Open
Description
When dealing with a folder of EVTX files (collected from an host for offline analysis), it would be nice to be able to point evtq to that folder and have it process all the files recursively instead of having to launch evtq for each file.
In this case (the input is a directory), evtq should enforce the output to be a directory as well where each EVTX file processed as input would generate a JSON/CSV/TSV file as output (input directory structure should be preserved in the output tree)
Ex:
evtq.exe --from-evtx \some\input\dir\with\evtx\ --to-json \some\output\dir
Bonus: the processing of each EVTX file could be multi-threaded !
Metadata
Metadata
Assignees
Labels
No labels