Skip to content

Commit

Permalink
Update Linux.Sysinternals.Sysmon.yaml (FullPath -> OSPath) (Velocidex…
Browse files Browse the repository at this point in the history
…#865)

Changed Fullpath to OSPath, as the symbol is not recognised.
  • Loading branch information
angry-bender authored Jun 26, 2024
1 parent 6af3a9e commit 0a1c326
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions content/exchange/artifacts/Linux.Sysinternals.Sysmon.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,8 @@ sources:
SELECT * FROM glob(globs=syslogPath)
}, query={
SELECT grok(grok=sysmonGrok, data=Line) AS Event,
FullPath
FROM parse_lines(filename=FullPath)
OSPath
FROM parse_lines(filename=OSPath)
WHERE Event.program = "sysmon" AND Event.event =~ "<Event>"
})
- LET ParsedEvents = SELECT parse_xml(accessor='data', file=Event.event).Event AS Event FROM UnparsedEvents
Expand Down

0 comments on commit 0a1c326

Please sign in to comment.