Closed fukusuket closed 3 weeks ago
@fukusuket Thanks so much! I check that it is working well for both csv-timeline
and json-timeline
.
For json-timeline
, the output at the end is like this:
"Count": 14,
"TargetUserName": "jlake/ssims/edygert/bking/mdouglas/jorchilles/bgalbraith/baker/cspizor/cragoso/smisenar/bgreenwood/dmashburn/drook",
"IpAddress": "172.16.144.128"
},
"ExtraFieldInfo": {}
}
{
"Timestamp": "2016-09-20 01:50:06.513 +09:00",
"RuleTitle": "PW Guessing",
"Level": "med",
"Computer": "DESKTOP-M5SN04R",
"Channel": "Sec",
"EventID": 4625,
"RecordID": "-",
"Details": {
"Count": 3558,
"TargetUserName": "Administrator",
"TargetDomainName": ".",
"IpAddress": "192.168.198.149",
"LogonType": 3,
"ProcessName": "-",
"LogonProcessName": "NtLmSsp"
},
"ExtraFieldInfo": {}
}
[00:00:19] 584 / 584 [========================================] 100%
Scanning finished.
Rule Authors:
Is it possible to add a space just before the progress bar?
Ex:
}
[00:00:19] 584 / 584 [========================================] 100%
@YamatoSecurity Thank you for checking :) I fixed it!!
% ./hayabusa json-timeline -d ../hayabusa-sample-evtx/YamatoSecurity -w -q
...
"CVEID": "[CVE-2020-0601] cert validation"
}
}
[00:00:00] 13 / 13 [========================================] 100%
Scanning finished.
Rule Authors:
What Changed
Evidence
% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -w
% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -w -o timeline.csv
I would appreciate it if you could check it out when you have time🙏