filter_input.json

{
  "visit_time": "2014-10-16 09:44:57",
  "title": "Pizza New York, NY",
  "url": "http://www.yelp.com/search?find_desc=pizza&find_loc=NYC"
}

filter_output.json

{
  "visit_time": "2014-10-16 09:44:57",
  "title": "Pizza New York, NY",
  "url": "http://www.yelp.com/search?find_desc=pizza&find_loc=NYC",
  "osxcollector_domains": ["yelp.com","www.yelp.com"]
}

find_by_time.sh

$ cat INCIDENT32.json | grep '2014-01-01 11:3[2-8]'

find_by_time_url.sh

$ cat INCIDENT32.json | grep '2014-01-01 11:3[2-8]' | jq 'select(has("url"))|.url'

find_user.sh

$ cat INCIDENT32.json | jq 'select(.osxcollector_username=="ivanlei")|.'

sample

$ sudo osxcollector.py
Wrote 35394 lines.
Output in osxcollect-2014_12_21-08_49_39.tar.gz

the_one_filter.sh

$ cat SlickApocalypse.json | \
    python -m osxcollector.output_filters.find_domains | \
    python -m osxcollector.output_filters.shadowserver.lookup_hashes | \
    python -m osxcollector.output_filters.virustotal.lookup_hashes | \
    python -m osxcollector.output_filters.find_blacklisted | \
    python -m osxcollector.output_filters.related_files | \
    python -m osxcollector.output_filters.opendns.related_domains | \
    python -m osxcollector.output_filters.opendns.lookup_domains | \
    python -m osxcollector.output_filters.virustotal.lookup_domains | \
    python -m osxcollector.output_filters.chrome_history | \
    python -m osxcollector.output_filters.firefox_history | \
    tee analyze_SlickApocalypse.json | \
    jq 'select(false == has("osxcollector_shadowserver")) |
        select(has("osxcollector_vthash") or
               has("osxcollector_vtdomain") or
               has("osxcollector_opendns") or
               has("osxcollector_blacklist") or
               has("osxcollector_related"))'