The Timesketch notebook is a docker container that runs a customized version of picatrix, designed to assist analysts using Timesketch.
The notebook is a docker container, so the first step is to make sure that docker is installed.
If you did not install the docker desktop app you may also need to install
docker-compose
, please follow the instructions
here (the version that is often
included in your source repo might be too old to properly setup the container).
After installing docker the next step is to create a docker compose file, which is used to bootstrap the docker commands.
Save the following content to a file called docker-compose.yml
:
version: '3'
services:
notebook:
container_name: notebook
image: us-docker.pkg.dev/osdfir-registry/timesketch/notebook:latest
ports:
- 127.0.0.1:8844:8844
restart: on-failure
volumes:
- FOLDER_PATH:/usr/local/src/picadata/
Replace the text FOLDER_PATH
with a folder that can survive reboots. This is
the path to the folder where all notebooks will be saved to. The folder needs
to be readable and writeable by a user with uid/gid 1000:1000 (if this is run
on a Windows system the FOLDER_PATH
can be set to something like
C:\My Folder\
)
Once the file has been saved, docker-compose can be used to pull and start the container:
$ sudo docker-compose pull
$ sudo docker-compose up -d
The docker compose command will download the latest build and deploy the TS docker container.
To be able to connect to the notebook connect to
http://localhost:8844, the password to access
the notebook is timesketch
.
In case there are any issues with the container it can be useful to take a look at the container logs, which may give you hints into what may be the issue.
$ sudo docker container logs notebook
TODO: Complete this section.
To update the container, use:
$ sudo docker-compose pull
$ sudo docker-compose stop
$ sudo docker-compose up -d
If you are using Docker desktop you can find the docker image, click on the three dots and select pull.
After manually updating the image the container needs to be recreated (using the docker compose up command used earlier).
The docker container will have default credentials and configuration to connect to the developement server running in a container on the localhost, using the user/pass combination of dev/dev.
To connect to a different server, few options are available:
- Copy ~/.timesketchrc and ~/.timesketch.token to the docker using
docker cp
. - Run `ts_client = config.get_client(confirm_choices=True) and change all values as questions come up.
- Create a separate session using
ts_client = config.get_client(config_section='myserver')
- The other option is to connect to the docker container:
$ sudo docker exec -it notebook /bin/bash
And manually craft the ~/.timesketchrc file.
In order to connect to the docker container from colab, select the arrow
next to the Connect
button, select Connect to local runtime
and type
in the URL http://localhost:8844/?token=timesketch
into the Backend URL
field and hit CONNECT
.
TODO: This section needs to be filled in.
However in the meantime these sites can be of an assistance: