You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I noticed that the fields in JSON output are outputted in alphabetical order instead of the original order. This makes creating rules a little difficult so it would be better to output in the original order.
Here is the rule that I was creating:
author: Zach Mathis
date: 2024/02/03
modified: 2024/02/03
title: Computer Startup
#details: 'MajorVer: %Data[1]% ¦ BuildNum: %Data[2]% ¦ RevNum: %Data[3]% ¦ UpdateBuildVer: %Data[4]%'
details: 'First: %Data[1]% ¦ Second: %Data[2]% ¦ Third: %Data[3]% ¦ Forth: %Data[4]% ¦ Fifth: %Data[5]%'
description: The computer started up. This event is important because it also contains the OS version information.
id: b27292f1a-18b3-4433-b340-151874a7d4e8
level: informational
status: test
logsource:
product: windows
service: system
detection:
selection:
Channel: System
EventID: 6009
condition: selection
falsepositives:
tags:
references:
ruletype: Hayabusa
When using csv-timeline (./target/release/hayabusa csv-timeline -d ../hayabusa-sample-evtx -r ../hayabusa-rules/hayabusa/builtin/System/Sys_6009_Info_ComputerStartup.yml -C -w -o 6009-test.csv), the order is correct:
However, when I save to JSON (./hayabusa-2.13.-dev json-timeline -d ../hayabusa-sample-evtx -r ../hayabusa-rules/hayabusa/builtin/System/Sys_6009_Info_ComputerStartup.yml -w), the order changes:
I noticed that the fields in JSON output are outputted in alphabetical order instead of the original order. This makes creating rules a little difficult so it would be better to output in the original order.
Here is the rule that I was creating:
When using
csv-timeline
(./target/release/hayabusa csv-timeline -d ../hayabusa-sample-evtx -r ../hayabusa-rules/hayabusa/builtin/System/Sys_6009_Info_ComputerStartup.yml -C -w -o 6009-test.csv
), the order is correct:"2014-11-26 06:52:38.000 +09:00","IE8Win7","Sys",6009,"info",3554,"Computer Startup","First: 6.01. ¦ Second: 7601 ¦ Third: Service Pack 1 ¦ Forth: Multiprocessor Free ¦ Fifth: 17514","-"
However, when I save to JSON (
./hayabusa-2.13.-dev json-timeline -d ../hayabusa-sample-evtx -r ../hayabusa-rules/hayabusa/builtin/System/Sys_6009_Info_ComputerStartup.yml -w
), the order changes:@hitenkoku Could you take a look at this?
The text was updated successfully, but these errors were encountered: