-
Notifications
You must be signed in to change notification settings - Fork 305
Is there a way to output Event Data from powershell output to .csv file from sigma rules? #151
Hey I love this tool, thanks for making it. I was wondering if it's possible to output the same columns found in the powershell output (particularly Event Data fields) to a csv? Would be super useful and I'm not seeing a way how... thanks!
All reactions
Hey @jv2k4ever, so the Sigma mapping file (assuming you are using sigma-event-logs-all.yml) is generic and thus will output all the event data into 'Event Data' column, this should also happen with CSV output.
You can tweak the mapping file to output the columns that are relevant to you by changing the visible flag from false to true.
The reason that the PowerShell Script file has tailored columns is because that is generated by a Chainsaw rule and not a Sigma rule, where the important columns are defined within the rule.
Replies: 1 comment 1 reply
Hey @jv2k4ever, so the Sigma mapping file (assuming you are using sigma-event-logs-all.yml) is generic and thus will output all the event data into 'Event Data' column, this should also happen with CSV output.
Screenshot 2023年12月01日 at 13 49 15
Screenshot 2023年12月01日 at 13 52 46
You can tweak the mapping file to output the columns that are relevant to you by changing the visible flag from false to true.
Screenshot 2023年12月01日 at 13 50 25
The reason that the PowerShell Script file has tailored columns is because that is generated by a Chainsaw rule and not a Sigma rule, where the important columns are defined within the rule.
All reactions
Awesome, thanks so much for responding, this is great. I actually figured out what I needed , when I exported the .csv the event data field in excel is just the following "---" in the cells (i mistakenly thought this was blank), I realized all I had to do was go into Home - Format - and set both "autofill row height" and "autofit column width" and the event data is available. Feel free to close this out : ]
All reactions
-
👍 1