Repository: log2timeline/dftimewolf

Issue:
GCPLoggingTimesketch set data_type gcp:log:json
Timesketch events created using GCPLoggingTimesketch don't have a data_type set making it hard to filter specifically on GCP logs in Timesketch.

The new Timesketch GCP analyser relies on a data_type of "gcp:log:json" as set by the GCP logging Plaso parser. GCPLoggingTimesketch should also set this data_type for emitted events.

Comments:

Patch:
diff --git a/dftimewolf/lib/processors/gcp_logging_timesketch.py b/dftimewolf/lib/processors/gcp_logging_timesketch.py
index 026bf42..937718a 100644
--- a/dftimewolf/lib/processors/gcp_logging_timesketch.py
+++ b/dftimewolf/lib/processors/gcp_logging_timesketch.py
@@ -16,6 +16,8 @@ if TYPE_CHECKING:
 class GCPLoggingTimesketch(BaseModule):
   """Transforms Google Cloud Platform logs for Timesketch."""
 
+  DATA_TYPE = 'gcp:log:json'
+
   def __init__(self,
                state: "state.DFTimewolfState",
                name: Optional[str]=None,
@@ -44,7 +46,8 @@ class GCPLoggingTimesketch(BaseModule):
     log_record = json.loads(log_line)
 
     # Metadata about how the record was obtained.
-    timesketch_record = {'query': query, 'project_name': project_name}
+    timesketch_record = {'query': query, 'project_name': project_name,
+                         'data_type': self.DATA_TYPE}
 
     # Timestamp related fields.
     timestamp = log_record.get('timestamp', None)


Test patch:
diff --git a/tests/lib/processors/gcp_logging_timesketch.py b/tests/lib/processors/gcp_logging_timesketch.py
index ac4df0c..a1cd69d 100644
--- a/tests/lib/processors/gcp_logging_timesketch.py
+++ b/tests/lib/processors/gcp_logging_timesketch.py
@@ -73,6 +73,8 @@ class GCPLoggingTimesketchTest(unittest.TestCase):
             'test_query',
         'project_name':
             'test_project',
+        'data_type':
+            'gcp:log:json',
         'datetime':
             '2019-06-06T09:00:41.797000Z',
         'timestamp_desc':
@@ -202,6 +204,8 @@ class GCPLoggingTimesketchTest(unittest.TestCase):
             'test_query',
         'project_name':
             'test_project',
+        'data_type':
+            'gcp:log:json',
         'datetime':
             '2019-06-06T09:00:27.066000Z',
         'timestamp_desc':
@@ -295,6 +299,8 @@ class GCPLoggingTimesketchTest(unittest.TestCase):
             'test_query',
         'project_name':
             'test_project',
+        'data_type':
+            'gcp:log:json',
         'datetime':
             '2019-06-06T09:29:04.499000Z',
         'timestamp_desc':
@@ -425,6 +431,8 @@ class GCPLoggingTimesketchTest(unittest.TestCase):
             'test_query',
         'project_name':
             'test_project',
+        'data_type':
+            'gcp:log:json',
         'datetime':
             '2020-06-16T05:09:57.427874505Z',
         'timestamp_desc':
@@ -516,6 +524,7 @@ class GCPLoggingTimesketchTest(unittest.TestCase):
         'message': 'line 470: /etc/selinux/config: Permission denied',
         'project_name': 'test_project',
         'query': 'test_query',
+        'data_type': 'gcp:log:json',
         'resource_label_cluster_name': 'cluster-ca8b',
         'resource_label_cluster_uuid': '44444-444444-444-4444-4444',
         'resource_label_project_id': 'metastore-playground',