so-import-evtx - Time range odd behavior.

[lerou114]

I have a security log that I have processed using so-import and the time range appears to be off. I'm not sure where I am getting the range discrepancy from. Any help or suggestions would be appreciated. I am on the latest version and hotfix.

The import completes and I received this output:

Processing Import: /home/onionadmin/Security.evtx

• assigning unique identifier to import: 4f26690bf7da642c8a32f33ec2f5d2f5
• importing logs to Elasticsearch...
  Traceback (most recent call last):
  File "/usr/local/bin/evtx2json", line 8, in
  sys.exit(entry_point())
  File "/usr/local/lib/python3.9/site-packages/evtx2es/views/Evtx2jsonView.py", line 49, in entry_point
  Evtx2jsonView().run()
  File "/usr/local/lib/python3.9/site-packages/evtx2es/views/Evtx2jsonView.py", line 36, in run
  Evtx2jsonPresenter(
  File "/usr/local/lib/python3.9/site-packages/evtx2es/presenters/Evtx2jsonPresenter.py", line 39, in export_json
  self.output_path.write_text(
  File "/usr/local/lib/python3.9/pathlib.py", line 1286, in write_text
  return f.write(data)
  MemoryError
  date: invalid date ‘+%s’
  /sbin/so-import-evtx: line 118: [: -lt: unary operator expected

Cleaning up:

Import complete!

You can use the following hyperlink to view data in the time range of your import. You can triple-click to quickly highlight the entire hyperlink and you can then copy it into your browser:

or you can manually set your Time Range to be (in UTC):
From: 2050-12-31 To: 2022-04-15

Please note that it may take 30 seconds or more for events to appear in Hunt.

imported another event log and get this date range:
or you can manually set your Time Range to be (in UTC):
From: 2022-04-14 To: 2022-02-19

[dougburks]

Sounds like there may be some corrupt data in the file. Are you able to share the file?

[lerou114]

Sorry for taking so long to get back. I have several other log imports and they are working correctly. I am assuming there must be corruption in the two log files I have pulled and imported.