Open ssnkhan opened 7 months ago
I am creating a tool to plot this output, I was already planning on implementing this stats idea, i don't know if this helps anyone or not.
It also plots AWS logs and you can see how the stats output is looking for that.
Would be helpful if chainsaw could provide high level stats detailing the frequency of event code IDs observed in an Event Log, like Eric Zimmerman's
evtxecmd tool
. Potential usage would bechainsaw hunt --stats-only evtx_attack_samples
.Another option
--stats-only-sigma
would produce a similar frequency table, but with a count of Sigma hits.Thanks for this amazing tool!