All pull requests

Pull requests

• Changes to check and fix the timeliner attribute mappings #5016

  #5366·nflexfo opened Oct 20, 2026Contributor·3 of 4 tasks·

  ·
  1

• Changed export_event_data.py to count event data that cannot be inspected as issues #5016

  #5365·nflexfo opened Oct 20, 2026Contributor·3 of 4 tasks·

  ·

• Changed Windows distributed link tracking event data to be constructed without arguments #5016

  #5364·nflexfo opened Oct 20, 2026Contributor·3 of 4 tasks·

  ·
  1

• Changes to bodyfile parser to handle unpaired surrogates #4705

  needs closer look
  #5363·Vigneshwarans32241 opened Oct 19, 2026·3 of 4 tasks·

  ·
  21

  

• Limit the text plugin match scanning to the first line

  needs closer lookpending reporter input
  #5356·elhoim opened Oct 12, 2026Contributor·

  ·

  · Parking/Temporary release
  5

  

• Use first-match grammar selection in text plugins

  needs closer look
  #5355·elhoim opened Oct 12, 2026Contributor·

  ·

  · Parking/Temporary release
  3

• Avoid building attribute names list in event filter

  pending reporter input
  #5352·elhoim opened Oct 12, 2026Contributor·

  ·

  · Parking/Temporary release
  3

  

• Changed text plugins to resume parsing after consecutive line failures

  pending reporter input
  #5349·elhoim opened Oct 12, 2026Contributor·

  ·

  · Parking/Temporary release
  3

  

• Changes to redact secrets from being stored in the storage file

  needs closer look
  #5348·elhoim opened Oct 12, 2026Contributor·

  ·
  3

  

• [medium] Changed image_export to sanitize data stream names in export paths

  #5347·elhoim opened Oct 12, 2026Contributor·

  ·
  3

  

• Improved Windows Defender DetectionHistory parser to extract the detection lifecycle timestamps and threat status #5344

  #5345·kev365 opened Oct 11, 2026Contributor·4 tasks done·

  ·

  · 2026 December release
  1

  7

  

• Changes to impose limit for the number of retries of an abandoned task #5331

  pending reporter input
  #5332·elhoim opened Oct 9, 2026Contributor·

  ·
  1

  7

  

• Changes to NSKeyedArchiver plist decoder to decode object references once #5325

  #5326·elhoim opened Oct 9, 2026Contributor·

  ·
  1

  6

  

• [medium] Bound SELinux EXECVE argument iteration by fields present

  pending reporter input
  #5316·elhoim opened Oct 9, 2026Contributor·

  ·
  1

  3

  

• Redact VirusTotal API key from request error written to log #5311

  #5312·elhoim opened Oct 9, 2026Contributor·

  ·
  1

  4

  

• Enhanced Apache access log parser

  pending reporter input
  #5296·elhoim opened Oct 1, 2026Contributor·

  ·
  1

  11

  

• [medium] Fixed text parser trying other plugins after a plugin failed

  needs closer look
  #5294·elhoim opened Oct 1, 2026Contributor·

  ·
  1

  2

  

• [medium] Fixed tagging of later events of a data stream in hash tagging plugins

  needs closer look
  #5280·elhoim opened Oct 1, 2026Contributor·

  ·
  1

  2

• [high] Fixed partitions, volumes and VSS stores selection in storage media tool

  #5279·elhoim opened Oct 1, 2026Contributor·

  ·
  1

  1

• [high] Fixed default plist plugin treating UTC dates as local time

  pending reporter input
  #5233·elhoim opened Oct 1, 2026Contributor·

  ·
  1

  4

  

• [high] Fixed sub-second fraction in non-dynamic time output formatting

  #5229·elhoim opened Oct 1, 2026Contributor·

  ·
  1

  2

• Plist recursekey fix

  pending reporter input
  #5108·oh6hay opened May 28, 2026·4 tasks done·

  ·
  4

  

• Added iOS Health SQLite (healthdb_secure.sqlite) plugin

  needs workpending reporter input
  #5027·annisadp opened Jan 18, 2026·2 of 4 tasks·

  ·

  · Parking/Temporary release
  24

  

• Add DJI Drone Binary TXT

  needs work
  #4967·zienzidan opened Jun 19, 2025·3 of 4 tasks·

  ·

  · Parking/Temporary release
  1

  

• Add DJI DAT Parser

  #4966·arilimata opened Jun 18, 2025·3 of 4 tasks·

  ·

  · Parking/Temporary release
  1