You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It looks like the Payload in Details keeps the return characters \\r\\n but they get stripped in AllFieldInfo. For JSON output, I want to keep tabs, spaces, return characters, etc.. as they are in the original log. Is this possible to keep the same for Details, ExtraFieldInfo and AllFieldInfo? (The value of the field should not change.)
"Details": {
"Payload": "CommandInvocation(Out-Default): "Out-Default"\r\n"
},
"ExtraFieldInfo": {
"ContextInfo": "Severity = Informational Host Name = ConsoleHost Host Version = 4.0 Host ID = 7f6359d5-da68-4ff5-8b7e-f3393366b020 Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Engine Version = 4.0 Runspace ID = c8166557-78a4-43a8-843d-dffbe24fa1ab Pipeline ID = 56 Command Name = Command Type = Script Script Name = Command Path = Sequence Number = 392 User = OFFSEC\admmig Shell ID = Microsoft.PowerShell",
"UserData": ""
},
"AllFieldInfo": {
"ContextInfo": "Severity = Informational Host Name = ConsoleHost Host Version = 4.0 Host ID = 7f6359d5-da68-4ff5-8b7e-f3393366b020 Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Engine Version = 4.0 Runspace ID = c8166557-78a4-43a8-843d-dffbe24fa1ab Pipeline ID = 56 Command Name = Command Type = Script Script Name = Command Path = Sequence Number = 392 User = OFFSEC\admmig Shell ID = Microsoft.PowerShell",
"Payload": "CommandInvocation(Out-Default): "Out-Default"",
"UserData": ""
}
It looks like the
Payload
inDetails
keeps the return characters\\r\\n
but they get stripped inAllFieldInfo
. For JSON output, I want to keep tabs, spaces, return characters, etc.. as they are in the original log. Is this possible to keep the same forDetails
,ExtraFieldInfo
andAllFieldInfo
? (The value of the field should not change.)Originally posted by @YamatoSecurity in #1187 (comment)
The text was updated successfully, but these errors were encountered: