https://github.com/jaegeral/goldfish
So simple that you might wonder why it took so long
https://github.com/jaegeral/goldfish
security security-tools
Last synced: 5 months ago
JSON representation
So simple that you might wonder why it took so long
- Host: GitHub
- URL: https://github.com/jaegeral/goldfish
- Owner: jaegeral
- License: mit
- Created: 2018-01-26T19:12:27.000Z (over 8 years ago)
- Default Branch: master
- Last Pushed: 2018-02-20T21:04:35.000Z (over 8 years ago)
- Last Synced: 2025-03-01T05:14:53.816Z (over 1 year ago)
- Topics: security, security-tools
- Homepage:
- Size: 6.84 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Goldfish
## Idea
The idea is to have a tool that is basically able to log all findings that analysts collect during incident response / forensic investigations.
Most people start with a spreadsheet with the following columns:
|date|time|Source|Hostname|Content / Raw Entry |Comment |
|---|---|---|---|---|---|
|2018-02-20| 07:00:01Z |RegKey:Modified |TargetHost |Lorem Ipsum |This is vary interesting |
However that approach does not really scale when a team is working on a case maybe involving multiple systems.
### Structure
There is a central Goldfish instance running that is being exposed via WebUi and / or REST-API. Thus analysts can add / modify delete data using both methods.
Within the WebUI different filter / search options would be ideal and an export to CSV is planned to enable analysts to take the latest data back to various other tools.
### Differences to xyz
Of couse the idea behind can be achieved with other tools like ticketing tools, SIEM solutions or any other cyber related tool. Goldfish is not intended to be a Swiss Army knife to solve dozen of problems but a bottle opener, made for a single task.
## Operations
### Requirements
How to install the goldfish to the fishbowl
### Installation
### Hardening
What to do to harden your Goldfish?
### Backup
How to backup your Goldfish
### Update
How to install the latest Goldfish
## Sample requests
### GET /findings/_design/by_host/_view/by_host?key="hostname123"
Will return a json array of all findings to a given hostname.
By appending "&include_docs=true" it will also contain the whole entry
### POST finding