Jos

Object ID's are ideal for referring to specific events. Can this object ID be included in the report template? For example: {{ event.object_id }} Another suggestion is to make the...

Reading CSV with json

1

Microsoft audit logs contain single-line CSV with a JSON column. I frequently use TimelineExplorer but for the Microsoft audit logs I resort to Splunk so I can "spath" the JSON...