# iOS analysis using the Sysdiagnose analysis framework workshop - advanced session — David Durvaux, Christophe Vandeplas

**URL:** <https://discourse.ossbase.org/t/ios-analysis-using-the-sysdiagnose-analysis-framework-workshop-advanced-session-david-durvaux-christophe-vandeplas/674>\
**Category:** 2025 talks / workshops\
**Tags:** 2025, training, hacklu\
**Created:** [August 26, 2025, 8:55am UTC](https://discourse.ossbase.org/t/ios-analysis-using-the-sysdiagnose-analysis-framework-workshop-advanced-session-david-durvaux-christophe-vandeplas/674 "2025-08-26T08:55:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://discourse.ossbase.org/uploads/default/original/1X/4713f3d4fec85f7513775fc2dd36f548a49f8faa.jpeg) [@system](https://discourse.ossbase.org/u/system)\
**Post date:** [August 26, 2025, 8:55am UTC](https://discourse.ossbase.org/t/ios-analysis-using-the-sysdiagnose-analysis-framework-workshop-advanced-session-david-durvaux-christophe-vandeplas/674/1 "2025-08-26T08:55:51Z")

</div>

**Join us at hack.lu 2025 — [Info & Registration](https://2025.hack.lu/info/)**

**Duration:** 120 min  
  
**Type:** Training  
  
**Speakers:** David Durvaux, Christophe Vandeplas

**Abstract**

This is the second part, or deep dive, of the Sysdiagnose Analysis Framework Workshop.

We will continue on the topics discussed in the first workshop, but here the focus is on diving DEEP in lots of the data that is present in the sysdiagnose archive.  
Please ONLY attend this workshop if you either attended previous year’s session or attended the beginners session, or already used the sysdiagnose analysis framework before.

**Description**

We will get our hands dirty and dive deeper into advanced Splunk queries digging into data and better understanding what is in the Sysdiagnose archive.

We will also develop a parser and/or analyser for the sysdiagnose analysis framework

Prerequisites for attending the workshop are:

- Having downloaded the workshop material beforehand, prepared the Splunk docker, and have a python development environment ready.
- Solid experience with Splunk Query Language
- Solid experience with `grep`, `sed`, `awk` and `jq` (or their alternatives)
- Experience with development in python
- Familiarity with the [sysdiagnose analysis framework](https://github.com/EC-DIGIT-CSIRC/sysdiagnose)

[View on pretalx](https://pretalx.com/hack-lu-2025/talk/RHLSNB/)

---

<div class="post-metadata">

**Author:** ![dlewen](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/dlewen/32/261_2.png) [@dlewen](https://discourse.ossbase.org/u/dlewen)\
**Post date:** [October 22, 2025, 5:59am UTC](https://discourse.ossbase.org/t/ios-analysis-using-the-sysdiagnose-analysis-framework-workshop-advanced-session-david-durvaux-christophe-vandeplas/674/2 "2025-10-22T05:59:29Z")

</div>

Is there a working link for the workshop material somewhere?

---

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [October 22, 2025, 6:20am UTC](https://discourse.ossbase.org/t/ios-analysis-using-the-sysdiagnose-analysis-framework-workshop-advanced-session-david-durvaux-christophe-vandeplas/674/3 "2025-10-22T06:20:56Z")

</div>

@ddurvaux will share the details.

---

<div class="post-metadata">

**Author:** ![ddurvaux](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/ddurvaux/32/51_2.png) [@ddurvaux](https://discourse.ossbase.org/u/ddurvaux)\
**Post date:** [October 22, 2025, 6:30am UTC](https://discourse.ossbase.org/t/ios-analysis-using-the-sysdiagnose-analysis-framework-workshop-advanced-session-david-durvaux-christophe-vandeplas/674/4 "2025-10-22T06:30:26Z")

</div>

Material is there:

> **[Hack.lu 2025 Workshop Sysdiag - HedgeDoc](https://hdoc.csirt-tooling.org/3Wkxgh3LRG-t-SVAhIyQtA)**