Jump start with Docker

1. Install Docker
2. Pull Docker image
3. Run Docker image
4. Accessing the Web GUI
5. Import EVTX

If you are using Docker, you can pull the following image.
https://hub.docker.com/r/jpcertcc/docker-logontracer/

Install Docker

If you do not have Docker, please check this page and install it.

Pull Docker image

$ docker image pull jpcertcc/docker-logontracer

Run Docker image

$ docker container run \
   --detach \
   --publish=7474:7474 --publish=7687:7687 --publish=8080:8080 \
   -e LTHOSTNAME=[IP_Address] \
   jpcertcc/docker-logontracer

Wait for a while for LogonTracer to run.

Accessing the Web GUI

Access http://[IP_Address]:8080/ via Web browser. Enable JavaScript on your browser.
Please note that docker image contains sample data on itself. And for the first access, you see the images by those data. This sample data will be purged for the first time you import your own logs.

Supported browsers

• Mozilla Firefox
• Google Chrome
• Microsoft Edge

Login

Login with the default account (neo4j:password) from the Web GUI.

Import EVTX

Import the event log using Web GUI or logontracer.py. After importing EVTX, you need to reload the web browser.

Importing by Web GUI

Event log can be imported with upload EVTX button. Supported file format is EVTX or XML(exported Event Viewer). If the import of the EVTX file is not successful, please check the "Log" button.

Importing by python script

You can import from host to Docker image with logontracer.py.

Clone LogonTracer github repository

$ git clone https://github.com/JPCERTCC/LogonTracer.git

Import using logontracer.py

Event log can be imported by logontracer.py option -e or -x.

$ cd LogonTracer
$ python3 logontracer.py --delete -e [EVTX File] -z [TIME Zone] -u neo4j -p password -s [Docker image IP Address]

or

$ cd LogonTracer
$ python3 logontracer.py --delete -x [XML File] -z [TIME Zone] -u [USERNAME] -p [PASSWORD] -s [Docker image IP Address]

• --delete: Delete data in Neo4j
• -e: EVTX filename to import
• -x: XML filename to import
• -z: Time zone (ex: +9, -5)
• -u: Neo4j username (Docker image is “neo4j”)
• -p: Neo4j password (Docker image is “password”)
• -s: Address where the Docker image (ex: localhost)