Comments (3)
"(((parser=='winevtx') and (timestamp_desc=='Creation Time')) or (parser!='winevtx')) and (date>datetime('2023-09-01T00:00:00') and date<datetime('2024-04-04T00:00:00'))"
Per https://plaso.readthedocs.io/en/latest/sources/user/Event-filters.html
Note that as of 20230108 the ‘parser’ event attribute is considered an output field and is discouraged to be used in the event filter. As of 20230724 the ‘parser’ event attribute has been removed.
Use the data_type instead
from plaso.
"filters suggested from SANS forensics course a year back"
@yowelf recommend you ask SANS to update their course material we don't control it, nor do we have insight into it
from plaso.
"filters suggested from SANS forensics course a year back"
@yowelf recommend you ask SANS to update their course material we don't control it, nor do we have insight into it
Thanks for your help. I'll ask them in case the filter is not up to date
from plaso.
Related Issues (20)
- Python 3.12 DeprecationWarning fork()
- Add more structure to test_data directory
- Add support for signed XML plist files
- Enhance Mac OS background items plist parser plugin
- Create parser and parser plugins for Apple Biome files (aka: SEBG files) HOT 10
- How do I select parsers? HOT 20
- How do I use the winiis text parser plugin? HOT 1
- Windows Event Log message strings support enhancements
- Release plaso 20240308
- Change winlnk parser to not generate distributed_link_tracking event data for duplicate identifier
- Add TeamViewer log parser HOT 1
- Image export: change default behavior to not export file system metadata files
- Windows shim databases produce spurious UTMP events HOT 1
- Replace Redis with Valkey
- Remove obsolete functionality
- acstore pre-release causing AttributeError: 'SQLiteStorageFile' object has no attribute '_CONTAINER_SCHEMA_TO_SQLITE_TYPE_MAPPINGS' HOT 9
- Remove indirect dependencies HOT 11
- winevtx: unable to parse evtx files without dependency identifier and string integer and FILETIME values HOT 5
- Failed to parse bitlocker encrypted image, but success with same image mounted with bdemount
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from plaso.