All pull requests

Pull requests

• Changes to Firefox downloads plugins to use the same event data #5016

  #5381·nflexfo opened Oct 23, 2026Contributor·3 of 4 tasks·

  ·

  · 2026 December release
  5

• Added test to check the attributes used by the formatters #5016

  on hold
  #5367·nflexfo opened Oct 21, 2026Contributor·2 of 4 tasks·

  ·
  3

• Changed text plugins to resume parsing after consecutive line failures

  needs closer look
  #5349·elhoim opened Oct 12, 2026Contributor·4 tasks done·

  ·

  · 2026 December release
  7

  

• Changes to redact secrets from being stored in the storage file

  needs closer look
  #5348·elhoim opened Oct 12, 2026Contributor·4 tasks done·

  ·

  · 2026 December release
  4

  

• Improved Windows Defender DetectionHistory parser to extract the detection lifecycle timestamps and threat status #5344

  #5345·kev365 opened Oct 11, 2026Contributor·4 tasks done·

  ·

  · 2026 December release
  1

  7

  

• Redact VirusTotal API key from request error written to log #5311

  pending reporter input
  #5312·elhoim opened Oct 9, 2026Contributor·4 tasks done·

  ·
  1

  8

  

• Fixed text parser trying other plugins after a plugin failed

  needs closer look
  #5294·elhoim opened Oct 1, 2026Contributor·4 tasks done·

  ·

  · 2026 December release
  1

  2

  

• Plist recursekey fix

  pending reporter input
  #5108·oh6hay opened May 28, 2026·4 tasks done·

  ·
  4

  

• Added iOS Health SQLite (healthdb_secure.sqlite) plugin

  needs workpending reporter input
  #5027·annisadp opened Jan 18, 2026·2 of 4 tasks·

  ·

  · Parking/Temporary release
  24

  

• Add DJI Drone Binary TXT

  needs work
  #4967·zienzidan opened Jun 19, 2025·3 of 4 tasks·

  ·

  · Parking/Temporary release
  1

  

• Add DJI DAT Parser

  #4966·arilimata opened Jun 18, 2025·3 of 4 tasks·

  ·

  · Parking/Temporary release
  1

  

• fix: correct registry value parsing for Amcache plugin parameters

  pending reporter input
  #4965·stetsbemueht opened Jun 18, 2025·1 of 4 tasks·

  ·
  1

  

• Add jpeg exif parser

  needs workpending reporter input
  #4941·oh6hay opened Dec 12, 2024·2 of 3 tasks·

  ·

  · Parking/Temporary release
  6

  

• Further IIS parsing improvements

  #4921·pyllyukko opened Nov 12, 2024Contributor·

  ·
  1

• Implemented Apple biome file parser

  #4878·rick-slin opened Apr 18, 2024Contributor·2 of 3 tasks·

  ·
  1

  5

  

• Draft: implemented text parser plugin for Apple ps.txt files.

  #4861·rick-slin opened Apr 4, 2024Contributor·2 of 3 tasks·

  ·
  9

  

• Changes to support event values container

  blocked
  #4850·joachimmetz opened Mar 28, 2024Member·

  ·
  1

  

• Created parser for Apple IPS files.

  #4688·rick-slin opened Jun 15, 2023Contributor·3 tasks done·

  ·

  · Parking/Temporary release
  13

  

• Changes to handling unsupported ZIP archive files

  blocked
  #4501·joachimmetz opened Dec 23, 2022Member·

  ·
  1

  

• Add new rules in tag_windows.txt to application_execution tag

  needs closer look
  #4376·lprat opened Nov 10, 2022Contributor·3 tasks·

  ·
  5

  

• DRAFT: MEGAsync parser

  needs closer look
  #4192·hur opened Aug 11, 2022Contributor·3 tasks·

  ·
  1

  3

  

• Add application_execution tag to certain Amcache entries

  blockedneeds closer look
  #4105·pyllyukko opened May 6, 2022Contributor·3 tasks·

  ·
  16

  

• Changes to store source configuration #2287

  blocked
  #3918·joachimmetz opened Nov 6, 2021Member·

  ·
  1

  

• Changed analysis plugins to directly read from storage #3439

  analysisblocked
  #3440·joachimmetz opened Jan 17, 2021Member·

  ·

• Added CPIO archive support #883

  blocked
  #3387·joachimmetz opened Dec 31, 2020Member·

  ·
  1