search

JPCERTCC / LogonTracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log
Other
2.7k stars 441 forks source link

Docker cannot delete default event files. Is it possible to perform event initialization? #132

Open ViolinTiger opened 1 year ago

ViolinTiger commented 1 year ago

Docker cannot delete default event files. Is it possible to perform event initialization? Dockerはデフォルトのイベントファイルを削除できません。イベントの初期化を行うことは可能ですか？

I was able to successfully import the event, but there are too many duplicates. Thank you very much, I appreciate it. イベントのインポートに成功しましたが、重複があまりにも多すぎます。大変ありがとうございます、感謝しています。

shu-tom commented 10 months ago

Please disable "Add additional EVTX or XML files". Upload EVTX File

or

Python command with option --delete.

$ python3 logontracer.py --delete -e [EVTX File] -z [TIME Zone] -u neo4j -p password -s [Docker image IP Address]