 'Reason for collection', None), ('--artifacts', 'Comma-separated list of artifacts to fetch ' '(override default artifacts)', None), ('--extra_artifacts', 'Comma-separated list of artifacts to append ' 'to the default artifact list', None), ('--use_tsk', 'Use TSK to fetch artifacts', False), ('--approvers', 'Emails for GRR approval request', None), ('--sketch_id', 'Sketch to which the timeline should be added', None), ('--incident_id', 'Incident ID (used for Timesketch description)', None), ('--grr_server_url', 'GRR endpoint', 'http://localhost:8000') ]
reason are positional arguments - they must be provided
through the command line.
grr_server_url are all optional. If they are not specified
through the command line, the default argument will be used.
If dftimewolf lacks the actual processing logic, you need to create a new module. If you can achieve your goal in Python, then you can include it in dfTimewolf. “There is no learning curve™”.