Chainsaw: a blank column was not in this export

The table is one group’s columns

Hunt output is grouped. Each group has its own headers: a time, a title, a computer, and whichever fields that group mapped. A column that is not in the header was not part of this export. A cell that is present but empty was not filled for that row. Those are different, and both are about the export, not automatically about the event.

Another group, or a search of the raw event, can show a field this table never had. The absence of a header is not the absence of the fact.

Do not translate blank into none

If the account column exists and the cell is blank, write “account cell blank in this table.” Do not write “the event has no account” until you have opened the event and the account field there is empty too. If the column is missing entirely, write “this export has no account column.”

The rule title does not fill the gap. A title that talks about a user is still the rule’s name.

What to file

File the group name, the headers on that table, and the cells you are using. For any blank you rely on, say whether the header exists. When the finding needs a field the table lacks, cite the event and the field you read there. Do not backfill from the title.

Worked case: no account column on a service row

A hunt group for a new service on ACCT-04 prints time, title, computer, and service name. There is no account header. A draft says the service was installed with no account, because the table does not show one. The System event 7045 for that service name includes an account string for the lab’s update task.

The note lists the headers the group actually printed and says the account was not in this export. The account in the finding is quoted from the 7045 event. The draft’s “no account” line is removed.

group headers: time, title, computer, service name
account column: not in this export
event: System 7045
account: quoted from that event, not from the table
not: "installed with no account"