WithSecureLabs / chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Issue with CSV output not populating "Event Data" row

danielgottt opened this issue · comments

commented

Hi Team,

When I output chainsaw detections into a csv I notice the actual data isn't populating within the "Event Data" row. I'll throw my cmdline arguments below along with an example output.

./chainsaw.exe hunt Logs/SOMEFILE.evtx -s sigma/rules/ --mapping mappings/sigma-event-logs-all.yml --full --output results --csv

I am getting detections but nothing is populating within that row 😢
1
2

Hey @danielgottt,

The data is there, if you expand the EventData cell downwards you should be able to see it.

let me know if you still have issues :)

commented

oh boy what a stupid mistake. Appreciate it!