rn Replace New-Line Chars with '|' Useful when grepping through audits like event log messages. f Force Force any previously extracted, parsed, or timelined r Recursive Input Recursively dive into directories for parsing files. o CSV Directory Output -REQUIRED- Parse XML to CSV. ebs Event Buffer Split Output Directory Split "eventbuffer" and "stateagentinspector" XML by event types. xsb XML Split Byte Size Default value is "300000000" (300 MB). XML files are automatically split to "/xmlsplit/".ĭoes not parse audits if a different path is specified.Īppends "_spxml#" to payload of filename. xso XML Split Output Directory Only Split XML audits into chunks.
This step is automatically included if parsing. exf Extract XML Format Change how filenames for acquired files are formatted. eff Extract File Acquisition Format Change how filenames for acquired files are formatted. efo Extract File Acquisitions Only Extract acquired files from archives only, no XML audits.ĭefaults '-eo' flag to "files" if not specified. Required to extract from file acquisition archives.
#Redline tools archive
ep Archive Password Provide a password for encrypted archives. eo Extract Output Directory (Only) ! ONE REQUIRED (2/2) - Only extract and do not parse audits.Īrchive files are automatically extracted to input directory o CSV Directory Output ! ONE REQUIRED (1/2) - Parse XML to CSV. # The standardized naming scheme for XML files is as follows: # Extract and rename files from triages packages (.mans), bulk data collections (.zip), and file acquisitions (.zip). i Directory Input ! REQUIRED - (except when '-tlo' used)Ĭan provide multiple comma delimited paths: # GoAuditParser can perform multiple tasks, sometimes independent of other steps, but it usually follows this order:ġ) EXTRACT Extract XML audits and other files from FireEye archives YESĢ) SPLIT Split XML files that are too big into smaller files YESĤ) TIMELINE Timeline CSV data into an output file NO, needs '-tl' You can also see this menu by running GoAuditParser with the -h or -help flags.
Automatically supports the latest FireEye Endpoint Security audit types.Multi-threaded speedy goodness with optimized memory usage.Supports FireEye archive extracting and timelining.Supports most audit data from good old MIR scripts too!.
Parse FireEye XML audit data from FireEye Endpoint Security (previously "HX") and Redline into CSV format.+-+-+ĭownload precompiled builds of the latest version for Windows, Mac, and Linux located in the Releases section. | Extract File Acqs | goauditparser -i -efo -ep | | Extract Audits | goauditparser -i -eo | | Parse & Timeline | goauditparser -i -o -tl |
0 kommentar(er)
