Conversation
| # Add your log files to data_library/my-dataset/ | ||
| ``` | ||
|
|
||
| The `filegen` generator automatically discovers and reads files from data library directories. Use it with: |
There was a problem hiding this comment.
This statement isn't true. This generator just accepts any arbitrary path to a directory or file.
| ./blitz --generator-type=filegen --generator-filegen-source=data_library/my-dataset --output-type=stdout | ||
| ``` | ||
|
|
||
| The generator reads files line-by-line and supports timestamp directives (e.g., `%Y-%m-%dT%H:%M:%SZ`) for dynamic timestamp generation. |
There was a problem hiding this comment.
It doesn't read them line by line (or shouldn't), it should randomly select from within the file on each generation.
There was a problem hiding this comment.
I'll correct both of these doc entries and ping you!
There was a problem hiding this comment.
Well, you were correct. I don't know how that made it through. Stupid AI not following directions, and me not being clear enough with the goal of the change to the reviewers.
I've got a PR open to fix it though. #60
| {"timestamp":"%Y-%m-%dT%H:%M:%S.%3NZ","host":"ceos-macboo","subsystem":"com.apple.launchservices","category":"process","process":"bash","pid":1451,"ppid":901,"user":"alice","event_type":"process_launch","message":"Shell spawned immediately after download","path":"/bin/bash","network":null,"result":"success"}, | ||
| {"timestamp":"%Y-%m-%dT%H:%M:%S.%3NZ","host":"ceos-macboo","subsystem":"com.apple.endpointsecurity","category":"execution","process":"bash","pid":1451,"ppid":901,"user":"alice","event_type":"file_execute","message":"Executed downloaded script","path":"/Users/alice/Downloads/eicar_test.sh","network":null,"result":"success"}, | ||
| {"timestamp":"%Y-%m-%dT%H:%M:%S.%3NZ","host":"ceos-macboo","subsystem":"com.apple.XProtectFramework","category":"malware","process":"bash","pid":1451,"ppid":901,"user":"alice","event_type":"signature_match","message":"EICAR-Test-File detected","path":"/Users/alice/Downloads/eicar_test.sh","network":null,"result":"success"}, | ||
|
|
There was a problem hiding this comment.
Another thing I noticed is that sometimes you have extra newlines. I don't know how that will affect the generator. I designed it with the sample files all not having them.
2 participants
Proposed Change
Add a data source that will generate MacOS Unified Logging commands that demonstrate Indicators of Compromise. This includes:
More IOC's to be added for UL.
Checklist