search

sans-blue-team / DeepBlueCLI

GNU General Public License v3.0
2.19k stars 355 forks source link

Powershell local (-log) or remote (-file) arguments shows no results #13

Open tsale opened 5 years ago

tsale commented 5 years ago

I have an issue where where the script local (-log) or remote (-file) arguments shows no results. There is no error so it looks like it cannot find anything even though there are event IDs that should match on the "Microsoft-Windows-PowerShell/Operational.evtx" log.

Can you please help me to troubleshoot this?

resv commented 8 months ago

I'm also having trouble with this as absolute path of an exported evtx file was not working. I believe line 632 function Check-Options($file, $log) could be the culprit.

Quick test to get it working: Create a directory within deepblue with the imported evtx file.

then run e.g.:

(For a folder you created within the deepblue directory using ".\"): .\DeepBlue.ps1 ".\< Created folder name of your imported logs>\< Event Log Filename >.evtx"

(For a folder you created at the parent directory above deepblue using "..\" ): .\DeepBlue.ps1 "..\< Created folder name of your imported logs>\< Event Log Filename >.evtx"