#etw — Public Fediverse posts

No Agent, No Problem: Discovering Remote #EDR

#Windows #ETW

https://jonny-johnson.medium.com/no-agent-no-problem-discovering-remote-edr-8ca60596559f

PerfView and TraceEvent 3.1.18

https://github.com/microsoft/perfview/releases/tag/v3.1.18

#dotnet #perf #etw #lttng #performance

Три слона, на которых держится логирование в Windows

Продолжаем наш цикл статей о типах и методах работы сборщиков данных с конечных точек, или, как принято их называть – агентов. В первой статье мы познакомились с этой сущностью и изучили основные нюансы сбора данных с их помощью. Так как мы в рамках разработки своих продуктов занимаемся и лог-менеджментом, и сбором событий, то хочется поделиться продолжением нашей обширной аналитики в quickstart формате. Поэтому в этом выпуске подробнее разберем функционал и используемые инструменты источников на ОС Windows.

https://habr.com/ru/companies/securityvison/articles/862352/

#Логирование #сбор_событий #eventlog #журналы_windows #журналы_событий #sysmon #event_tracing_for_windows #event_logging #event_log #etw

New blog post! Stack walk profiling NodeJS in Windows: https://blogs.igalia.com/dape/2023/03/14/stack-walk-profiling-nodejs-in-windows/ #etw #webperf cc @igalia (1/4)

Last blog post in my native call stack profiling series just published. This time about the work I did this year in #V8 #Windows #ETW stack walk support: https://blogs.igalia.com/dape/2022/12/21/native-call-stack-profiling-3-3-2022-work-in-v8/

In march, V8 ETW support was broken. After fixing a small regression, we could proceed improving readability of the traces, and improving initialization. This @igalia work was sponsored by #Bloomberg.

The overhead in V8 is very small now, making the traces more accurate. This work is available in V8 10.9.0.

#WebPerf

Just published the second blog post in my native call stack profiling series, about Event Tracing for Windows and #Chromium: https://blogs.igalia.com/dape/2022/11/29/native-call-stack-profiling-2-3-event-tracing-for-windows-and-chromium/

#ETW is the native tracing/profiling tool in #Windows. It samples stack traces for further analysis. #V8 assists providing information of the JIT-compiled functions, then available for stack walk analysis.

Big thanks to @[email protected], for his series of blog posts about performance analysis, and for writing #UIForETW. https://github.com/google/UIforETW

Just published: Solving #Windows Log Collection Challenges with Event Tracing https://nxlog.co/whitepapers/windows-event-tracing #etw

Event Tracing for Windows (ETW) logs kernel, application and other system activity. ETW provides better data and uses less resources.

I also added a section with an example of messing around with ETW for another reason to do ETW data centralization.

This part had to be taken out though: https://infosec.exchange/@superruserr/103514722074754232

@maxg See https://www.youtube.com/watch?v=gj_bOp7JYUU #splunk #logging #etw

Intrusion Detection with #ETW

https://blog.zacbrown.org/2017/04/11/hidden-treasure-intrusion-detection-with-etw-part-1

https://blog.zacbrown.org/2017/05/9/hidden-treasure-intrusion-detection-with-etw-part-2

#infosec

A few tries at sending test #ETW events (from Microsoft-Windows-DNSServer provider) to #Splunk over Syslog. Now just need to find a scenario to show various ETW traces etc.