pipe ability

[kmelchinger]

I would like to use lovely very useful chainsaw in a pipe e.g. cat windows_eventlog.json | chainsaw hunt. Does this make sense to you?

[FranticTyping]

Hey @kmelchinger

Chainsaw doesn't support STDIN as an input option. You can just load the JSON file as a direct input into chainsaw though, instead of pushing it through cat and |.

[kmelchinger]

Frank, thanx for the quick answer. Even if it has got the wrong non-eventlog extension ?. I know that at the moment STDIN is not implemented but could guess that it could be very useful for other pipe usage ;-).

[FranticTyping]

Yeah, by default chainsaw will load the following file extensions for EVTX files:

• .json
• .jsonl
• .xml
• .evt
• .evtx

Beyond that, you can also pass the --load-unknown flag and it will load the file and attempt to identify if the contents is an event log, MFT, etc.

[FranticTyping]

Ack on the pipe usage. I'll bare it in mind in case we get more requests for it :)

[kmelchinger]

Hopefully not only me will love it. Everything is a stream/pipe... with endless opportunities....