evtx2es re-broken: [Temporary Hackaround :)]

[zaphode]

evtx2es was working until I updated to 2.3..40.
Is authentication to the Elastic Search API (port:9200) added in 2.3.40? I can query GET /_cat/indices from in Dev Tools but get an empty reply if I try to run it from curl. It seems like it would be an access issue.

What I have checked:

• Made sure access was open in so-allow
• tested simple query using curl (failed)

[defensivedepth]

Please review #3449

You will need to connect via https now.

[zaphode]

I tried this but it looks like there is an authentication error.

[zaphode]

As it does work in curl using https with no authentication I also tried putting in a blank login. Is there maybe a login required to write to Elasticsearch in this version?

[defensivedepth]

That is a bug in evtx2es - I submitted a PR to fix it sumeshi/evtx2es#6

(It was trying to authenticate using a username elastic, even though --login was not specified

[zaphode]

Good call, got it working

[zaphode]

If anyone else is using evtx2es, here is a temporary hackaround until it is fixed.

Edit the '/usr/local/bin/evtx2es' (or wherever you have this file stored).

1. Add an extra elif statement to check for the state (scheme == 'https') and (login == "") in the Elasticsearch() initialization.
   

2. In the argument parser (around Line 293) replace default="elastic" with default=""
   

Suppress the "Unverified HTTPS request" messages:
export PYTHONWARNINGS="ignore:Unverified HTTPS request"

Ex:

• evtx2es --scheme https --host localhost --index so-evtx2es --pipeline import.wel sysmon3_win10.evtx

Or better just hide the Unverified HTTPS request: