- Regex for Powershell Channel(s):
From Powershell Channel
|
Pattern detailRegex = /^([^:(]+)\(([^)]+)\)\:\s*(.+)?$/; |
From Forwarded Powershell Channel
|
Pattern detailRegex = /^(.+)\((.+)\)\:\s*(.+)?$/; |
)
I would imagine the first one is the correct one per commit: 75c6fad
Also winlogbeat uses this one as well.
Same is also true for Powershell_Operational Regex
-
40 Differences for Security Channel
There are over 40 differences between the Security Channel log and the same log within the Forwarded Channel despite them being the same log.
-
70 Differences for Sysmon Channel
There are over 70 differences between the Sysmon Channel log and the same log within the Forwarded Channel despite them being the same log.
From Powershell Channel
integrations/packages/windows/data_stream/powershell/elasticsearch/ingest_pipeline/default.yml
Line 264 in 163fd96
From Forwarded Powershell Channel
integrations/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell.yml
Line 240 in 163fd96
)
I would imagine the first one is the correct one per commit: 75c6fad
Also winlogbeat uses this one as well.
Same is also true for Powershell_Operational Regex
40 Differences for Security Channel
There are over 40 differences between the Security Channel log and the same log within the Forwarded Channel despite them being the same log.
70 Differences for Sysmon Channel
There are over 70 differences between the Sysmon Channel log and the same log within the Forwarded Channel despite them being the same log.