parse_csv

Plugin

ArgDescriptionType
filenameCSV files to openlist of string (required)
accessorThe accessor to usestring
auto_headersIf unset the first row is headersbool
separatorComma separator (default ‘,’)string
commentThe single character that should be considered a commentstring
columnsThe columns to uselist of string

Description

Parses events from a CSV file.

Parses records from a CSV file. We expect the first row of the CSV file to contain column names. This parser specifically supports Velociraptor’s own CSV dialect and so it is perfect for post processing already existing CSV files.

The types of each value in each column is deduced based on Velociraptor’s standard encoding scheme. Therefore types are properly preserved when read from the CSV file.

For example, downloading the results of a hunt in the GUI will produce a CSV file containing artifact rows collected from all clients. We can then use the parse_csv() plugin to further filter the CSV file, or to stack using group by.

Example

The following stacks the result from a Windows.Applications.Chrome.Extensions artifact:

SELECT count(items=User) As TotalUsers, Name
FROM parse_csv(filename="All Windows.Applications.Chrome.Extensions.csv")
Order By TotalUsers
Group By Name
comments powered by Disqus