wagga40 / Zircolite

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
671 stars 91 forks source link

Consider adding option to disable console output #21

Closed weslambert closed 2 years ago

weslambert commented 2 years ago

First, thanks for all your work on this!

It would be nice to have an option to disable console output or consoleLogger.info, or simply write the results to a file for automated/remote runs of the tool.

Currently, I'm having an issue with the encoding when trying to run non-interactively via cmd and Powershell on Windows 10, and it seems the only way to get around it is to set the local/region prefs to UTF-8 system-wide, which might not be ideal in certain instances.

I can work on this if needed, as time allows.

wagga40 commented 2 years ago

Hi, thanks for filling this issue.

I think I have reproduced the problem and found a quick workaround. If you replace the printhere : https://github.com/wagga40/Zircolite/blob/dfad7462195da76cf1155bb50d54b86eda1e3159/zircolite.py#L761 by a consoleLogger.info you will not have the error anymore.

The output will still print on the console if you do not redirect the error. Please, tell me if it OK, I will push an update.

An option is still something to consider by the way. I would be happy if you work on it. To be honest, I think the logging system is far from perfect (you will have to handle Tqdm).

weslambert commented 2 years ago

Thanks for making the change for zircolite.py! Testing using Python and the script directly and using out-null now works without error. Would it be possible to generate a new release package? If not, and you prefer to do so at another interval, I completely understand. I am currently using the nuitka embedded package. I do think it would still be beneficial in the future to have an option, but for now this seems to accomplish what I am looking to do. Thanks!

wagga40 commented 2 years ago

Would it be possible to generate a new release package?

I have regenerated the new packages but I forgot to upload them… will do ASAP.

you are right an option would still be useful.

wagga40 commented 2 years ago

Done.

weslambert commented 2 years ago

Thanks!