Fixed test

Velocidex · Aug 21, 2023 · 5bc4ba9 · 5bc4ba9
1 parent 70b72ed
commit 5bc4ba9
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/artifacts/definitions/Windows/Forensics/UserAccessLogs.yaml b/artifacts/definitions/Windows/Forensics/UserAccessLogs.yaml
@@ -111,8 +111,8 @@ sources:
                })) AS Value
             FROM items(item={
                SELECT *, get(item=RoleLookup, field=RoleGuid).RoleName AS RoleName,
-                  format(format="%02x", args=Address) AS RawAddress,
-                  FormatAddress(Address=Address) AS Address
+                  Address AS RawAddress,
+                  FormatAddress(Address=unhex(string=Address)) AS Address
                FROM parse_ese(file=OSPath, table="CLIENTS")
             })
         }, column="Value")