Skip to content

feat(plaso): allow setting a custom name for the Plaso output file #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
julianghill wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat(plaso): allow setting a custom name for the Plaso output file #17

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1698f73
feat(plaso): allow setting a custom name for the Plaso output file
julianghill Jul 23, 2025
029e026
[EDIT] Changed how the extension gets stripped
julianghill Aug 26, 2025
b092b15
Refactor if/else tree
hacktobeer Sep 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 32 additions & 6 deletions src/log2timeline.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
import subprocess
import time
from uuid import uuid4
import os

from openrelik_worker_common.file_utils import create_output_file
from openrelik_worker_common.task_utils import (
Expand Down Expand Up @@ -81,6 +82,13 @@
"type": "textarea",
"required": False,
},
{
"name": "output_file_name",
"label": "Output file name",
"description": "Custom name for the output Plaso file (without .plaso extension).",
"type": "text",
"required": False,
},
],
}

Expand Down Expand Up @@ -110,18 +118,36 @@ def log2timeline(
output_files = []
temp_dir = None

# Determine display file name from task_config if provided
custom_name = None
if task_config and task_config.get("output_file_name"):
custom_name = task_config["output_file_name"]
if not custom_name.lower().endswith(".plaso"):
custom_name = f"{custom_name}.plaso"

if len(input_files) == 1:
display_name=f"{input_files[0].get('display_name')}.plaso"
if custom_name:
display_name = custom_name
output_file = create_output_file(
output_path,
display_name=f"{input_files[0].get('display_name')}.plaso",
display_name=display_name,
data_type="plaso:log2timeline:plaso_storage",
)
else:
output_file = create_output_file(
output_path,
extension="plaso",
data_type="plaso:log2timeline:plaso_storage",
)
if custom_name:
display_name = custom_name
output_file = create_output_file(
output_path,
display_name=display_name,
data_type="plaso:log2timeline:plaso_storage",
)
else:
output_file = create_output_file(
output_path,
extension="plaso",
data_type="plaso:log2timeline:plaso_storage",
)
status_file = create_output_file(output_path, extension="status")

command = [
Expand Down