Search timestamp version 2.5.0

[EICP02]

Hi, I'm trying to use the search module but always fail and the error that came is: "error: a value is required for '--timestamp ' but none was supplied" and the documentation just said: "--timestamp The field that contains the timestamp"

I use the version 2.1.1 and I want to update, but with this error I can't make any search.

What parameters do I need to use?

[alexkornitzer]

Heya,

So you should be able to use timestamp like follows:

chainsaw search --timestamp Event.System.TimeCreated --from '2020-03-21T05:00:25' --to '2020-03-21T06:00:25' -t 'Event.System.EventID: =7' /tmp/EVTX-ATTACK-SAMPLES

Where --timestamp is used to specify the field that contains the timestamp value you wish to apply date range filtering to. Then you can use --from and/or --to to filter the time on the specified field.

Is there anything we could add to make it easier to understand?

[EICP02]

Hi Alex,

Thank you so much. It works!