janstarke

# delete all
MATCH (n)
OPTIONAL MATCH (n)-[r]-()
DELETE n,r;

# create process index
CREATE INDEX on :Process(pid);
CREATE INDEX on :File(path);
CREATE INDEX on :RegistryValue(path);

janstarke

#!/bin/bash
MYIP=$1

function configure() {
  sed -i "s~#*$2:.*~$2: $3~" $1
}

CFG=/etc/elasticsearch/elasticsearch.yml
export DEBIAN_FRONTEND=noninteractive
apt install --yes elasticsearch

janstarke

# convert all evtx files to xml files

for F in *.evtx; do evtx_dump "$F">"${F%.evtx}.xml"; done

# create python env
python3 -m venv venv
source venv/bin/activate.fish
pip3 install --upgrade pip
pip3 install regipy

janstarke

| grep '^[0-9][0-9]*|' |awk -F '|' '{OFS="|";print 0,$5,0,0,0,0,0,-1,$1,-1,-1} {}'

janstarke

#!/bin/bash

trap "exit 1" TERM
export TOP_PID=$$

RIP=/usr/local/bin/rip

function tln2csv {
	egrep '^[0-9]+\|' | awk -F '|' '{OFS="|";print 0,$5,0,0,0,0,0,-1,$1,-1,-1}' |mactime2 -b - -d -t "$TIMEZONE"
}

janstarke

#!/usr/bin/perl -w

use strict;
use warnings;
use DateTime;

-r "mounted_devices.txt" or die "unable to read 'mounted_devices.txt'";

my %devices = ();

janstarke

{
    "$schema": "https://lnav.org/schemas/format-v1.schema.json",
    "evtx_timeline": {
        "title": "Windows EVTX timeline",
        "file-pattern": "evtx.*\\.json(\\.gz)?",
        "json": true,
        "line-format": [
            {"field": "ts"},
            "|",
            {"field": "event_id", "min-width": 5, "max-width": 5, "align": "right"},

janstarke

#!/bin/bash

display_usage() {
  echo "$0 <dir with vmdk files>" >&2
}

exit_with_error() {
  MSG="$1"
  echo "$MSG" >&2
  exit 1