intunemanagementextension

$ target-query <path/to/target> -f intunemanagementextension

Details

Module	dissect.target.plugins.os.windows.log.intunemanagementextension.IntuneManagementExtensionLogParserPlugin
Output	records

Module documentation

Parse Microsoft Intune Management Extension logs (including rotated logs).

This plugin processes both the primary IntuneManagementExtension.log file and any timestamped rotated versions (e.g. IntuneManagementExtension-20251009-135155.log).

Each parsed entry includes metadata such as timestamp, log type, thread ID, component name, and message content.

Function documentation

Parse Intune Management Extension log files.

Yields:

IntuneManagementExtensionLogRecord: One record per parsed log line.