Hello !
Fibratus helps me a lot for my current project. However, I've tried using transformers and it seems to only works for editing parameters that are inside the "kparams" parameter.
For example, my Json output is formated like :
{
"seq": 9714518,
"pid": 4,
"tid": 4128,
"cpu": 1,
"name": "CreateFile",
"category": "file",
"description": "Creates or opens a file or I/O device",
"host": "DESKTOP-J1PAUV7","timestamp": "2025-05-12T16:27:23.8979653+02:00",
"kparams":
{
"attributes": "NORMAL",
"create_disposition": "CREATE",
"create_options": "SYNCHRONOUS_IO_NONALERT",
"file_name": "C:\\Windows\\system32\\Logfiles\\WMI\\RtBackup\\EtwRTNT Kernel Logger.etl",
"file_object": "ffffe50c40d059e0",
"irp": "ffffe50c3dc7fc48",
"share_mask": "READ|DELETE",
"status": "Success",
"tid": 4128,
"type": "File"
},
"meta": {},
"ps":
{
"pid": 4,
"ppid": 0,
"name": "System",
"cmdline": "",
"exe": "System",
"cwd": "",
"sid": "S-1-5-18",
"args": [],
"sessionid": 4294967295
}
}
I managed to remove the "tid" event inside the "kparams" parameter, but I can't remove the "tid" event that is outside it. Is there a way around that ?
If there isn't, I would like that putting a code like that in the fibratus.yml file would work :
transformers:
# Remove transformer deletes provided event parameters.
remove:
# Indicates if the remove transformer is enabled
enabled: true
field:
- tid
Would that be a posibility ?
Hello !
Fibratus helps me a lot for my current project. However, I've tried using transformers and it seems to only works for editing parameters that are inside the "kparams" parameter.
For example, my Json output is formated like :
I managed to remove the "tid" event inside the "kparams" parameter, but I can't remove the "tid" event that is outside it. Is there a way around that ?
If there isn't, I would like that putting a code like that in the fibratus.yml file would work :
Would that be a posibility ?