microsoft-krabsetw

admin/microsoft-krabsetw

Fork 0

mirror of https://github.com/microsoft/krabsetw synced 2026-06-06 16:14:32 +00:00

Commit Graph

Select branches

Hide Pull Requests

master

tracelogging_support

users/ashroff/sfi

users/mswann/error-handling

users/mswann/on-error

users/mswann/unexpected-events

#10

#100

#102

#104

#105

#107

#108

#110

#111

#112

#113

#115

#116

#117

#118

#119

#12

#120

#121

#123

#124

#125

#126

#127

#128

#129

#130

#131

#132

#134

#135

#14

#140

#141

#144

#145

#146

#148

#149

#151

#153

#154

#155

#158

#16

#162

#163

#164

#166

#167

#168

#169

#170

#171

#172

#174

#175

#179

#18

#180

#181

#185

#186

#19

#191

#194

#196

#198

#204

#206

#207

#209

#21

#210

#215

#22

#226

#227

#23

#231

#234

#236

#239

#24

#241

#242

#243

#244

#250

#254

#255

#256

#257

#258

#261

#265

#267

#269

#271

#272

#273

#274

#275

#276

#28

#29

#3

#30

#32

#34

#35

#38

#40

#41

#43

#45

#46

#48

#51

#54

#55

#56

#57

#59

#60

#65

#68

#7

#72

#75

#8

#82

#84

#86

#9

#90

#91

#92

#93

#94

#95

#96

#97

ac9042c8cf fixed schema event_name parsing (#131) path/to/file 2020-05-07 02:33:37 +10:00
68f98beea9 Bring back process api for trace (#130) Johannes Rave 2020-05-05 17:53:59 +02:00
5dc8b9c3f6 exposed activityId (#129) path/to/file 2020-05-05 07:04:19 +10:00
e141871935 added krabs::sid to parse TDH_INTYPE_SID and TDH_INTYPE_WBEMSID types (#128) path/to/file 2020-05-05 06:58:20 +10:00
67a2b6ffcb Fix compiler errors when winternl.h is included before krabs.hpp. (#127) Derek J. Ravenson 2020-04-23 17:20:33 +01:00
dc92c87460 Read container ID from event extended data (#125) Andrew Gu 2020-04-20 16:52:13 -04:00
261f0bdfb1 Remove Boost Dependency (#126) turingcompl33t 2020-04-20 15:10:09 -04:00
8034e9fa08 Feature/vector predicates (#124) path/to/file 2020-04-17 01:49:07 +10:00
8f503853f5 Adds TraceFlags property to RawProvider for parity with Provider. (#120) Andrew Gu 2020-04-07 20:46:25 -04:00
f7acd9a648 Update schema to support TraceLogging events (#119) pskhodad 2020-04-08 06:07:19 +05:30
f266ea6236 Add getter for property Provider.TraceFlags (#118) Andrew Gu 2020-04-03 16:00:54 -04:00
66fa6ea09f Update nuspec per previous commit (#117) Matt Swann 2020-03-27 09:34:02 -07:00
f8fca78968 Widen trace_flags_ to ULONG to match ENABLE_TRACE_PARAMETERS.EnableProperty. (#116) Andrew Gu 2020-03-27 12:21:41 -04:00
7ae868c9c1 Suppress wchar_t to char narrowing when constructing error messages (#115) Matt Swann 2020-03-24 09:18:08 -07:00
75a5be3406 Fixed Windows 7 support (#110) (#113) John U 2020-03-19 04:44:44 +11:00
3e974bd0c7 Create github action ci flow (#112) Johannes Rave 2020-03-13 19:25:27 +02:00
1d1997c314 Fix record builder for TDH_INTYPE_SID (#111) Johannes Rave 2020-03-13 18:35:48 +02:00
a57fc2df56 Wininet parsing (#105) Johannes Rave 2020-03-11 18:31:06 +02:00
5ad82eff2a added PERFINFO_GROUPMASK typedefs and macros (#108) John U 2020-03-11 04:45:55 +11:00
1077fd1a7b added support for additional kernel trace types (#106) (#107) John U 2020-03-10 06:12:08 +11:00
633d5c6e99 fixed bug introduced in thread-safe schema_locator bugfix (#103) (#104) John U 2020-03-04 03:22:08 +11:00
c9b1de7aff fixed PreBuildEvent that was looking for 35MSSharedLib1024.snk in wrong folder (#102) path/to/file 2020-02-27 03:47:10 +11:00
02abe921e8 Added krabs dir to Microsoft.O365.Security.Native.ETW's AdditionalIncludeDirectories (#100) path/to/file 2020-02-25 12:56:35 +11:00
9863c2cb8a [bugfix] thread-safe schema_locator (#61) (#96) John U 2020-02-10 03:20:09 +11:00
3fe54c812c Update Nuget versions to 3.0.0 (#97) Matt Swann 2020-01-17 09:35:13 -08:00
46cff75065 deprecate process() (#95) John U 2020-01-18 03:23:36 +11:00
66ff440b91 .stop() should always call ControlTrace(STOP) - even if .open()/.start() has not been called (#90) John U 2020-01-16 08:57:01 +11:00
a45815005d Add ability to specify trace (performance) properties (#80) [C++ only] (#92) John U 2020-01-16 04:42:19 +11:00
aad6efc81f tracing Microsoft-Windows-Security-Auditing (#5) (#93) John U 2020-01-15 05:08:55 +11:00
396d8cc971 add missing kernel convenience providers (#94) John U 2020-01-15 04:52:38 +11:00
6a0f093f77 updated exception to reflect decoupling of open() and process() (#91) John U 2020-01-08 08:53:52 +11:00
5b110cadf0 Cosmetic fixes (wording, formatting) (#86) Andrea Spadaccini 2019-10-14 16:32:35 +01:00
ab944eeef1 Add support in C++/CLI for native ETW filtering (#84) Matt Swann 2019-09-30 11:31:47 -07:00
249fd3b601 Added <vector> include to event_filter.hpp to make it compile on VS2019 (#75) Stefan Boberg 2019-06-07 01:50:07 +02:00
9c99ea3ecc Add early return when finding provider by name (#72) Matt Swann 2019-02-25 09:12:23 -08:00
0b42d12c33 Address code review feedback from @kallanreed (#68) Matt Swann 2019-02-14 15:22:07 -08:00
2cc089a0b7 Formatting updates and a little cleanup. (#65) Zac Brown 2018-12-29 21:44:55 -08:00
f4aa34ff7e boosting krabs performance by filtering by event id on api level (without predicates) (#60) Issahar G 2018-12-28 21:22:51 +02:00
b218ae358b Update .nuspec dependency to match the dependency in the build (#59) Matt Swann 2018-10-27 06:03:02 -07:00
6240e000ec Address additional nuget compliance requirements (#57) Matt Swann 2018-10-04 11:15:47 -07:00
10661ab379 Comply with requirements for MSFT-owned nuget packages (#56) Matt Swann 2018-10-02 12:14:48 -07:00
2e5319b0ae Update nuget version to 1.0.13 (#55) Matt Swann 2018-09-27 19:03:01 -07:00
c99ac2a4b8 Provide separate open() and process() session calls (#54) aydany 2018-09-27 14:18:57 -04:00
d613afe628 Improve property parsing (#41) aydany 2018-09-27 12:10:21 -04:00
00eb0cbcb3 Address issues related to setting the C++ standard to C++17. Also upgrades boost to 1.68. (#51) Zac Brown 2018-09-19 11:49:26 -07:00
7e2dc32793 system_call_provider fix, and FileIo provider addition (#48) Stefan Boberg 2018-09-19 04:56:18 +02:00
16580008af Update nuget versions (#46) Matt Swann 2018-05-03 10:58:37 -07:00
6abb879776 Add filtering by primitive types (#45) mjeong92 2018-05-02 14:36:58 -07:00
ed1feacc52 Fix errors when building with /permissive- (#42) (#43) Johannes Rave 2018-04-12 07:43:50 +03:00
b1a45bc6cc Fix mis-used flag. (#40) Zac Brown 2018-02-21 10:50:24 -08:00
b7bde6b0b1 Update compilation readme to include notes about UNICODE. (#38) Zac Brown 2018-02-18 14:03:20 -08:00
de2d6d0ed5 Use proper name for krabsetw. (#35) Zac Brown 2018-01-10 13:35:19 -08:00
53e7b52251 Update CONTRIBUTING.md with Code Of Conduct and CLA requirements. (#34) Zac Brown 2018-01-02 14:01:22 -08:00
75e40c16d2 Merge pull request #32 from Microsoft/users/zacbrown/better-managed-exceptions Zac Brown 2017-11-12 23:41:30 -08:00
43786931f4 Update nuspec files. Zac Brown 2017-11-12 15:49:59 -08:00
822bc5309e Improve exceptions in nightmare.hpp. Check if krabs::binary data is null before passing it to Marshal::Copy. Zac Brown 2017-11-11 22:52:22 -08:00
1a82891a1c Bugfix threadid implementation for EventUserMetadata::ThreadId (#30) Zac Brown 2017-10-24 09:59:56 -07:00
b408b3a073 Update nuspecs (#29) Zac Brown 2017-10-20 11:17:24 -07:00
8ff48197d1 Bugfixes and feature requests from community. (#28) Zac Brown 2017-10-19 17:36:17 -07:00
328de28beb Move to scripts directory. Zac Brown (ODSP SECURITY) 2017-05-18 14:58:18 -07:00
047572b80b Add script for building, signing, and packaging. Zac Brown (ODSP SECURITY) 2017-05-18 14:57:38 -07:00
adf4091a3d Update package version. Zac Brown (ODSP SECURITY) 2017-05-18 13:44:27 -07:00
3dff28ae64 Better exception for when no ETW trace sessions remaining (#24) Zac Brown 2017-05-16 10:51:44 -07:00
00c76c0631 NuSpec updates for 1.0.7. Zac Brown (ODSP SECURITY) 2017-05-10 15:02:58 -07:00
4c1a1adeba Merge branch 'master' of https://github.com/Microsoft/krabsetw Zac Brown (ODSP SECURITY) 2017-05-10 15:01:41 -07:00
cd1a5013ed Remove forced unmanaged code compilation of comparers.hpp. (#23) Zac Brown 2017-05-10 15:01:25 -07:00
f5c0a55ee0 Updated nuspec files. Zac Brown (ODSP SECURITY) 2017-05-09 15:59:15 -07:00
364864cdb7 Ensure that comparers.hpp is compiled as unmanaged code. (#22) Zac Brown 2017-05-09 15:55:05 -07:00
ab3b3c4941 Merge pull request #21 from zacbrown/master Kyle Reed 2017-04-24 12:05:41 -07:00
12f32bfda4 Fix kernel examples. Zac Brown 2017-04-24 11:09:23 -07:00
7086e5955b Updated NuSpec files. Zac Brown (ODSP SECURITY) 2017-04-20 11:10:48 -07:00
dc4de17565 Merge pull request #19 from zacbrown/master Kyle Reed 2017-03-24 15:42:22 -07:00
d2a053e762 Create DebugSigning and ReleaseSigning build targets for when we release to NuGet. This fixes issues with delay signing and the regular Debug/Release builds. Zac Brown (ODSP SECURITY) 2017-03-24 15:06:56 -07:00
cf8c1dde88 Add support for ends_with/iends_with property value matching in filter code. (#18) Zac Brown 2017-03-24 14:44:17 -07:00
