search

JPCERTCC / LogonTracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log
Other
2.7k stars 441 forks source link

Load JSON data from Elasticsearch #102

Closed jkhalouian closed 3 years ago

jkhalouian commented 3 years ago

Is it possible to pull Event Log data in the form of JSON payload from elastic.

For example, I have an index that stores event IDs with the field names "System.EventID.Value" and "EventData.LogonType".

Could I possibly modify any of the variables in the script to search for these fields and pull the values?

Thanks!

shu-tom commented 3 years ago

LogonTracer only supports loading data imported from Winlogbeat into Elasticsearch.