ceramicskate0 / SWELF

Simple Windows Event Log Forwarder (SWELF). Its easy to use/simply works Log Forwarder and EVTX Parser. Almost in full release here at https://github.com/ceramicskate0/SWELF/releases/latest.

https://ceramicskate0.github.io/SWELF/

ceramicskate0/SWELF Issues

SPLUNK .Net SDKs now out
Updated a year ago
Add macros to find in Searchs.txt to Log Sources
Closed 3 years ago
Add new sysmon event ID's from 2018 to today
Closed 3 years ago
.cpl
Closed 3 years ago
Add to searchs.txt for cmdline
Closed 3 years ago1
Add to search,txt
Closed 3 years ago1
SWELF may have searching issues in Search.cs (v0.6.1.0)
Updated 4 years ago
Update SWELF_SPLUNK_DASHBOARD.xml
Closed 4 years ago1
SWELF will log the full URL to the error log of application when it is unable to access it
Closed 4 years ago
SWELF CPU usage to High in 0.5.0.3
Closed 4 years ago1
Not all Errors being recorded
Updated 4 years ago
MultiSearch Feature not logging to event log as multisearh
Updated 4 years ago1
SWELF 0.6.1.0 Crash under certain conditions for SEND_Errors_To_Central_Location()
Updated 4 years ago
Send Logs in JSON Format
Updated 4 years ago
Add feature for tcp TLS connection
Closed 4 years ago
When SWELF reads in EventLogs it stores compmressed but also in cleartext
Updated 4 years ago
Error log default output has typo
Closed 4 years ago
Add App_Config option to parse out sysmon
Closed 4 years ago
INCORRECT ERROR everyrun Severity=critical MethodInCode=SEC_Check_Failed() Message=SEC_Check Fail the reg hostname != to the config hostname for log_collector1. Possible SWELF config integrity issue.
Closed 4 years ago1
ips.txt and hash.txt file name is backwards
Closed 4 years ago
Reg keys still contain SWELF in name vice what ever app was renamed to
Closed 4 years ago
Newest SWELF Version cuts off some eventdata in logs
Closed 4 years ago
File and Directory to monitor default settings cause crash
Closed 4 years ago1
Add sysmon integ check feature addition
Closed 4 years ago3
Complete TODO in app comments and remove comemnts
Closed 4 years ago
0.5.0.4 sensitve files not always encrypting after 2nd run
Closed 4 years ago
Send Logs over tcp SSL/TLS
Updated 4 years ago3
Lock down install dir for SWELF
Updated 4 years ago5
After Code refactor UPDATE DOCS
Closed 4 years ago
Look at redoing multisearch feature to use regex vice loop
Closed 4 years ago1
Add msbuild IOC to searchs.txt
Closed 4 years ago1
ADD to template
Closed 4 years ago1
add Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command
Closed 4 years ago1
add eventid 1042
Closed 4 years ago1
Add DelegateExecute reg value for UAC bypasses
Closed 4 years ago1
Add forfiles.exe
Closed 4 years ago1
add C:\Windows\System32\wsreset.exe
Closed 4 years ago1
Explore the Idea of Search_Rule Comments in Log_of_interest output
Updated 4 years ago
Add MSSQL log event ID's
Updated 4 years ago
Default files created during install appear to have _ in them and some dont.
Closed 5 years ago
SWELF 1st run takes 5 runs to setup
Closed 5 years ago2
Current version in test has issue with wrong search term in eventlog on system
Closed 5 years ago3
SWELF Keep track of failed connection attempts by Date
Closed 5 years ago
Send Logs of all Network Connections Excerpt Browsers Search
Closed 5 years ago
Redo the "not_in_log" search logic
Closed 5 years ago
Fresh install not working
Closed 5 years ago1
Add reg key for wdigest
Closed 5 years ago1
SWELF 0.5.0.0 re reading old logs every run.
Closed 5 years ago1
Search_Command that will search only network connections for hits on IP or part of/whole match of Domain/TLD
Closed 5 years ago1
event Log for SWELF Alerts/issues/and bugs on machine
Closed 5 years ago