-
Notifications
You must be signed in to change notification settings - Fork 305
Search timestamp version 2.5.0 #118
Hi, I'm trying to use the search module but always fail and the error that came is: "error: a value is required for '--timestamp ' but none was supplied" and the documentation just said: "--timestamp The field that contains the timestamp"
I use the version 2.1.1 and I want to update, but with this error I can't make any search.
What parameters do I need to use?
All reactions
Heya,
So you should be able to use timestamp like follows:
chainsaw search --timestamp Event.System.TimeCreated --from '2020-03-21T05:00:25' --to '2020-03-21T06:00:25' -t 'Event.System.EventID: =7' /tmp/EVTX-ATTACK-SAMPLES
Where --timestamp is used to specify the field that contains the timestamp value you wish to apply date range filtering to. Then you can use --from and/or --to to filter the time on the specified field.
Is there anything we could add to make it easier to understand?
Replies: 1 comment 1 reply
Heya,
So you should be able to use timestamp like follows:
chainsaw search --timestamp Event.System.TimeCreated --from '2020-03-21T05:00:25' --to '2020-03-21T06:00:25' -t 'Event.System.EventID: =7' /tmp/EVTX-ATTACK-SAMPLES
Where --timestamp is used to specify the field that contains the timestamp value you wish to apply date range filtering to. Then you can use --from and/or --to to filter the time on the specified field.
Is there anything we could add to make it easier to understand?
All reactions
Hi Alex,
Thank you so much. It works!
All reactions
-
👍 1