zipfile-entries

Imports a list of compressed files and directories in the specified ZIP file.

Syntax

zipfile-entries ZIPFILE_PATH
Required Parameter
ZIPFILE_PATH
Path to the ZIP file. If you use a wildcard (*) in the file name, you can retrieve all the files containing a specific string pattern in the file name at once. The Logpresso daemon must have the read permission to the file.

Description

The output fields are as follows:

FieldTypeDescription
zip_pathStringPath to ZIP file
entryStringZIP file name
file_sizeIntegerFile size
compressed_sizeIntegerCompressed size
modified_atDateLast modification time
commentStringComment

Usage

  1. Load the list of files and directories in the entry.zip file under D:\data.

    zipfile-entries
    D:\data\entry.zip
    
  2. Load the list of files and directories of all ZIP files under D:\data.

    zipfile-entries D:\data\*.zip
    
  3. Retrieve file entries with the .evtx extension in the entry.zip file.

    zipfile-entries D:\data\entry.zip
    | search entry=="*.evtx"