motherboard_info winreg plugin #4953
Conversation
|
Passed AppVeyor tests, waiting for approvals to start GitHub Actions workflows |
| @@ -31,3 +31,4 @@ | |||
| from plaso.parsers.winreg_plugins import winlogon | |||
| from plaso.parsers.winreg_plugins import winrar | |||
| from plaso.parsers.winreg_plugins import windows_version | |||
| from plaso.parsers.winreg_plugins import motherboard_info | |||
There was a problem hiding this comment.
style nit: please use alphabetical order
plaso/data/formatters/windows.yaml
Outdated
| - '{bios_version}' | ||
| - 'Origin: {key_path}' | ||
| short_source: 'REG' | ||
| source: 'Registry Key' |
There was a problem hiding this comment.
style nit: make sure line has end-of-line character
plaso/data/timeliner.yaml
Outdated
| attribute_mappings: | ||
| - name: 'last_written_time' | ||
| description: 'Content Modification Time' | ||
| place_holder_event: false |
There was a problem hiding this comment.
style nit: make sure line has end-of-line character
|
@elad-levi-cyberark thanks for the proposed plug-in could you provide me a bit of context about your use case, given what it looks like, the plugin does not parse additional values it just wraps them in an unique event data type. |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #4953 +/- ##
=======================================
Coverage 85.05% 85.06%
=======================================
Files 431 432 +1
Lines 38648 38676 +28
=======================================
+ Hits 32873 32898 +25
- Misses 5775 5778 +3 ☔ View full report in Codecov by Sentry. |
I'm using Plaso output in Timesketch, and obviously all registry key value pairs are displayed. If it's a finding (IoC, evidence of execution, etc.) I usually just write a sigma rule in Timesketch, but because this is just info I find it more useful as a data type |
motherboard_info winreg plugin
Description:
This plugin extract from the Windows registry the following information:
Notes:
All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.
One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.
Checklist: