Skip to content

Instantly share code, notes, and snippets.

@automine

automine/props.conf

Created October 20, 2016 16:44
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save automine/33bb9d3f1ed4840edd451fb545e5410e to your computer and use it in GitHub Desktop.
Save automine/33bb9d3f1ed4840edd451fb545e5410e to your computer and use it in GitHub Desktop.
Download ZIP
Raw
props.conf
#Returns most of the space savings XML would provide SEDCMD-clean_fluff_from_winsec_events_this_event
SEDCMD-0-windows-event-formater = s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g s/(?m)(\:)(\s+NULL SID)$/\1/g s/(?m)(ID\:)(\s+0x0)$/\1/g
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment