Beispiel #1
0
        internal static void Start_EVTX_Process()
        {
            try
            {
                Read_EventLog EvntLogSearch = new Read_EventLog();

                PARSE_Commandline_Input(EvntLogSearch);

                Search_EventLog search_Obj = new Search_EventLog(EvntLogSearch.EVTX_File_Logs);

                Settings.SWELF_Events_Of_Interest_Matching_EventLogs = search_Obj.Search(Settings.CMDLine_EVTX_File);

                if (Settings.output_csv)
                {
                    File_Operation.Write_Ouput_CSV(Settings.CMDLine_Output_CSV, Settings.SWELF_Events_Of_Interest_Matching_EventLogs);
                }
                else
                {
                    Start_Write_To_SWELF_EventLogs();
                }

                if (Settings.CMDLine_Dissolve)
                {
                    Settings.Dissolve();
                }
                Error_Operation.WRITE_Stored_Errors();
            }
            catch (Exception e)
            {
                Settings.Stop(Settings.SWELF_CRIT_ERROR_EXIT_CODE, "Start_EVTX_Process() ", e.Message.ToString(), e.StackTrace.ToString());
            }
        }
Beispiel #2
0
        private static void Start_Searching_Logs(int Index)
        {
            try
            {
                Read_EventLog EVNT_Log = new Read_EventLog();

                Sec_Checks.Live_Run_Sec_Checks(Settings.EventLog_w_PlaceKeeper_List.ElementAt(Index));

                EVNT_Log.READ_EventLog(Settings.EventLog_w_PlaceKeeper_List.ElementAt(Index), Settings.EventLog_w_PlaceKeeper[Settings.EventLog_w_PlaceKeeper_List.ElementAt(Index)]);

                if (Data_Store.contents_of_EventLog.Count > 0)
                {
                    Search_EventLog search_Obj = new Search_EventLog();

                    Data_Store.SWELF_Events_Of_Interest_Matching_EventLogs = search_Obj.Search(Settings.EventLog_w_PlaceKeeper_List.ElementAt(Index));
                }
                Data_Store.contents_of_EventLog.Clear();
            }
            catch (Exception e)
            {
                if (e.Message == "Object reference not set to an instance of an object.")
                {
                    Error_Operation.Log_Error("Start_Read_Search_Write_Forward_EventLogs()", Settings.EventLog_w_PlaceKeeper_List.ElementAt(Index) + " " + e.Message.ToString() + " This error means the EventLog was not read or searched. \n", e.StackTrace.ToString(), Error_Operation.LogSeverity.Informataion);
                }
                else if (e.Message.ToString().Contains("The process cannot access the file"))
                {
                    Error_Operation.Log_Error("Start_Read_Search_Write_Forward_EventLogs()", e.Message.ToString() + " OS File lock of vital resource at runtime." + " This error means the EventLog was not read or searched.\n", e.StackTrace.ToString(), Error_Operation.LogSeverity.Warning);
                }
                else
                {
                    Error_Operation.Log_Error("Start_Read_Search_Write_Forward_EventLogs()", " " + Settings.EventLog_w_PlaceKeeper_List.ElementAt(Settings.Total_Threads_Run) + " x=" + (Settings.Total_Threads_Run).ToString() + " " + e.Message.ToString() + ". Check search Syntx." + " This error means the EventLog was not read or searched.\n", e.StackTrace.ToString(), Error_Operation.LogSeverity.Informataion);
                }
            }
            GC.Collect();
        }
Beispiel #3
0
        private static void PARSE_Commandline_Input(Read_EventLog EvntLogSearch)
        {
            for (int x = 0; x < Program_Start_Args.Count; ++x)
            {
                switch (Program_Start_Args.ElementAt(x).ToLower())
                {
                //ONCE YOU ADD COMMAND HERE ADD TO HELP MENU at Settings.SHOW_Help_Menu()
                case "-help":
                {
                    Settings.SHOW_Help_Menu();
                    break;
                }

                case "-h":
                {
                    Settings.SHOW_Help_Menu();
                    break;
                }

                case "?":
                {
                    Settings.SHOW_Help_Menu();
                    break;
                }

                case "-output_csv":
                {
                    Settings.CMDLine_Output_CSV = Program_Start_Args.ElementAt(x + 1);
                    Settings.output_csv         = true;
                    break;
                }

                case "-evtx_file":
                {
                    Settings.CMDLine_EVTX_File = Program_Start_Args.ElementAt(x + 1);
                    EvntLogSearch.READ_EVTX_File(Settings.CMDLine_EVTX_File);
                    Settings.EVTX_Override = true;
                    break;
                }

                case "-evtx_folder":
                {
                    Settings.CMDLine_EVTX_File = Program_Start_Args.ElementAt(x + 1);
                    EvntLogSearch.READ_EVTX_Folder(Settings.CMDLine_EVTX_File);
                    Settings.EVTX_Override = true;
                    break;
                }

                case "-search_terms":
                {
                    Settings.CMDLine_Search_Terms = Program_Start_Args.ElementAt(x + 1);
                    Settings.READ_Search_Terms_File(false, false);
                    break;
                }

                case "-dissolve":
                {
                    Settings.CMDLine_Dissolve = true;
                    break;
                }

                case "-find":
                {
                    Settings.CMDLine_Find_SEARCHTERM = Program_Start_Args.ElementAt(x + 1);
                    break;
                }

                default:
                {
                    break;
                }
                }
            }
        }