Server administration
tsctl
tsctl is a command line tool to control timesketch.
Parameters:
--config / -c (optional)
Example
tsctl runserver -c /etc/timesketch/timesketch.conf
User management
Adding users
Command:
tsctl add_user
Parameters:
--name / -n
--password / -p (optional)
Example
tsctl add_user --name foo
Change user password
To change a user password, the add_user command can be used, as it is checking if the user exists if yes it will update the update.
Command:
tsctl add_user
Parameters:
--username / -u
--password / -p (optional)
Example
tsctl add_user --username foo
Removing users
Not yet implemented.
Group management
Adding groups
Command:
tsctl add_group
Parameters:
--name / -n
Removing groups
Not yet implemented.
Managing group membership
Add or remove a user to a group. To add a user, specify the group and user. To remove a user, include the -r option.
Command:
tsctl manage_group
Parameters:
--remove / -r (optional)
--group / -g
--user / -u
Example:
tsctl manage_group -u user_foo -g group_bar
add_index
Create a new Timesketch searchindex.
Command:
tsctl add_index
Parameters:
--name / -n
--index / -i
--user / -u
Example:
tsctl add_index -u user_foo -i test_index_name -n sample
Migrate db
Command:
tsctl db
Drop database
Will drop all databases.
Command:
tsctl drop_db
Import json to Timesketch
Command:
tsctl json2ts
Purge
Delete timeline permanently from Timesketch and Elasticsearch. It will alert if a timeline is still in use in a sketch and prompt for confirmation before deletion.
Args:
index_name: The name of the index in Elasticsearch
Command:
tsctl purge
search_template
Export/Import search templates to/from file.
Command:
tsctl search_template
Parameters:
--import / -i
--export / -e
import_location: Path to the yaml file to import templates. export_location: Path to the yaml file to export templates.
import
Creates a new Timesketch timeline from a file. Supported file formats are: plaso, csv and jsonl.
Command:
tsctl import
Parameters:
--file / -f
--sketch_id / -s (optional)
--username / -f (optional)
--timeline_name / -n (optional)
The sketch id is inferred from the filename if it starts with a number. The timeline name can also be generated from the filename if not specified.
similarity_score
Command:
tsctl similarity_score
Upgrade DB After Schema Change
After changing the schema for the database a revision file needs to be generated.
(temporary solution)
Before doing the database migration you'll need to modify the file timesketch/models/__init__.py
:
def init_db():
...
BaseModel.metadata.create_all(bind=engine)
This line needs to be commented out, eg:
def init_db():
...
#BaseModel.metadata.create_all(bind=engine)
Then inside the timesketch container, to generate the file use the command:
cd /usr/local/src/timesketch/timesketch
tsctl db stamp head
tsctl db upgrade
This makes sure that the database is current. Then create a revision file:
tsctl db migrate -m "<message>"
Once the migration is done, remove the comment to re-enable the line in timesketch/models/__init.py
.
Troubleshooting Database Schema Changes
If the migration file is not created, which could be an indication that the schema change is not detected by the automation one can create an empty revision file:
tsctl db revision
And then fill in the blanks, see examples of changes in timesketch/migrations/versions/*_.py
.