diff --git a/TimberWinR/Parser.cs b/TimberWinR/Parser.cs index 6cfcaf6..52311ee 100644 --- a/TimberWinR/Parser.cs +++ b/TimberWinR/Parser.cs @@ -238,6 +238,7 @@ namespace TimberWinR.Parser FormatMsg = true; FullText = true; BinaryFormat = FormatKinds.ASC; + FullEventCode = false; Fields = new List(); Fields.Add(new Field("EventLog", "string")); diff --git a/WindowsEvents.md b/WindowsEvents.md index 6e35d70..1c274af 100644 --- a/WindowsEvents.md +++ b/WindowsEvents.md @@ -7,11 +7,26 @@ The following parameters are allowed when configuring WindowsEvents. | Parameter | Type | Description | Legal Values | Default | | :---------------- |:---------------| :----------------------------------------------------------------------- | :--------------------------- | :-- | | *source* | property:string |Windows event logs | Application,System,Security | | -| *binaryFormat* | property:string |Format of the "Data" binary field. | ASC,HEX,PRINT | ASC | -| *msgErrorMode* | property:string |Behavior when event messages or event category names cannot be resolved. |NULL,ERROR,MSG | MSG | -| *direction* | property:string |Format of the "Data" binary field. | FW,BW | FW | -| *stringsSep* | property:string |Separator between values of the "Strings" field. | any string | \| | -| *fullEventCode* | property:bool |Return the full event ID code instead of the friendly code. | true,false | false | -| *fullText* | property:bool |Retrieve the full text message | true,false | true | -| *resolveSIDS* | property:bool |Resolve SID values into full account names | true,false | true | -| *formatMsg* | property:bool |Format the text message as a single line. | true,false | true | \ No newline at end of file +| *binaryFormat* | property:string |Format of the "Data" binary field. | ASC,HEX,PRINT | **ASC** | +| *msgErrorMode* | property:string |Behavior when event messages or event category names cannot be resolved. |NULL,ERROR,MSG | **MSG** | +| *direction* | property:string |Format of the "Data" binary field. | FW,BW | **FW** | +| *stringsSep* | property:string |Separator between values of the "Strings" field. | any string | | | +| *fullEventCode* | property:bool |Return the full event ID code instead of the friendly code. | true,false | **false** | +| *fullText* | property:bool |Retrieve the full text message | true,false | **true** | +| *resolveSIDS* | property:bool |Resolve SID values into full account names | true,false | **true** | +| *formatMsg* | property:bool |Format the text message as a single line. | true,false | **true** | +``` +{ + "TimberWinR": { + "Inputs": { + "WindowsEvents": [ + { + "source": "System,Application", + "binaryFormat": "PRINT", + "resolveSIDS": true + } + ] + } + } +} +``` \ No newline at end of file