Enhancement: Duplicate detections for logon-summary about hayabusa HOT 5 OPEN

I gave it a try and it looks like a nice way to get the info I need. Thanks for letting me know!

from hayabusa.

@mischw We updated the stack-logons command so if you compile takajo with the main branch, you can get failed logon info as well.

from hayabusa.

We will look into adding this feature. For now, you might just have to write a script to remove the duplicates.

from hayabusa.

Thanks for considering adding this feature. In the mean time I am happy to write a script. Do you happen to know a tool or two which would be suitable for usage in script and at the same time is able to output a format which hayabusa is able to parse?

from hayabusa.

@mischw To work around this, you can remove duplicates with the json-timeline command, output to JSONL and then use the stack-logons in Takajo to get the same information. (https://github.com/Yamato-Security/takajo?tab=readme-ov-file#stack-logons-command)
Right now, it only summarizes successful logons but will add an option to analyze failed logons as well.

from hayabusa.