Invalid: -x option in logon-summary and eid-metrics will result in duplicate results

[YamatoSecurity]

Turning on -x to carve records from slack will often result in duplicate events being read, however, logon-summary and eid-metrics does not do any filtering for duplicate events. I think we need to keep track of timestamp, etc.. information for events only when -x is being used and filter on duplicate events before giving results in order to give more accurate results.

[YamatoSecurity]

@fukusuket Could I ask you to do this one?

[fukusuket]

Yes! I would love to implement it!💪

[fukusuket]

@YamatoSecurity
I have a question!
Is the specification expected to not count duplicate events, either with or without the -x option? (For example, if you simply copy evtx and specify it with the -d option)

• Related: Enhancement: Duplicate detections for logon-summary #1325

[YamatoSecurity]

Good question! We probably need to also add a -X, --remove-duplicate-detections option as well to remove (and ignore) any duplicate events.

[fukusuket]

@YamatoSecurity
Thank you for checking! I'll add -X, --remove-duplicate-detections option. Are the following specifications correct?

• with -X : output unique event(remove duplicate events)
• without -X : output duplicate events(current behavior)