-
Notifications
You must be signed in to change notification settings - Fork 305
pipe ability #214
I would like to use lovely very useful chainsaw in a pipe e.g. cat windows_eventlog.json | chainsaw hunt. Does this make sense to you?
All reactions
Replies: 1 comment 4 replies
Hey @kmelchinger
Chainsaw doesn't support STDIN as an input option. You can just load the JSON file as a direct input into chainsaw though, instead of pushing it through cat and |.
All reactions
Frank, thanx for the quick answer. Even if it has got the wrong non-eventlog extension ?. I know that at the moment STDIN is not implemented but could guess that it could be very useful for other pipe usage ;-).
All reactions
Yeah, by default chainsaw will load the following file extensions for EVTX files:
- .json
- .jsonl
- .xml
- .evt
- .evtx
Beyond that, you can also pass the --load-unknown flag and it will load the file and attempt to identify if the contents is an event log, MFT, etc.
All reactions
Ack on the pipe usage. I'll bare it in mind in case we get more requests for it :)
All reactions
Hopefully not only me will love it. Everything is a stream/pipe... with endless opportunities....