Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

isolate invidvidual line parsing errors #36

Merged
merged 1 commit into from
Sep 1, 2022

Conversation

conitrade-as
Copy link
Contributor

@conitrade-as conitrade-as commented Sep 1, 2022

This makes sure parsing continues if e.g. an end tag is missing. We observed this behavior with Sysmon on Linux where lines like this were present in the log (i.e. the </Event> tag is missing, probably because Sysmon truncates the line):

Aug 31 09:40:30 ubuntu sysmon: <Event><System><Provider Name="Linux-Sysmon" Guid="{ff032593-a8d3-4f13-b0d6-01fc615a0f97}"/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime="2022-08-31T07:40:30.235304000Z"/><EventRecordID>6466</EventRecordID><Correlation/><Execution ProcessID="933" ThreadID="933"/><Channel>Linux-Sysmon/Operational</Channel><Computer>ubuntu</Computer><Security UserId="0"/></System><EventData><Data Name="RuleName">-</Data><Data Name="UtcTime">2022-08-31 07:40:30.236</Data><Data Name="ProcessGuid">{40eea3da-106e-630f-55a1-6b0000000000}</Data><Data Name="ProcessId">4969</Data><Data Name="Image">/usr/bin/python3.8</Data><Data Name="FileVersion">-</Data><Data Name="Description">-</Data><Data Name="Product">-</Data><Data Name="Company">-</Data><Data Name="OriginalFileName">-</Data><Data Name="CommandLine">/usr/bin/python3.8 -E -S /usr/lib/python3.8/py_compile.py /usr/lib/python3.8/__future__.py ... /usr/lib/python3.8/fnmatch.py /usr/lib/python3.8/

@wagga40
Copy link
Owner

wagga40 commented Sep 1, 2022

Thanks !

@wagga40 wagga40 merged commit 403ce24 into wagga40:master Sep 1, 2022
@conitrade-as conitrade-as deleted the hotfix/sysmon-parsing branch September 19, 2022 11:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants