admin/pathtofile-Sealighter
1
0
Fork 0
mirror of https://github.com/pathtofile/Sealighter synced 2026-06-08 16:41:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

updated links in docs

Browse Source
This commit is contained in:
pathtofile
2021-01-15 17:25:50 +11:00
parent 9b955fa5a2
commit 593ab6066b
4 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/BUFFERING.md
+2 -2
View File
@@ -9,8 +9,8 @@ number of `cmd.exe`s seen that minute.
There are two things to configure to enable buffering:
- [Buffering Timeout](#Buffering%20Timeout)
- [Per-Provider Buffers](#Per-Provider%20Buffers)
- [Buffering Timeout](#Buffering-Timeout)
- [Per-Provider Buffers](#Per-Provider-Buffers)
## Buffering Timeout
By setting the `buffering_timout_seconds` option in the `session_properties` config
docs/FILTERING.md
+6 -6
View File
@@ -1,7 +1,7 @@
# Filtering
- [Filtering Overview](#Filtering%20Overview)
- [Filter Lists](#Filter%20Lists)
- [Filter Types](#Filter%20Types)
- [Filtering Overview](#Filtering-Overview)
- [Filter Lists](#Filter-Lists)
- [Filter Types](#Filter-Types)
# Filtering Overview
@@ -103,20 +103,20 @@ For each filter key, you can either set it to a value (either a number or string
If an array, it is the same as if the array is a mini `any_of` list, where the event only has to match one of them to match.
The possible filters are:
- [Header Filters](#Header%20Filters)
- [Header Filters](#Header-Filters)
- [event_id_is](#event_id_is)
- [opcode_is](#opcode_is)
- [process_id_is](#process_id_is)
- [version_is](#version_is)
- [activity_id_is](#activity_id_is)
- [process_name_contains](#process_name_contains)
- [Property Filters](#Property%20Filters)
- [Property Filters](#Property-Filters)
- [property_is](#property_is)
- [property_equals/property_iequals](#property_equals/property_iequals)
- [property_contains/property_icontains](#property_contains/property_icontains)
- [property_starts_with/property_istarts_with](#property_starts_with/property_istarts_with)
- [property_ends_with/property_iends_with](#property_ends_with/property_iends_with)
- [Discovery Filters](#Discovery%20Filters)
- [Discovery Filters](#Discovery-Filters)
- [any_field_contains](#any_field_contains)
- [max_events_total](#max_events_total)
- [max_events_id](#max_events_id)
docs/PARSING_DATA.md
+2 -2
View File
@@ -1,6 +1,6 @@
# Parsing Data
- [Event Format](#Event%20Format)
- [Parsing Data](#Parsing%20Data)
- [Event Format](#Event-Format)
- [Parsing Data](#Parsing-Data)
## Event Format
docs/SCENARIOS.md
+6 -6
View File
@@ -8,12 +8,12 @@ These great blogs provide a great example of the power of ETW, TraceLogging, and
# Example uses using Sealighter
- [Tracking process execution](#Tracking%20process%20execution)
- [Find data in any field](#Find%20data%20in%20any%20field)
- [Find correlated Events](#Find%20correlated%20Events)
- [Use Stack Traces](#Use%20Stack%20Traces)
- [Use Buffering](#Use%20Buffering)
- [WPP Tracing](#WPP%20Tracing)
- [Tracking process execution](#Tracking-process-execution)
- [Find data in any field](#Find-data-in-any-field)
- [Find correlated Events](#Find-correlated-Events)
- [Use Stack Traces](#Use-Stack-Traces)
- [Use Buffering](#Use-Buffering)
- [WPP Tracing](#WPP-Tracing)
# Tracking process execution
Lets trace a program using [Zac Brown's ideas](https://zacbrown.org/2017/04/11/hidden-treasure-intrusion-detection-with-etw-part-1). Create the Following Config: