🦖Day 68 of the @velocidex #velociraptor #ArtifactsOfAutumn series
Artifact: Linux[.]Sys[.]JournalCtl
Link: docs.velociraptor.app/exchange/artif…
Artifact: Linux[.]Sys[.]JournalCtl
Link: docs.velociraptor.app/exchange/artif…
This artifact parses the output of the 'journalctl' command. It is used to view systemd logs on a Linux host.
These logs can contain valuable information to incident responders, such as hardware events, kernel messages, network connectivity, service status, and user events.
These logs can contain valuable information to incident responders, such as hardware events, kernel messages, network connectivity, service status, and user events.
Information provided by this artifact includes:
- Timestamp
- Message
- Boot ID
- Machine ID (h)
- Cursor
- Syslog facility/priority (h)
- Monotonic timestamp (h)
- Transport (h)
*h -> column is hidden from the output by default, and can be viewed with the column selector.
- Timestamp
- Message
- Boot ID
- Machine ID (h)
- Cursor
- Syslog facility/priority (h)
- Monotonic timestamp (h)
- Transport (h)
*h -> column is hidden from the output by default, and can be viewed with the column selector.
This artifact could be improved to leverage journalctl's native filtering mechanisms to increase performance, as well as potentially parsing the 'systemd.journal' file directly.
Until then, filtering can be accomplished with Velociraptor's built-in features (transform table).
Until then, filtering can be accomplished with Velociraptor's built-in features (transform table).
That's it for now! Stay tuned to learn about more artifacts! 🦖
• • •
Missing some Tweet in this thread? You can try to
force a refresh
