plaso icon indicating copy to clipboard operation
plaso copied to clipboard

Make Windows EventLog tagging rules more robust

Open joachimmetz opened this issue 2 years ago • 0 comments

Currently Windows EventLog tagging rules are based on event source name and identifier. However per https://winevt-kb.readthedocs.io/en/latest/sources/eventlog-providers/index.html is it evident that EventLog can have multiple names and/or an identifier for the same provider (https://winevt-kb.readthedocs.io/en/latest/sources/eventlog-providers/Provider-Microsoft-Windows-COMRuntime.html).

Check/Change the rules to ensure all the known event source names and identifiers are included in the tagging rules.

joachimmetz avatar Aug 09 '22 19:08 joachimmetz