elastic / elastic/integrations
[USN Journal]: Ingest and parse USN journal file
Open
Integration:beat
Integration:windows
needs:triage
Team:Security-Service Integrations
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
Beat [beat]
### Dataset Name
usn.journal
### Integration Version
0
### Agent Version
8.17.3
### OS Version and Architecture
Ubuntu 22.04 LTS
### User Goal
For forensics purpose we would like to ingest the Windows USN journal from all the discs where it's active/enabled.
### Existing Features
https://docs.velociraptor.app/docs/forensic/ntfs/#parsing-usn-journal
https://github.com/osquery/osquery/blob/master/osquery/events/windows/usn_journal_reader.cpp
Both of the above are not ECS conform
### What did you see?
Nothing, as the Integration does not yet exist
### Anything else?
love you 🙏
Contributor guide
Assessment
This issue has not been assessed yet.