[
https://issues.apache.org/jira/browse/NIFI-5025?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16418987#comment-16418987
]
Otto Fowler commented on NIFI-5025:
-----------------------------------
What might be better is a more generic component that can do de-duplication
downstream of this or another processor (most likely by type xml, json)
> Improve ParseEVTX to maintain state
> -----------------------------------
>
> Key: NIFI-5025
> URL: https://issues.apache.org/jira/browse/NIFI-5025
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Extensions
> Reporter: Jon Zeolla
> Priority: Major
>
> Currently, ParseEVTX parses Windows EVTX files and sends them without the
> concept of state/duplication. In order to use this on our Windows machines
> we would want such a feature to be more in line with native Windows Event
> Forwarding capabilities (such as
> [this|https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection#how-is-client-progress-tracked]).
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
