Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

keep same for Details, ExtraFieldInfo and AllFieldInfo value #1189

Closed
hitenkoku opened this issue Oct 13, 2023 · 0 comments · Fixed by #1190
Closed

keep same for Details, ExtraFieldInfo and AllFieldInfo value #1189

hitenkoku opened this issue Oct 13, 2023 · 0 comments · Fixed by #1190
Assignees
Labels
invalid This doesn't seem right
Milestone

Comments

@hitenkoku
Copy link
Collaborator

It looks like the Payload in Details keeps the return characters \\r\\n but they get stripped in AllFieldInfo. For JSON output, I want to keep tabs, spaces, return characters, etc.. as they are in the original log. Is this possible to keep the same for Details, ExtraFieldInfo and AllFieldInfo? (The value of the field should not change.)

"Details": {
"Payload": "CommandInvocation(Out-Default): "Out-Default"\r\n"
},
"ExtraFieldInfo": {
"ContextInfo": "Severity = Informational Host Name = ConsoleHost Host Version = 4.0 Host ID = 7f6359d5-da68-4ff5-8b7e-f3393366b020 Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Engine Version = 4.0 Runspace ID = c8166557-78a4-43a8-843d-dffbe24fa1ab Pipeline ID = 56 Command Name = Command Type = Script Script Name = Command Path = Sequence Number = 392 User = OFFSEC\admmig Shell ID = Microsoft.PowerShell",
"UserData": ""
},
"AllFieldInfo": {
"ContextInfo": "Severity = Informational Host Name = ConsoleHost Host Version = 4.0 Host ID = 7f6359d5-da68-4ff5-8b7e-f3393366b020 Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Engine Version = 4.0 Runspace ID = c8166557-78a4-43a8-843d-dffbe24fa1ab Pipeline ID = 56 Command Name = Command Type = Script Script Name = Command Path = Sequence Number = 392 User = OFFSEC\admmig Shell ID = Microsoft.PowerShell",
"Payload": "CommandInvocation(Out-Default): "Out-Default"",
"UserData": ""
}

Originally posted by @YamatoSecurity in #1187 (comment)

@hitenkoku hitenkoku self-assigned this Oct 13, 2023
hitenkoku added a commit that referenced this issue Oct 14, 2023
@hitenkoku hitenkoku added the invalid This doesn't seem right label Oct 14, 2023
@hitenkoku hitenkoku modified the milestones: v2.9.1, v2.10.0 Oct 14, 2023
hitenkoku added a commit that referenced this issue Oct 16, 2023
fixed removed `AllFieldInfo` and `ExtraFieldInfo`  field newline and tab char
hitenkoku added a commit that referenced this issue Oct 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
invalid This doesn't seem right
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant