Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

finalize 2.9.0 #1180

Merged
merged 7 commits into from
Sep 22, 2023
Merged

finalize 2.9.0 #1180

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
605214f
finalize 2.9.0
YamatoSecurity Sep 21, 2023
c4c6044
Update CHANGELOG-Japanese.md
YamatoSecurity Sep 21, 2023
d94392a
Update CHANGELOG.md
YamatoSecurity Sep 21, 2023
9bc02f9
Merge branch 'main' into finalize-2.9.0
hitenkoku Sep 22, 2023
c0101db
build(Cargo): cargo update and modified evtx crate reference
hitenkoku Sep 22, 2023
ecfcbf8
update changelog
YamatoSecurity Sep 22, 2023
872c0bd
optimize thread number
YamatoSecurity Sep 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 4 additions & 11 deletions CHANGELOG-Japanese.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,31 +1,24 @@
# 変更点

## 2.9.0 [2023/XX/XX] "xxx Release"

**新機能:**

- XXX
## 2.9.0 [2023/09/22] "Autumn Rain Release"

**改善:**

- ディレクトリパスの指定にバックスラッシュを使用すべきではないことを示すエラーメッセージを追加した。 (#1166) (@hitenkoku, 提案者: @joswr1ght)
- 一度に読み込むレコード数の最適化。(#1175) (@yamatosecurity)
- プログレスバー内にあるバックスラッシュの表示をスラッシュに変更した。 (#1172) (@hitenkoku)
- JSON形式で出力する際に、`count`ルールの`Details`フィールドを文字列にし、パースしやすくした。(#1179) (@hitenkoku)

**バグ修正:**

- XXX

**その他:**

- XXX
- まれにJSONフィールドが正しくパースされない状態を修正した。(#1145) (@hitenkoku)

## 2.8.0 [2023/09/01] "Double X Release"

**新機能:**

- フィールドマッピング設定に16進数値を10進数に変換する`HexToDecimal`機能に対応した。 (元の16進数のプロセスIDを変換するのに便利。) (#1133) (@fukusuket)
- `csv-timeline`と`json-timeline`に`-x, --recover-records`オプションを追加し、空ページのファイルカービングによってevtxレコードを復元できるようにした。(#952) (@hitenkoku) (Evtxカービング機能は@forensicmattに実装された。)
- `csv-timeline`と`json-timeline`に`-x, --recover-records`オプションを追加し、evtxのスラックスペースのファイルカービングによってevtxレコードを復元できるようにした。(#952) (@hitenkoku) (Evtxカービング機能は@forensicmattに実装された。)
- `csv-timeline`と`json-timeline`に`-X, --remove-duplicate-detections`オプションを追加した。(`-x`を使用する場合、重複データのあるバックアップログを含める場合などに便利。) (#1157) (@fukusuket)
- `csv-timeline`、`json-timeline`、`logon-summary`、`eid-metrics`、`pivot-keywords-list`、`search`コマンドに、直近のイベントだけをスキャンするための`--timeline-offset`オプションを追加した。 (#1159) (@hitenkoku)
- `search`コマンドに`-a, --and-logic`オプションを追加し、複数のキーワードをAND条件で検索できるようにした。 (#1162) (@hitenkoku)
Expand Down
23 changes: 6 additions & 17 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,35 +1,24 @@
# Changes

## 2.9.0 [2023/XX/XX] "xxx Release"

**New Features:**

- XXX

**New Features:**

- XXX
## 2.9.0 [2023/09/22] "Autumn Rain Release"

**Enhancements:**

- Added an error message to indicate that when you can't load evtx files in Windows due to specifying a directory path with spaces in it, you need to remove the trailing backslash. (#1166) (@hitenkoku, thanks for the suggestion from @joswr1ght)
- Optimized the number of records to load at a time. (#1175) (@yamatosecurity)
- Replaced double backslashes in paths in under the progress bar on Windows systems with single forward slashes. (#1172) (@hitenkoku)
- Optimized the number of records to load at a time for performance. (#1175) (@yamatosecurity)
- Replaced double backslashes in paths under the progress bar on Windows systems with single forward slashes. (#1172) (@hitenkoku)
- Made the `Details` field for `count` rules a string in the JSON output for easier parsing. (#1179) (@hitenkoku)

**Bug Fixes:**

- XXX

**Other:**

- XXX
- Fixed JSON fields would not be correctly parsed in rare cases. (#1145) (@hitenkoku)

## 2.8.0 [2023/09/01] "Double X Release"

**New Features:**

- Added support for `HexToDecimal` in the field mapping configuration files to convert hex values to decimal. (Useful for converting the original process IDs from hex to decimal.) (#1133) (@fukusuket)
- Added `-x, --recover-records` option to `csv-timeline` and `json-timeline` to recover evtx records through file carving on empty pages. (#952) (@hitenkoku) (Evtx carving feature is thanks to @forensicmatt)
- Added `-x, --recover-records` option to `csv-timeline` and `json-timeline` to recover evtx records through file carving in evtx slack space. (#952) (@hitenkoku) (Evtx carving feature is thanks to @forensicmatt)
- Added `-X, --remove-duplicate-detections` option to `csv-timeline` and `json-timeline` to not output any duplicate detection entries. (Useful when you use `-x`, include backup logs or logs extracted from VSS with duplicate data, etc...)
- Added a `--timeline-offset` option to `csv-timeline`, `json-timeline`, `logon-summary`, `eid-metrics`, `pivot-keywords-list` and `search` commands to scan just recent events based on a offset of years, months, days, hours, etc... (#1159) (@hitenkoku)
- Added a `-a, --and-logic` option in the `search` command to search keywords with AND logic. (#1162) (@hitenkoku)
Expand Down
Loading