New maps

[barrie0482]

Hi Eric,

This is my first lot of maps. These events I use in my timelines at work.

Cheers, Barrie

[EricZimmerman]

Why not combine the domain and user so its presented in a more compact form and in a way that most people are used to seeing?

rather than have

Domain: Zim
User: Eric

just do

Zim\Eric

thoughts?

these look great otherwise

[EricZimmerman]

also for EventId: 6005 and the other one referencing Computer, that field is already automatically pulled into the CSV so this is redundant. i would drop these two UNLESS you like having the Map description column populated (which is nice).

thoughts on this one?

[EricZimmerman]

im going to pull these in and then combine the domain and username, like the 4624 map.

[EricZimmerman]

pulled, updated, and committed the changes. refresh from here for current

[EricZimmerman]

and thanks!! great work

[barrie0482]

Hi Eric, *Why not combine the domain and user so its presented in a more compact form and in a way that most people are used to seeing?* no problem with combining the domain and username. I debated which way to go. *also for EventId: 6005 and the other one referencing Computer, that field is already automatically pulled into the CSV so this is redundant. i would drop these two UNLESS you like having the Map description column populated (which is nice).* The map description column is the one I need. I use these in my timelines to indicate when a computer is restarted. *and thanks!! great work* Thanks to you Eric for all the great work you've done on your tools. My contribution is small, but it is good to be able to participate. I am developing a process in my work place to collect and process a triage image using KAPE and your other tools. My environment is fairly locked down, so I have a few hoops I need to go through. :-( Cheers, Barrie

…

On Tue, 30 Apr 2019 at 21:53, Eric ***@***.***> wrote: Why not combine the domain and user so its presented in a more compact form and in a way that most people are used to seeing? rather than have Domain: Zim User: Eric just do Zim\Eric thoughts? these look great otherwise — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#3 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAQDTPAPPG6CFKRJA5MIV3PTAXNFANCNFSM4HJKEHJA> .