HUNTR EXPORT AS CSV LICENSE
HUNTR EXPORT AS CSV FREE
HUNTR EXPORT AS CSV WINDOWS

users can use the extracted fields to create their use cases. Analyzing EVTX logs : APT-hunter use external library ( evtx ) in order to parse the EVTX log files then using Regex the fields extracted for every events used in APT-Hunter.Analyzing CSV logs : APT-hunter use builtin library ( csv ) in order to parse the CSV log files then using Regex the fields extracted for every events used in APT-Hunter.Collecting logs : user can collect the logs in both CSV and EVTX format manually or use the powershell scripts discussed latter in this article to automatically extract the required logs.

HUNTR EXPORT AS CSV WINDOWS

This tool will be used to speed up windows log analysis but will never replace the deep log analysis.

Turn millions of events into hundreds with severity you can use as a filter.ĪPT-Hunter have two parts that work together to help the user get the data he want quickly.

Personally i used it in many incident and helped me uncover events i missed out and allowed me finish the investigations faster.

HUNTR EXPORT AS CSV FREE

Free Open source tool that will serve you without any limitation.

it will help you in cases you don’t have much time to do deep investigation.

Faster investigating multiple servers in short amount of time.

With the important 60 use cases configured in one place you will invest your time in other data sources.

Output configured to be compatible with timesketch so you can do time line analysis.

faster attack detection which will decrease the response time in order to quickly contain and eradicate the attacks.

Make a good use of the windows event logs you collected.

Detect APT movements in the system based on events from previous discovered APT attacks.

uncover any suspicious activity you don’t know about before it turns to a big incident.

Now if you are using APT-Hunter you will have : also if you search the web there is not much open source tools to analyze windows event logs and many analyst gets lazy and only depend on other forensic sources to uncover system compromise.

HUNTR EXPORT AS CSV LICENSE

Usually the customer does not have SIEM or log collector solution which make it really hard to collect the windows event logs, upload them to ( SIEM solution, parse the data, start searching to uncover any indication of compromise using searches which you have to memorize them in order to not miss anything ) if you have license but if you don’t then you are on your own to enjoy extracting CSV from evtx files and start looking for events in the sheet with millions of events. i work as Security specialist in SOC environment and we provide threat hunting, incident response and forensic investigation to our customers. Many analysts ignore windows event logs or does not know where to search for suspicious activity and most of them does know what event logs to collect in case of attack.

ĪPT-Hunter can be downloaded from here : APT-Hunter Why I Built this Tool ? Kindly note this tool is heavily tested but still a beta version and may contain bugs. If you are a Threat Hunter, Incident Responder or forensic investigator, i assure you will enjoy using this tool, why ? i will discuss the reason in this article and how it will make your life easy just it made mine. APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity without the need to have complicated solution for parsing and detecting attacks in windows event logs like SIEM solutions and log collectors.

Huntr export as csv