search

JPCERTCC / LogonTracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log
Other
2.7k stars 441 forks source link

Errors when importing from Elasticsearch #109

Closed seb9988 closed 3 years ago

seb9988 commented 3 years ago

Hi, I'm trying to import events from Elasticsearch using your python script (I'm using python 3.8.8), but got an error:

C:\LogonTracer>python logontracer.py --es --es-server https://xxx:9200 --es-user xxx --es-pass xxx --es-cafile \xxx.cer -z +2 -f 2021-04-08T08:00:00 -t 2021-04-08T08:00:30 [+] Script start. 2021/04/08 09:07:21 [+] Neo4j Kernel version: 4.2.2 [+] Time zone is 2. [+] Search ES from 2021-04-08 08:00:00. [+] Search ES to 2021-04-08 08:00:30. [+] Start searching the ES. Traceback (most recent call last): File "logontracer.py", line 1857, in <module> main() File "logontracer.py", line 1851, in main parse_es() File "logontracer.py", line 1569, in parse_es event_series = pd.Series([eventid, ipaddress, username, logintype, status, authname, int(stime.strftime("%s"))], index=event_set.columns) ValueError: Invalid format string

It looks like stime.strftime("%s") is not supported, see https://stackoverflow.com/questions/11743019/convert-python-datetime-to-epoch-with-strftime or https://bugs.python.org/issue12750.

Could you have a look? Best regards,

shu-tom commented 3 years ago

Thank you for using LogonTracer. I've fixed it from strftime to timestamp.