WithSecureLabs / chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts
GNU General Public License v3.0
2.71k stars 245 forks source link

Issue with CSV output not populating "Event Data" row #96

Closed danielgottt closed 2 years ago

danielgottt commented 2 years ago

Hi Team,

When I output chainsaw detections into a csv I notice the actual data isn't populating within the "Event Data" row. I'll throw my cmdline arguments below along with an example output.

./chainsaw.exe hunt Logs/SOMEFILE.evtx -s sigma/rules/ --mapping mappings/sigma-event-logs-all.yml --full --output results --csv

I am getting detections but nothing is populating within that row 😢 1 2

FranticTyping commented 2 years ago

Hey @danielgottt,

The data is there, if you expand the EventData cell downwards you should be able to see it.

let me know if you still have issues :)

danielgottt commented 2 years ago

oh boy what a stupid mistake. Appreciate it!