forensicstore

Overview ¶

Package forensicstore implements the forensicstore command line tool with various subcommands that can be used to edit and handle forensicstores.

create    Create a forensicstore
import    Import another forensicstore or stix json
element      Edit the forensicstore (insert, get, select, all)
process   Process a workflow.yml
validate  Validate forensicstores

Usage ¶

Create a forensicstore

forensicstore create my.forensicstore

Insert and fetch elements

forensicstore element insert '{"type": "test", "foo": "bar"}' my.forensicstore
forensicstore element get foo--16b02a2b-d1a1-4e79-aad6-2f2c1c286818 my.forensicstore > myelement.json
forensicstore element select foo my.forensicstore > foo_export.json
forensicstore element all my.forensicstore > export.json

Process forensicstore

forensicstore process --workflow myreports.yml my.forensicstore

Validate forensictore

forensicstore validate my.forensicstore