-
Notifications
You must be signed in to change notification settings - Fork 186
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enhancement: Duplicate detections for logon-summary #1325
Comments
We will look into adding this feature. For now, you might just have to write a script to remove the duplicates. |
Thanks for considering adding this feature. In the mean time I am happy to write a script. Do you happen to know a tool or two which would be suitable for usage in script and at the same time is able to output a format which hayabusa is able to parse? |
@mischw To work around this, you can remove duplicates with the |
@mischw We updated the |
I gave it a try and it looks like a nice way to get the info I need. Thanks for letting me know! |
I saw that the csv-timeline and json-timeline commands support deduplication using the flag
--remove-duplicate-detections
. I think that is incredibly useful. Unfortunately the logon-summary does not have a equivalent flag it seems? The resulting output therefore shows many times more logon attempts when also using evtx from shadow copies for example.Either way I am happy with a solution that allows deduplicated logon-summary. But I thought maybe you hadn't considered adding it as a flag to logon-summary too :)
The text was updated successfully, but these errors were encountered: