资 源 简 介
perl script to parse through symantec logs, to pull out infections.
Output looks like this:
MySystem,JoeDirt, W32.SillyFDC, C:funny_pic.scr,4, MyParentServer,(IP)-192.168.101.111,MyDomain,00:1B:4A:F2:70:8A
This is the system name, username, virus name, location of infected file, action taken by sav, the parent server of the client(system), the ip address, the domain of the system, and the mac address of the system. As it stands, this can create a file with hundreds of duplicate system entries, depending on the number of alerts from each system.
still ironing that part out