Closed giacomoconti1978 closed 1 year ago
Hi, could you provide me :
Did you try with the option « —debug » and checked Zircolite.log ?
I know this was closed, but I ran into this today and not sure what to do with [-] too many columns on logs This was working on Windows EVTX logs
Hello, this typically indicates that your logs have too many fields, which turn into columns following the EVTX to SQLite conversion. By default, SQLite, which Zircolite uses as its backend, imposes a strict limit of 2000 columns (see details here). Altering this limit requires recompilation, a step not easily feasible as SQLite is accessed via the Python library in this context.
To avoid this you could :
Please give me feedback if it works for you.
I'm new of Zircolite, but when I tty to use it, have this issues:
-= Standalone SIGMA Detection tool for EVTX/Auditd/Sysmon Linux =-
[+] Checking prerequisites [+] Extracting events Using 'tmp-YIWJDQ4F' directory 100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 161/161 [00:05<00:00, 28.50it/s] [+] Processing events 100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 161/161 [00:14<00:00, 11.20it/s] [+] Creating model [-] Unable to create table
Why?