ec8ac3800d Add tests for ends_with/iends_with. Zac Brown (ODSP SECURITY) 2017-03-24 12:37:01 -07:00
595ace6807 Fix broken test in GitHub build. Zac Brown (ODSP SECURITY) 2017-03-24 12:36:52 -07:00
aa8691aa10 Add support for EndsWith/IEndsWith in property value matching. Zac Brown (ODSP SECURITY) 2017-03-24 11:51:53 -07:00
c943a9ad4b Merge remote-tracking branch 'upstream/master' Zac Brown (ODSP SECURITY) 2017-03-24 11:38:43 -07:00
c5534af0eb Updates to nuspec files and managed build definition. Zac Brown 2017-03-08 10:51:19 -08:00
14f78f54c2 Support fixed-length strings in collection_view (#16) Kyle Reed 2017-03-07 15:09:24 -08:00
956e2549b9 Add instructions for checking the signing key on the NuGet binaries. Zac Brown (ODSP SECURITY) 2017-03-03 13:45:02 -08:00
ee5c1030cb New NuGet for string length fix for certain ETW providers. Zac Brown (ODSP SECURITY) 2017-03-03 13:39:28 -08:00
18d96c1277 Update nuspec for 1.0.1. Zac Brown (ODSP SECURITY) 2017-03-03 13:30:30 -08:00
af59f4363a Merge pull request #14 from kallanreed/master Zac Brown 2017-03-01 16:09:03 -08:00
fd9dd3cc5a typo Kyle Reed 2017-03-01 16:04:38 -08:00
cd84021311 Fix bug where null terminated strings contained terminator Kyle Reed 2017-03-01 16:02:28 -08:00
b3b8934249 Merge remote-tracking branch 'upstream/master' Zac Brown (ODSP SECURITY) 2017-02-27 14:40:19 -08:00
fbe5b57893 Merge pull request #12 from kallanreed/master Zac Brown 2017-02-24 16:09:57 -08:00
cc4f558b8a Explicitly set the length of ansi and unicode strings on creation Kyle Reed 2017-02-24 16:01:21 -08:00
5b56b4fb6f Force usage of TDH to get property size when arrayvalue is being processed. (#10) Zac Brown 2017-01-31 12:07:40 -08:00
ce7db36b6e More general solution for handling when property Flags are set on EVENT_PROPERTY_INFO. Zac Brown (ODSP SECURITY) 2017-01-31 11:59:20 -08:00
71ba538d0c Merge branch 'master' of https://github.com/zacbrown/krabsetw Zac Brown (ODSP SECURITY) 2017-01-31 11:12:57 -08:00
f9eb0cb909 Merge remote-tracking branch 'upstream/master' Zac Brown (ODSP SECURITY) 2017-01-31 11:12:43 -08:00
a3582ad6c7 Force usage of TDH to get property size of array types. Should this prove to be a performance penalty in the longterm, we will revisit optimizing for heuristic sizing. Zac Brown (ODSP SECURITY) 2017-01-31 11:12:35 -08:00
24506375e3 Add link to ETW Primer on README.md. Zac Brown 2016-12-29 12:03:21 -05:00
acf3c2dfee Add UsingMessageAnalyzerToFindETWSources.md to README (#9) Zac Brown 2016-12-13 14:03:19 -08:00
e5a8c9a437 Add link to Message Analyzer howto in README. Zac Brown 2016-12-13 14:02:52 -08:00
2709793099 Merge remote-tracking branch 'upstream/master' Zac Brown 2016-12-13 14:00:52 -08:00
a8b44259fd Add document for using Message Analyzer to find new ETW sources. (#8) Zac Brown 2016-12-13 13:58:03 -08:00
f3ab2a99ae Update links to images. Zac Brown 2016-12-13 12:49:18 -08:00

1 2 3 4 5 ...