From 593ab6066bb69aa4f90f43e0f33f244598a1912b Mon Sep 17 00:00:00 2001 From: pathtofile Date: Fri, 15 Jan 2021 17:25:50 +1100 Subject: [PATCH] updated links in docs --- docs/BUFFERING.md | 4 ++-- docs/FILTERING.md | 12 ++++++------ docs/PARSING_DATA.md | 4 ++-- docs/SCENARIOS.md | 12 ++++++------ 4 files changed, 16 insertions(+), 16 deletions(-) diff --git a/docs/BUFFERING.md b/docs/BUFFERING.md index 2bae8bf..82da9e5 100644 --- a/docs/BUFFERING.md +++ b/docs/BUFFERING.md @@ -9,8 +9,8 @@ number of `cmd.exe`s seen that minute. There are two things to configure to enable buffering: - - [Buffering Timeout](#Buffering%20Timeout) - - [Per-Provider Buffers](#Per-Provider%20Buffers) + - [Buffering Timeout](#Buffering-Timeout) + - [Per-Provider Buffers](#Per-Provider-Buffers) ## Buffering Timeout By setting the `buffering_timout_seconds` option in the `session_properties` config diff --git a/docs/FILTERING.md b/docs/FILTERING.md index 6ff7d81..b65fc2f 100644 --- a/docs/FILTERING.md +++ b/docs/FILTERING.md @@ -1,7 +1,7 @@ # Filtering - - [Filtering Overview](#Filtering%20Overview) - - [Filter Lists](#Filter%20Lists) - - [Filter Types](#Filter%20Types) + - [Filtering Overview](#Filtering-Overview) + - [Filter Lists](#Filter-Lists) + - [Filter Types](#Filter-Types) # Filtering Overview @@ -103,20 +103,20 @@ For each filter key, you can either set it to a value (either a number or string If an array, it is the same as if the array is a mini `any_of` list, where the event only has to match one of them to match. The possible filters are: - - [Header Filters](#Header%20Filters) + - [Header Filters](#Header-Filters) - [event_id_is](#event_id_is) - [opcode_is](#opcode_is) - [process_id_is](#process_id_is) - [version_is](#version_is) - [activity_id_is](#activity_id_is) - [process_name_contains](#process_name_contains) - - [Property Filters](#Property%20Filters) + - [Property Filters](#Property-Filters) - [property_is](#property_is) - [property_equals/property_iequals](#property_equals/property_iequals) - [property_contains/property_icontains](#property_contains/property_icontains) - [property_starts_with/property_istarts_with](#property_starts_with/property_istarts_with) - [property_ends_with/property_iends_with](#property_ends_with/property_iends_with) - - [Discovery Filters](#Discovery%20Filters) + - [Discovery Filters](#Discovery-Filters) - [any_field_contains](#any_field_contains) - [max_events_total](#max_events_total) - [max_events_id](#max_events_id) diff --git a/docs/PARSING_DATA.md b/docs/PARSING_DATA.md index b803a31..0817d2e 100644 --- a/docs/PARSING_DATA.md +++ b/docs/PARSING_DATA.md @@ -1,6 +1,6 @@ # Parsing Data - - [Event Format](#Event%20Format) - - [Parsing Data](#Parsing%20Data) + - [Event Format](#Event-Format) + - [Parsing Data](#Parsing-Data) ## Event Format diff --git a/docs/SCENARIOS.md b/docs/SCENARIOS.md index 73ab4ad..35b2cfb 100644 --- a/docs/SCENARIOS.md +++ b/docs/SCENARIOS.md @@ -8,12 +8,12 @@ These great blogs provide a great example of the power of ETW, TraceLogging, and # Example uses using Sealighter - - [Tracking process execution](#Tracking%20process%20execution) - - [Find data in any field](#Find%20data%20in%20any%20field) - - [Find correlated Events](#Find%20correlated%20Events) - - [Use Stack Traces](#Use%20Stack%20Traces) - - [Use Buffering](#Use%20Buffering) - - [WPP Tracing](#WPP%20Tracing) + - [Tracking process execution](#Tracking-process-execution) + - [Find data in any field](#Find-data-in-any-field) + - [Find correlated Events](#Find-correlated-Events) + - [Use Stack Traces](#Use-Stack-Traces) + - [Use Buffering](#Use-Buffering) + - [WPP Tracing](#WPP-Tracing) # Tracking process execution Lets trace a program using [Zac Brown's ideas](https://zacbrown.org/2017/04/11/hidden-treasure-intrusion-detection-with-etw-part-1). Create the Following Config: