Output. {"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/deepbluecli":{"items":[{"name":"attachments","path":"IntroClassFiles/Tools. When using multithreading - evtx is significantly faster than any other parser available. A tag already exists with the provided branch name. He gained information security experience in a. sys','*. This is very much part of what a full UEBA solution does:</p> <p dir="auto">PS C: oolsDeepBlueCLI-master><code>. md","path":"READMEs/README-DeepBlue. ForenseeventosExtraidossecurity. DeepBlueCLI is available here. It also has some checks that are effective for showing how UEBA style techniques can be in your environment. EVTX files are not harmful. DeepBlueCLI / DeepBlueHash-checker. {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":"READMEs","path":"READMEs","contentType":"directory"},{"name":"evtx","path":"evtx. Contribute to ghost5683/jstrandsClassLabs development by creating an account on GitHub. \DeepBlue. Posts with mentions or reviews of DeepBlueCLI. In the “Windows PowerShell” GPO settings, set “Turn on Module Logging” to enabled. Ullrich, Ph. md","path":"READMEs/README-DeepBlue. Eric is the Chief Technology Officer (CTO) of Backshore Communications, a company focusing on hunt teaming, intrusion detection, incident. Defense Spotlight: DeepBlueCLI SECTION 6: Capture-the-Flag Event Our Capture-the-Flag event is a full day of hands-on activity that has you working as a consultant for ISS Playlist, a fictitious company that has recently been compromised. Description: Deep Blue is an easy level defensive box that focuses on reading and extracting informtion from Event Viewer logs using a third-party PowerShell script called. . Description Get-WinEvent fails to retrieve the event description for Event 7023 and EventLogException is thrown. . Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . DeepBlue. You may need to configure your antivirus to ignore the DeepBlueCLI directory. You will apply all of the skills you’ve learned in class, using the same techniques used by{"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/Velociraptor":{"items":[{"name":"attachment","path":"IntroClassFiles/Tools. More, on Medium. . py. DeepBlueCLI reviews and mentions. Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . {"payload":{"allShortcutsEnabled":false,"fileTree":{"evtx":{"items":[{"name":"many-events-application. Hello Guys. Patch Management. DeepBlue. It does this by counting the number of 4625 events present in a systems logs. DeepBlueCLI is a tool used for managing and analyzing security events in Splunk. C: oolsDeepBlueCLI-master>powershell. #5 opened Nov 28, 2017 by ssi0202. Linux, macOS, Windows, ARM, and containers. this would make it alot easier to run the script as a pre-parser on data coming in from winlogbeat /logstasah before being sent to elasticsearch db"a PowerShell Module for Threat Hunting via Windows Event Logs" and Techniques for Digital Forensics and Incident Response - Blue-Team-Toolkit/deepbluecli. Chris Eastwood in Blue Team Labs Online. The original repo of DeepBlueCLI by Eric Conrad, et al. Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . You may need to configure your antivirus to ignore the DeepBlueCLI directory. #20 opened Apr 7, 2021 by dhammond22222. md","path":"READMEs/README-DeepBlue. Download DeepBlueCLI If you like the site, please consider joining the telegram channel or supporting us on Patreon using the button below. Oriana. evtx","path":"evtx/Powershell-Invoke. To fix this it appears that passing the ipv4 address will r. You may need to configure your antivirus to ignore the DeepBlueCLI directory. {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":"READMEs","path":"READMEs","contentType":"directory"},{"name":"evtx","path":"evtx. 79. SOF-ELK - A pre-packaged VM with Elastic Stack to import data for DFIR analysis by Phil Hagen; so-import-evtx - Import evtx files into Security Onion. Defense Spotlight: DeepBlueCLI. ディープ・ブルーは、32プロセッサー・ノードを持つIBMの RS/6000 SP をベースに、チェス専用の VLSI プロセッサ を512個を追加して作られた。. In the “Options” pane, click the button to show Module Name. The tool initially act as a beacon and waits for a PowerShell process to start on the system. Usage . DeepBlueCLI / evtx / Powershell-Invoke-Obfuscation-encoding-menu. rztbzn. exe /c echo kyvckn > . The exam features a select subset of the tools covered in the course, similar to real incident response engagements. As Windows updates, application installs, setting changes, and. Now, let's open a command Prompt: Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . 1 Threat Hunting via Sysmon 23 Test PowerShell Command • The test command is the PowerSploit Invoke-Mimikatz command, typically loaded via NetWebClient DownloadString o powershell IEX (New-Object Net. DNS-Exfiltrate Public Python 18 GPL-3. Blue Team Level 1 is a practical cybersecurity certification focusing on defensive practices, security. py. The only difference is the first parameter. DeepBlueCLI ; Domain Log Review ; Velociraptor ; Firewall Log Review ; Elk In The Cloud ; Elastic Agent ; Sysmon in ELK ; Lima Charlie ; Lima Charlie & Atomic Red ; AC Hunter CE ; Hunting DCSync, Sharepoint and Kerberoasting . Eric and team really have built a useful and efficent framework that has been added to my preferred arsenal thanks to Kringlecon. evtx parses Event ID. . Learn how CSSLP and ISC2 can help you navigate your training path, create your plan and distinguish you as a globally respected secure. The script assumes a personal API key, and waits 15 seconds between submissions. evtx and System. Contribute to r3p3r/sans-blue-team-DeepBlueCLI development by creating an account on GitHub. freq. md","contentType":"file"},{"name":"win10-x64. Forensic Toolkit --OR-- FTK. As Windows updates, application installs, setting changes, and. evtx directory (which contain command-line logs of malicious attacks, among other artifacts). Introducing DeepBlueCLI v3. DeepBlueCLI, in concert with Sysmon, enables fast discovery of specific events detected in Windows Security, System, Application, PowerShell, and Sysmon. Table of Contents . . I forked the original version from the commit made in Christmas. Contribute to xxnlxzx/Strandjs-ClassLabs development by creating an account on GitHub. 1\" width=\"16\" height=\"16\" aria-hidden=\"true. Popular Searches Council of Better Business Bureaus Inc Conrad DeepBlueCLI SIC Code 82,824 NAICS Code 61,611 Show More. ConvertTo-Json - login failures not output correctly. To enable module logging: 1. Microsoft Safety Scanner. And I do mean fast, DeepBlueCLI is quick against saved or archived EVTX files. Table of Contents . Now we will analyze event logs and will use a framework called deepbluecli which will enrich evtx logs. . Let's get started by opening a Terminal as Administrator. 1 to 2 years of network security of cybersecurity experience. filter Function CheckRegex Function CheckObfu Function CheckCommand Function. DeepBlueCLI, ported to Python. DeepBlueCLI by Eric Conrad is a powershell module that can be used for Threat Hunting and Incident Response via Windows Event Logs. Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . freq. DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs. This allows them to blend in with regular network activity and remain hidden. With the help of PowerShell and the Convert-EventLogRecord function from Jeffery Hicks, it is much easier to search for events in the Event Log than with the Event Viewer or the Get-WinEvent cmdlet. Detected events: Suspicious account behavior, Service auditing. Solutions for retired Blue Team Labs Online investigations, part of Security Blue Team. Even the brightest minds benefit from guidance on the journey to success. . You will apply all of the skills you’ve learned in class, using the same techniques used by Threat Hunting via DeepBlueCLI v3. DEEPBLUECLI FOR EVENT LOG ANALYSIS Use DeepBlueCLI to quickly triage Windows Event logs for signs of malicious activity. Challenge DescriptionUse the following free Microsoft software to detect and remove this threat: Windows Defender for Windows 10 and Windows 8. 2. RedHunt-OS. You switched accounts on another tab or window. Run directly on a VM or inside a container. DeepBlueCLI. Contribute to r3p3r/sans-blue-team-DeepBlueCLI development by creating an account on GitHub. 1, add the following to WindowsSystem32WindowsPowerShellv1. securityblue. Finding a particular event in the Windows Event Viewer to troubleshoot a certain issue is often a difficult, cumbersome task. DeepBlueCLI uses module logging (PowerShell event 4103) and script block logging (4104). DownloadString('. ps1 . This will work in two modes. From the above link you can download the tool. py evtx/password-spray. md","contentType":"file. JSON file that is used in Spiderfoot and Recon-ng modules. evtx","path":"evtx/Powershell-Invoke. EVTX files are not harmful. Usage: -od <directory path> -of Defines the name of the zip archive will be created. - GitHub - strandjs/IntroLabs: These are the labs for my Intro class. Now, let's open a command Prompt: •DeepBlueCLI contains an evtx directory chock-full of logs showing malicious activity •Some over-aggressive antivirus (I'm looking at you, Windows Defender Antivirus) will quarantine the logs •Then I receive angry accusing emails from random infosec professionals who are apparently frightened by scary… logs These are the videos from Derbycon 2016:{"payload":{"allShortcutsEnabled":false,"fileTree":{"READMEs":{"items":[{"name":"README-DeepBlue. Why? No EXE for antivirus or HIPS to squash, nothing saved to the filesystem, sites that use application whitelisting allow PowerShell, and little to no default logging. 2. py. Table of Contents. 专门用于攻防对抗仿真（Adversary Emulation）和威胁狩猎的虚拟机。. 45 mins. Leave Only Footprints: When Prevention Fails. {"payload":{"allShortcutsEnabled":false,"fileTree":{"READMEs":{"items":[{"name":"README-DeepBlue. RedHunt-OS. 0 event logs o Available at: Processes local event logs, or evtx files o Either feed it evtx files, or parse the live logs via Windows Event Log collection o Can process logs centrally on a. Usage This seems to work on the example file: [mfred@localhost DeepBlueCLI]$ python DeepBlue. py. The output is a series of alerts summarizing potential attacks detected in the event log data. RedHunt-OS. Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . DeepBlueCLI is a free tool by Eric Conrad that demonstrates some amazing detection capabilities. . DeepBlueCLI can also review Windows Event logs for a large number of authentication failures. The tool parses logged Command shell and. ps1 -log. Eric Conrad : WhatsMyName ; OSINT/recon tool for user name enumeration. Blue Team Level 1 is a practical cybersecurity certification focusing on defensive practices, security. Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . md","contentType":"file. exe or the Elastic Stack. Given Scenario, A Windows. Posted by Eric Conrad at 10:16 AM No comments: Sunday, June 11, 2023. It supports command line parsing for Security event log 4688, PowerShell log 4014, and Sysmon log 1. evtx であることが判明。 DeepBlueCLIはイベントIDを指定して取得を行っているため対象となるログが取得範囲外になっていたためエラーとなっていなかった模様。Contribute to r3p3r/sans-blue-team-DeepBlueCLI development by creating an account on GitHub. CyberChef is a web application developed by GCHQ, also known as the “Cyber Swiss Army Knife. Here's a video of my 2016 DerbyCon talk DeepBlueCLI. Contribute to mwhatter/DeepBlueCLI-1 development by creating an account on GitHub. 13 subscribers Subscribe 982 views 3 years ago In this video, I'll teach you how to use the Windows Task Scheduler to automate running DeepBlueCLI to look for evidence of. . 0 / 5. ps1 . md Go to file Go to file T; Go to line L; Copy path Copy permalink; This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. 2020-11-03T17:30:00-03:00 5:30 PM | Post sponsored by FaradaySEC | Multiuser Pentest Environment Zion3R. #13 opened Aug 4, 2019 by tsale. Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . Defense Spotlight: DeepBlueCLI SECTION 6: Capture-the-Flag Event Our Capture-the-Flag event is a full day of hands-on activity that has you working as a consultant for ISS Playlist, a fictitious company that has recently been compromised. DeepBlueCLI is a PowerShell script created by Eric Conrad that examines Windows event log information. RedHunt的目标是通过整合攻击者的武库和防御者的工具包来主动识别环境中的威胁，来提供威胁仿真（Threat Emulation）和威胁狩猎所有需求的一站式服务. md","contentType":"file. You can read any exported evtx files on a Linux or MacOS running PowerShell. Thursday, 29 Jun 2023 1:00PM EDT (29 Jun 2023 17:00 UTC) Speaker: Eric Conrad. EVTX files are not harmful. Eric is the Chief Technology Officer (CTO) of Backshore Communications, a company focusing on hunt teaming, intrusion detection, incident. Learn how CSSLP and ISC2 can help you navigate your training path, create your plan and distinguish you as a globally respected secure. Here we will inspect the results of Deepbluecli a little further to show how easy it is to process security events: Password spray attack Date : 19/11/2019 12:21:46 Log : Security EventID : 4648 Message : Distributed Account Explicit Credential Use (Password Spray Attack) Results : The use of multiple user account access attempts with explicit. You may need to configure your antivirus to ignore the DeepBlueCLI directory. In order to fool a port scan, we have to allow Portspoof to listen on every port. Event Log Explorer. Every incident ends with a lessons learned meeting, and most executive summaries include this bullet point: "Leverage the tools you already paid for". It identifies the fastest series of steps from any AD account or machine to a desired target, such as membership in the Domain Admins group. EVTX files are not harmful. {"payload":{"allShortcutsEnabled":false,"fileTree":{"evtx":{"items":[{"name":"Powershell-Invoke-Obfuscation-encoding-menu. Top 10 companies in United States by revenue. 5 contributions on November 13th. Now, click OK . What is the name of the suspicious service created? Investigate the Security. Packages. deepblue at backshore dot net. Table of Contents . Here are links and EVTX files from my SANS Blue Team Summit keynote Leave Only Footprints: When Prevention Fails. It is not a portable system and does not use CyLR. DeepBlueCLI. evtx log. You switched accounts on another tab or window. DeepBlueCLI : A PowerShell Module For Threat Hunting Via Windows Event. Yeah yeah I know, you will tell me to run a rootkit or use msfvenom to bypass the firewall but. ConvertTo-Json - login failures not output correctly. #13 opened Aug 4, 2019 by tsale. As you can see, they attempted 4625 failed authentication attempts. What is the name of the suspicious service created? Whenever a event happens that causes the state of the system to change , Like if a service is created or a task was scheduled it falls under System logs category in windows. It does take a bit more time to query the running event log service, but no less effective. /// 🔗 DeepBlue CLI🔗 Antisyphon Training Pay-What-You-Can Coursescontributions in the last year. BloodHound is a web application that identifies and visualizes attack paths in Active Directory environments. DeepBlue. || Jump into Pay What You Can training for more free labs just like this! the PWYC VM: Public PowerShell 1,945 GPL-3. And I do mean fast, DeepBlueCLI is quick against saved or archived EVTX files. a. Investigate the Security. Sysmon is required:. md","contentType":"file. </p> <h2 tabindex=\"-1\" id=\"user-content-table-of-contents\" dir=\"auto\"><a class=\"heading-link\" href=\"#table-of-contents\">Table of Contents<svg class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1. {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":"READMEs","path":"READMEs","contentType":"directory"},{"name":"evtx","path":"evtx. Now, we are going to use DeepBlueCLI to see if there are any odd logon patterns in the domain logs. {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":"READMEs","path":"READMEs","contentType":"directory"},{"name":"evtx","path":"evtx. A responder must gather evidence, artifacts, and data about the compromised. DeepBlueCLI’nin saldırganların saldırılarını gizlemek için kullandıkları çeşitli kodlama taktiklerini nasıl algıladığını tespit etmeye çalışalım. py. Chainsaw or Hayabusa? Thoughts? In my experience, those using either tool are focused on a tool, rather than their investigative goals; what are they trying to solve, or prove/disprove? Also, I haven't seen anyone that I have seen use either tool write their own detections/filters, based on what they're seeing. In this video I have explained Threat hunting concept and performed a demonstration with help of opensource tools like DNSTwist, CyberChef, DeepBlueCLI and T. It reads either a 'Log' or a 'File'. Table of Contents . {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":"READMEs","path":"READMEs","contentType":"directory"},{"name":"evtx","path":"evtx. Process creation is being audited (event ID 4688). It provides detailed information about process creations, network connections, and changes to file creation time. AnalyticsInstaller Examine Tcpdump Traffic Molding the Environment Add-Content -Path C:windowssystem32driversetchosts -Value "10. You may need to configure your antivirus to ignore the DeepBlueCLI directory. \DeepBlue. evtx | FL Event Tracing for Windows (ETW). evtx file using : Out-GridView option used to get DeepBlueCLI output as GridView type. \evtx directory (which contain command-line logs of malicious attacks, among other artifacts). py. Using DeepBlueCLI investigate the recovered System. The last one was on 2023-02-15. Explore malware evolution and learn about DeepBlueCLI v2 in Python and PowerShell with Adrian Crenshaw. Yes, this is intentional. Open Powershell and run DeepBlueCLI to process the Security. {"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/deepbluecli":{"items":[{"name":"attachments","path":"IntroClassFiles/Tools. I'm running tests on a 12-Core AMD Ryzen. evtx. DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs Eric Conrad, Backshore Communications, LLC deepblue at ba. Performance was benched on my machine using hyperfine (statistical measurements tool). 本記事では2/23 (日)～2/28 (金)サンフランシスコで開催された、RSA Conferenceの参加レポートとなります。. Download it from SANS Institute, a leading provider of security training and resources. #13 opened Aug 4, 2019 by tsale. You either need to provide -log parameter then log name or you need to show the . com' -Recurse | Get-FileHash| Export-Csv -Path safelist. Daily Cyber Security News Podcast, Author: Johannes B. Others are fine; DeepBlueCLI will use SHA256. Here are links and EVTX files from my SANS Blue Team Summit keynote Leave Only Footprints: When Prevention Fails. {"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/deepbluecli":{"items":[{"name":"attachments","path":"IntroClassFiles/Tools. Eric Conrad : WhatsMyName ; OSINT/recon tool for user name enumeration. Reload to refresh your session. Let's start by opening a Terminal as Administrator: . 🔍 Search and extract forensic artefacts by string matching, and regex patterns. Oriana. Event Log Explorer is a PowerShell tool that is used to detect suspicious Windows event log entries. Event Log Explorer. DeepBlueCLI is. \evtx directory (which contain command-line logs of malicious attacks, among other artifacts). Thank you,. DeepBlueCLI is available here. 61 KBContribute to whoami-chmod777/DeepBlueCLI development by creating an account on GitHub. py. PS C:\\> Get-ChildItem c:\\windows\\system32 -Include '*. {"payload":{"allShortcutsEnabled":false,"fileTree":{"READMEs":{"items":[{"name":"README-DeepBlue. DeepBlueCLI has no bugs, it has no vulnerabilities, it has a Strong Copyleft License and it has medium support. Hi everyone and thanks for this amazing tool. Setup the DRBL environment. Moreover, DeepBlueCLI is quick when working with saved or archived EVTX files. EVTX files are not harmful. It should look like this: . No contributions on December 18th. It also has some checks that are effective for showing how UEBA style techniques can be in your environment. ps1 . \evtx\Powershell-Invoke-Obfuscation-encoding-menu. evtxmetasploit-psexec-powershell-target-security. More information. 1 Threat Hunting via Sysmon 23 Test PowerShell Command • The test command is the PowerSploit Invoke-Mimikatz command, typically loaded via NetWebClient DownloadString o powershell IEX (New-Object. Automation. By default this is port 4444. exe or the Elastic Stack. ps1 and send the pipeline output to a ForEach-Object loop, sending the DeepBlueCLI alert to a specified Syslog server. Then, navigate to the oolsDeepBlueCLI-master directory Threat Hunting via Sysmon 19 DeepBlueCLI • DeepBlueCLI (written by course authors) is a PowerShell framework for threat hunting via Windows event logs o Can process PowerShell 4. Blue Team Level 1 is a practical cybersecurity certification focusing on defensive practices, security. It is not a portable system and does not use CyLR. CSI Linux. . Computer Aided INvestigative Environment --OR-- CAINE. exe? Using DeepBlueCLI investigate the recovered Security. DeepBlueCLI - PowerShell script that was created by SANS to aid with the investigation and triage of Windows Event logs. Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . Table of Contents. evtx","path":"evtx/many-events-application. exe','*. py. DeepBlueCLI, in concert with Sysmon, enables fast discovery of specific events detected in Windows Security, System, Application, PowerShell, and Sysmon logs. csv Using DeepBlueCLI investigate the recovered System. Suggest an alternative to DeepBlueCLI. {"payload":{"allShortcutsEnabled":false,"fileTree":{"evtx":{"items":[{"name":"Powershell-Invoke-Obfuscation-encoding-menu. pipekyvckn. Related Job Functions. The working solution for this question is that we can DeepBlue. . SysmonTools - Configuration and off-line log visualization tool for Sysmon. {"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/WindowsCLI":{"items":[{"name":"attachments","path":"IntroClassFiles/Tools. 手を動かして何か行うといったことはないのでそこはご了承を。. 4K subscribers in the purpleteamsec community. Belkasoft’s RamCapturer. DeepBlueCLI ; A PowerShell Module for Threat Hunting via Windows Event Log. In the situation above, the attacker is trying to guess the password for the Administrator account. RedHunt的目标是通过整合攻击者的武库和防御者的工具包来主动识别环境中的威胁，来提供威胁仿真（Threat Emulation）和威胁狩猎所有需求的一站式服务. Autopsy. But you can see the event correctly with wevtutil and Event Viewer. Instant dev environmentsMicrosoft Sentinel and Sysmon 4 Blue Teamers. Micah HoffmanDeepBlueCLI ya nos proporciona la información detallada sobre lo “sospechoso” de este evento. Start an ELK instance. DeepBlueCLI parses logged Command shell and Powershell command lines to detect suspicious indications like regex searches, long command lines,. Tag: DeepBlueCLI. py. You may need to configure your antivirus to ignore the DeepBlueCLI directory. RustyBlue is a Rust implementation of Eric Conrad's DeepBlueCLI, a DFIR tool that detects various Windows attacks by analyzing event logs. First, we confirm that the service is hidden: PS C: oolsDeepBlueCLI> Get-Service | Select-Object Name | Select-String -Pattern 'SWCUEngine' PS C: oolsDeepBlueCLI>. evtx Figure 2. We can observe the original one 2022–08–21 13:02:23, but the attacker tampered with the timestamp to 2021–12–25 15:34:32. {"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/deepbluecli":{"items":[{"name":"attachments","path":"IntroClassFiles/Tools. evtxsmb-password-guessing. evtx). #19 opened Dec 16, 2020 by GlennGuillot. py. The only difference is the first parameter. Study with Quizlet and memorize flashcards containing terms like What is deepblue CLI?, What should you be aware when using the deepblue cli script. #5 opened Nov 28, 2017 by ssi0202. Description Please include a summary of the change and (if applicable) which issue is fixed. Reload to refresh your session. {"payload":{"allShortcutsEnabled":false,"fileTree":{"READMEs":{"items":[{"name":"README-DeepBlue. Except for books, Amazon will display a List Price if the product was purchased by customers on Amazon or offered by other retailers at or above the List Price in at least the past 90 days. . 2020年3月6日. We can do this using DeepBlueCLI (as asked) to help automatically filter the log file for specific strings of interest. And I do mean fast, DeepBlueCLI is quick against saved or archived EVTX files. You may need to configure your antivirus to ignore the DeepBlueCLI directory. evtx and System.