Thank you for the blog mention.. glad to know you found part of one sentence interesting.
>>I am also familiar with the reality of it.
What's the reality? The context of my entire sentence was parsing and reviewing timeline data. If you know of a efficient and effective CLI kung foo method, please share..
From my perspective, the "reality" is that you're right.
The fact of the matter seems to be that no matter how useful a tool may be, if it's CLI, a great majority of the "community" won't be interested in using it...for the simple fact that it's CLI.
I've seen this a number of times. CLI tools seem to be a limiting factor for a lot of analysts.
I have a number of tools in my timeline analysis toolkit, but I've been told that there are too many, and they're all CLI. It doesn't matter that producing TLN output is only one of the formats that the tool can provide; nor does it matter that the tools have some built-in filtering capability to pull the analyst's attention to specific items. Most analysts tell me that they don't use them b/c they're CLI, and even seasoned analysts tell me that there are too many of them.
I've also seen people post to forums saying that they don't get into using SIFT b/c it's Linux, there are too many tools, etc.