All pull requests

Pull requests

• Changes to storage writer to store event label counts in event label count containers #5212

  #5216·kev365 opened Sep 13, 2026Contributor·

  ·
  1

  1

• Added support for the cronie reporter name to the syslog parser #5214

  #5215·kev365 opened Sep 13, 2026Contributor·

  ·
  1

• Added support for invalid user authentication failures to the syslog SSH parser #5183

  #5208·kev365 opened Sep 12, 2026Contributor·

  ·
  1

• Plist recursekey fix

  pending reporter input
  #5108·oh6hay opened May 28, 2026·

  ·
  4

  

• Added iOS Health SQLite (healthdb_secure.sqlite) plugin

  needs workpending reporter input
  #5027·annisadp opened Jan 18, 2026·

  ·

  · Parking/Temporary release
  24

  

• Add DJI Drone Binary TXT

  needs work
  #4967·zienzidan opened Jun 19, 2025·

  ·

  · Parking/Temporary release
  1

  

• Add DJI DAT Parser

  #4966·arilimata opened Jun 18, 2025·

  ·

  · Parking/Temporary release
  1

  

• fix: correct registry value parsing for Amcache plugin parameters

  pending reporter input
  #4965·stetsbemueht opened Jun 18, 2025·

  ·
  1

  

• Add jpeg exif parser

  needs workpending reporter input
  #4941·oh6hay opened Dec 12, 2024·

  ·

  · Parking/Temporary release
  6

  

• Further IIS parsing improvements

  #4921·pyllyukko opened Nov 12, 2024Contributor·

  ·
  1

• Implemented Apple biome file parser

  #4878·rick-slin opened Apr 18, 2024Contributor·

  ·
  1

  4

  

• Draft: implemented text parser plugin for Apple ps.txt files.

  #4861·rick-slin opened Apr 4, 2024Contributor·

  ·
  9

  

• Changes to support event values container

  blocked
  #4850·joachimmetz opened Mar 28, 2024Member·

  ·
  1

  

• Created parser for Apple IPS files.

  #4688·rick-slin opened Jun 15, 2023Contributor·

  ·

  · Parking/Temporary release
  13

  

• Changes to handling unsupported ZIP archive files

  blocked
  #4501·joachimmetz opened Dec 23, 2022Member·

  ·
  1

  

• Add new rules in tag_windows.txt to application_execution tag

  needs closer look
  #4376·lprat opened Nov 10, 2022Contributor·

  ·
  5

  

• DRAFT: MEGAsync parser

  needs closer look
  #4192·hur opened Aug 11, 2022Contributor·

  ·
  1

  3

  

• Add application_execution tag to certain Amcache entries

  blockedneeds closer look
  #4105·pyllyukko opened May 6, 2022Contributor·

  ·
  16

  

• Changes to store source configuration #2287

  blocked
  #3918·joachimmetz opened Nov 6, 2021Member·

  ·
  1

  

• Changed analysis plugins to directly read from storage #3439

  analysisblocked
  #3440·joachimmetz opened Jan 17, 2021Member·

  ·

• Added CPIO archive support #883

  blocked
  #3387·joachimmetz opened Dec 31, 2020Member·

  ·
  1