Indexing results from JKats Toolkit cURL

[mrgibbon]

Hi All, Im just about to get cracking on a new project and want to know something before I start.
I'll be taking a look at the curl command in JKats Toolkit to retrieve data from an external system.
BUT, I don't want to view the data on a dashboard, I'd like to have it indexed instead.
Is it possible? If it is, how?

Thanks in advance!

[jkat54 · Accepted solution]

Yes that's exactly how I would do it. Collect, sistats, etc.

The premise of the command is to get the data into the search pipeline so that you can use Rex and other commands to manipulate it as you wish. There are updates coming and your input is welcomed and appreciated.

[mrgibbon]

Thanks for the confirmation, I'd be eager to see any future updates!

[jkat54]

Next version should only use options instead of the current mix of keywords and options. So it will look like this

| curl uri=... method=... user=... pass=... data=...

after that the next goal is to encrypt the authentication settings in a conf file and give the option of connection_name=... Maybe include the uri in the conf file too (optionally).

[jkat54]

Thanks for your interest!

[mrgibbon]

Could I use the collect command for instance? Or is there a better way? I dont want to use a summary index unless I really need to.