what content should be in .kjson? about kuiper HOT 2 CLOSED

Hi,
kjson is a JSONL file (line separated JSON objects) with predefined fields. The following is an example with the data you provided:

{
    "Data": {"baseurl":"www.xxxx.com/baseurl/xxxx"},
    "data_type": "<ARTIFACT_NAME>",
    "data_source": "<ARTIFACT_SOURCE>",
    "data_path": "<ARTIFACT_SOURCE_PATH>"
}

Where:

• <ARTIFACT_NAME> : is the same name as the parser name in Kuiper
• <ARTIFACT_SOURCE> : artifact source (ex. Firefox Browser History)
• <ARTIFACT_SOURCE_PATH>: Path to the artifact (ex. /home/u0041/.mozilla/firefox/XXXXXXXX.default/places.sqlite)

Also, make sure to add the field @timestamp to the JSON object in the field Data to be able to visualize it in the timeline otherwise it will default to 1700-01-01 00:00:00

from kuiper.

@AbdulRhmanAlfaifi thx! it works, by the way, when kuiper will support get artifact from linux? i think ,linux is the same important as windows

from kuiper.