casemanagement is a Python Flask-powered application designed to streamline the management of forensic cases. It provides an intuitive interface for investigators to upload evidence and receive the analyzed results.

• Case Management: Easily create, update, and delete forensic cases.
• Evidence Tracking: Upload and analyze forensic case data.
• User Authentication: Secure user authentication and authorization system.
• Automatic reporting: Automatically send analyzed data to Splunk backend.
• Customizable: Adapt the application to fit your specific forensic investigation workflow.

to do

To run the application, you need to set the following environment variables:

• DEPLOYMENT: development creates a local sqlite db, value production expects PROD_DB_STRING to be set
• SECRET_KEY: varchar(100) secret value for cookie "salt" in Flask
• SECURITY_PASSWORD_SALT: varchar(100) secret value for password salting
• SPLUNK_URL: url(https://{ip}:{port}) for Splunk api port 8089
• SPLUNK_TOKEN: JWT for Splunk access via api as bearer
• PROD_DB_STRING: PostgreSQL connection string as postgesql:https://{username}:{password}@{hostname}:{port}/{database}?sslmode=require
• ADMIN_PASSWORD: Admin user password
• ADMIN_EMAIL: Admin user emailaddress
• HAYABUSA_WORKER_URL: Hayabusa worker url with /upload [explained further down below]
• HAYABUSA_ACCESS_TOKEN: Hayabusa accesstoken for the workers [explained further down below]

1. Pull image:

docker pull ghcr.io/tobiass1402/casemanagement:main

2. Set-up docker-compose

cp docker-compose-example.yml docker-compose.yml

3. Edit variables

4. Run

docker compose up

1. Clone the repository:

git clone https://github.com/tobiass1402/casemanagement
cd casemanagement

2. Install dependencies:

pip install -r requirements.txt

3. Set-up docker-compose

cp docker-compose-example.yml docker-compose.yml

4. Edit variables

5. Run and build

docker compose up --build 

The application should now be running and accessible at http:https://0.0.0.0:9000.

In order to automatically have your .evtx files analyzed you need to set-up the Hayabusa worker from https://github.com/TobiasS1402/hayabusa-docker. This has automatically been added to docker-compose, just set the same key for HAYABUSA_ACCESS_TOKEN and ACCESS_TOKEN.

Contributions are welcome! If you have any suggestions, feature requests, or bug reports, please open an issue or submit a pull request.

• seperate Celery task files
• seperate files for functions and classes
• create error view for tasks
• create retry button for failed tasks
• create database connection task storage