I was given several Windows Event Log (.evtx) files exported by a client of mine, and I need to find a way to get OSSEC to read them. I do not have access into their environment and they do not have these systems running OSSEC agents yet, so I cannot request an archive (logall) dump of the data. Is there any way to get an OSSEC agent to read the files? I'm guessing that there may be some way to insert them into the eventchannel configuration of a different Windows system and read them from there, but my testing so far hasn't succeeded. Does anybody have any methods for getting the WinEvtLog messages normally logged by an OSSEC agent out of an .evtx export file? Thanks!
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
