KAPE - USN Endpoint Parsing

philhagen / sof-elk

Configuration files for the SOF-ELK VM

GNU General Public License v3.0

1.46k stars 272 forks source link

KAPE - USN Endpoint Parsing #236

Closed RandyRandleman closed 2 years ago

RandyRandleman commented 2 years ago

MFTECmd.exe from Eric Zimmerman now includes a JSON output for the USN Journal. Would like to get ingestion of this output file into SOF-ELK for the purpose of cataloguing of data relating to file activity.

philhagen commented 2 years ago

following items are new in the USN journal entries compared to existing fields:

UpdateTimeStamp, UpdateReasons, FileAttributes, OffsetToData, SourceFile

philhagen commented 2 years ago

confirmed this is clear to close with ab9862b769363eed50056e5674929fb336992c54