auditd-timeline

A parser/timeline creator for auditd logs.

random notes

Every PATH entry has a (null) entry with it - this appears to be the end of the inode. Could be useful for carving files from disk