You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Similar to the computer-metrics command in hayabusa, it will stack unique entries of the .Computer field.
I would like to output in the table format for standard output and CSV file output and add Levels and Alerts similar to takajo's stack-services command. It would be nice to print how many alerts for each level and alert.
Example:
Count
Computer
Levels
Alerts
500
ComputerA
crit (10) | high (20) | info (xx)
CobaltStrike Service Installations - System (10) | Alert2 (20) | Alert3 (5) | etc...
100
ComputerB
high (10) | low (10) | info (100)
Drive-by Compromise (10) | etc...
1
ComputerC
hogehoge
hogehoge
The difference between stack-computers and computer-metrics is that stack-computers only gets info from Hayabusa results but Hayabusa's computer-metrics will take metrics on all events regardless of sigma rules.
We should probably add this option: -m=, --minLevel= specify the minimum alert level (default: informational)
Similar to the
computer-metrics
command in hayabusa, it will stack unique entries of the.Computer
field.I would like to output in the table format for standard output and CSV file output and add
Levels
andAlerts
similar to takajo'sstack-services
command. It would be nice to print how many alerts for each level and alert.Example:
The difference between
stack-computers
andcomputer-metrics
is thatstack-computers
only gets info from Hayabusa results but Hayabusa'scomputer-metrics
will take metrics on all events regardless of sigma rules.We should probably add this option:
-m=, --minLevel= specify the minimum alert level (default: informational)
@fukusuket Are you interested in this?
The text was updated successfully, but these errors were encountered: