elastic / elastic/integrations

[USN Journal]: Ingest and parse USN journal file

Open
#13,154 5 comments 0 reactions 0 assignees View on GitHub
Integration:beat Integration:windows needs:triage Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Beat [beat]

### Dataset Name

usn.journal

### Integration Version

0

### Agent Version

8.17.3

### OS Version and Architecture

Ubuntu 22.04 LTS

### User Goal

For forensics purpose we would like to ingest the Windows USN journal from all the discs where it's active/enabled.

### Existing Features

https://docs.velociraptor.app/docs/forensic/ntfs/#parsing-usn-journal
https://github.com/osquery/osquery/blob/master/osquery/events/windows/usn_journal_reader.cpp

Both of the above are not ECS conform

### What did you see?

Nothing, as the Integration does not yet exist

### Anything else?

love you 🙏

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.