JPCERTCC / LogonTracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log
Other
2.74k stars 443 forks source link

Evtx Imported ok but no data after reload page #126

Open johnjohnsp1 opened 2 years ago

johnjohnsp1 commented 2 years ago

Hello, running logon tracer within docker following the wiki instructions, no problem to get it up and running on port 8080 i upload the security dc log EVTX format and all the upload is go fine. when i reach the full upload i can see the text to close the window and reload webpage in order to display data but sadly the reloaded page doesn't show me any of the data uploaded:

[+] Script start. 2022/10/19 13:16:33 [+] Neo4j Kernel version: 4.2.13 [+] Delete all nodes and relationships from this Neo4j database. [+] make cache folder /usr/local/src/LogonTracer/cache. [+] Time zone is 1. [+] Last record number is 225632. [+] Start parsing the EVTX file. [+] Parse the EVTX file /usr/local/src/LogonTracer/upload/0.evtx. [+] Now loading 100 records. [+] Now loading 200 records. [+] Now loading 300 records. [+] Now loading 400 records. [+] Now loading 500 records. [+] Now loading 600 records. [+] Now loading 700 records. [+] Now loading 800 records. [+] Now loading 900 records. [+] Now loading 1000 records. [+] Now loading 1100 records. [+] Now loading 1200 records. [+] Now loading 1300 records. [+] Now loading 1400 records. [+] Now lo......... ...... 600 records. [+] Now loading 223700 records. [+] Now loading 223800 records. [+] Now loading 223900 records. [+] Now loading 224000 records. [+] Now loading 224100 records. [+] Now loading 224200 records. [+] Now loading 224300 records. [+] Now loading 224400 records. [+] Now loading 224500 records. [+] Now loading 224600 records. [+] Now loading 224700 records. [+] Now loading 224800 records. [+] Now loading 224900 records. [+] Now loading 225000 records. [+] Now loading 225100 records. [+] Now loading 225200 records. [+] Now loading 225300 records. [+] Now loading 225400 records. [+] Now loading 225500 records. [+] Now loading 225600 records. [+] Load finished. [+] Total Event log is 225632. [+] Filtered Event log is 71935. [+] Create cache files. [+] Calculate ChangeFinder. [+] Calculate Hidden Markov Model. [+] Calculate PageRank. [+] Creating a graph data. [+] Creation of a graph data finished. [+] Script end. 2022/10/19 14:00:27

i do start the docker image with

docker pull jpcertcc/docker-logontracer

Using default tag: latest latest: Pulling from jpcertcc/docker-logontracer e5ae68f74026: Pull complete 9e9f5b9b70c2: Pull complete 487fc3d77b36: Pull complete c014467dc653: Pull complete 6b842fb5c673: Pull complete d94ad0ad5f08: Pull complete 6223faaa5de3: Pull complete d09d97bc89e4: Pull complete 4e9c112f3b2c: Pull complete cca389b6aba3: Pull complete c3b03f6efc25: Pull complete 4bf458238b00: Pull complete 4f4fb700ef54: Pull complete ca9dc6273e3e: Pull complete 92920ae20fae: Pull complete 0fa4e198ce81: Pull complete 2ff7fea4f24f: Pull complete b449706902db: Pull complete Digest: sha256:c9336057e37fe062ed58c8d8d5a20f7d0d6e6f8d0d3fe542e03c4f381cc1270c Status: Downloaded newer image for jpcertcc/docker-logontracer:latest docker.io/jpcertcc/docker-logontracer:latest

docker run \

--detach \ --publish=7474:7474 --publish=7687:7687 --publish=8080:8080 \ -e LTHOSTNAME=0.0.0.0 \ jpcertcc/docker-logontracer

anything i miss or do wrong ? did anyone else get the same problem ? also tried different browser:

firefox, safari,chrome on different OS: macOS ventura 12.6, windows 10 21h2 build 19044, ubuntu 22.04

thanks

Schermata 2022-10-19 alle 16 13 13 Schermata 2022-10-19 alle 17 34 46
shu-tom commented 2 years ago

Have you checked your web browser Console Log for errors?

wangqiusheng1983 commented 2 weeks ago

same problems