search

davehull / Kansa

A Powershell incident response framework
Apache License 2.0
1.56k stars 266 forks source link

Get-NetstatDistinctLocal24.ps1: missing DATADIR directive #187

Closed iknowjason closed 4 years ago

iknowjason commented 5 years ago

Hello all,

I'm getting this WARNING in my Kansa output during analysis. I've been trying to play with where to put the DATADIR directive and how to populate it. The netstat collector is running and collecting data. Can anyone lend any insight please?

WARNING: Analysis script, .\Analysis\Net\Get-NetstatDistinctLocal24.ps1, missing # DATADIR directive, skipping analysis

dmoore44 commented 5 years ago

Can you give the full command line issued when you ran Kansa? I don't tend to run the analysis scripts, but I'll see if I can lend a hand.

davehull commented 5 years ago

It's been awhile, but it looks to me like Get-NetstatDistinctLocal24.ps1 is missing the DATADIR directive. If you look at the other Net collectors, not all of them, but this one for instance, https://github.com/davehull/Kansa/blob/4cf548d873808ddd202f51f07ad778f97e2f6fc0/Analysis/Net/Get-NetstatForeign16sStack.ps1#L23, has a line that says where the data will be sitting for the Analysis script to run against. Add that line to Get-NetstatDistinctLocal24.ps1 and it should fix it.

PRs welcome. Cheers!

iknowjason commented 5 years ago

Sorry for the delayed response on this issue. The DATADIR directive insight above helped resolve this. Thank you. Command that I ran: .\kansa.ps1 -TargetList .\hosts.txt -Analysis

athegist commented 4 years ago

Fixed via https://github.com/davehull/Kansa/commit/6431e4eb35b1f56db72bac4872ae522c6e8c5062