evtx | C # based evtx parser with lots of extras

by EricZimmerman C# Version: Current License: MIT

X-Ray Key Features Code Snippets Community Discussions(10)Vulnerabilities Install Support

kandi X-RAY | evtx Summary

evtx is a C# library. evtx has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitHub.

This project contains both the core parsing engine as well as a command line front end that uses it. For documentation on creating maps, check out the README in the Maps directory. Use the Guide to learn how to make maps from the Template provided.

Support

Quality

Security

License

Reuse

Support

evtx has a low active ecosystem.

It has 174 star(s) with 55 fork(s). There are 19 watchers for this library.

It had no major release in the last 6 months.

There are 3 open issues and 26 have been closed. On average issues are closed in 38 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of evtx is current.

Quality

evtx has no bugs reported.

Security

evtx has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

License

evtx is licensed under the MIT License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

evtx releases are not available. You will need to build from source code and install.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of evtx

Get all kandi verified functions for this library.

evtx Key Features

No Key Features are available at this moment for evtx.

evtx Examples and Code Snippets

No Code Snippets are available at this moment for evtx.

Community Discussions

Trending Discussions on evtx

Query .evtx converted to .xml

How remove all whitespace in multiple filenames?

Directory search returns incorrect number of files

Finding The Correct File Path For a Powershell Script

How to use os.system to convert all files in a folder at once using external python script

How to export Windows Event log for a specific source with WMI?

Creating a progress bar for BASH script exporting system log files

Returning matched regex & Select-object properties of file where expression matched

Saving and reading a file into a data table - C#

Parsing Windows Event Logs stored in syslog-ng system with multi-lines and tabs

QUESTION

Query .evtx converted to .xml

Asked 2021-Mar-11 at 17:44

Having used evtx_dump.py to convert .evtx files to .xml i seek to learn how to query it using XQuery or whatever helps me datamine the document using BaseX.

At this point whatever i try i can only query the whole document using //Events

When i define a path such as //Events/Event/System/[EventID = '4688'] i get 0 results.

This first query is to simply track all specific EventID matching a specific value.

Being new to BaseX and XQuery i found the documentation hard to apply to this use case.

I looked for tools to help me build an XQuery to no avail.

BaseX has all index features enabled i could find.

Br,

Joris

...

ANSWER

Answered 2021-Mar-11 at 17:44

When XQuery fails to return data you are expecting it is often caused by the presence XML namespaces.

The Microsoft XML event log uses a XML namespace on Event nodes and it is inherited by their children. This is the xmlns='http://schemas.microsoft.com/win/2004/08/events/event' you can see in the files. E.g

Source https://stackoverflow.com/questions/66579960

QUESTION

How remove all whitespace in multiple filenames?

Asked 2021-Feb-27 at 16:34

I'm new to Python. I am converting evtx log files to xml, however, some of the evtx files have whitespace in their names and I get an error when the file conversion starts. One of the solutions is to manually remove all the whitespace from the evtx file names, but this is impossible when you deal with a large number of files.

I need to remove all the whitespace from file names in multiple directories. I am trying to rename the files by removing the whitespace with .replace(" ",""), however, I keep getting an error:

...

ANSWER

Answered 2021-Feb-27 at 16:17

solution

Source https://stackoverflow.com/questions/66400781

QUESTION

Directory search returns incorrect number of files

Asked 2021-Jan-29 at 19:59

I'm using Python3, Linux Mint and Visual Studio Code.

Also using, the following code to see whether any evtx files exist in a directory:

...

ANSWER

Answered 2021-Jan-29 at 19:59

Modified your existing code to use glob as suggested above.

Source https://stackoverflow.com/questions/65960105

QUESTION

Finding The Correct File Path For a Powershell Script

Asked 2020-Jun-30 at 12:03

So i have been working on this script at home

...

ANSWER

Answered 2020-Jun-24 at 15:13

The file path can be found with the following steps:

Open Event Viewer as an administrator or a user with permission to view the security log.
Right-click the security log object on the left and open Properties.

Or you can get the full path with powershell by checking the registry - note that this also requires running powershell as an admin user:

Source https://stackoverflow.com/questions/62534677

QUESTION

How to use os.system to convert all files in a folder at once using external python script

Asked 2020-Feb-04 at 13:11

I've managed to find out the method to convert a file from one file extension to another (.evtx to .xml) using an external script. Below is what I am using:

...

ANSWER

Answered 2020-Feb-03 at 11:57

import os, sys

DIR = "D:/Test"

# ...or as a command line argument

DIR = sys.argv[1]

for f in os.listdir(DIR):
    path = os.path.join(DIR, f)

    name, ext = os.path.splitext(f)

    if ext == ".txt":
        new_path = os.path.join(DIR, f"{name}.xml")    

        os.rename(path, new_path)

Source https://stackoverflow.com/questions/60038561

QUESTION

How to export Windows Event log for a specific source with WMI?

Asked 2020-Jan-05 at 02:23

I'm trying to use Win32_NTEventLogFile WMI class to export the Applications branch of the Windows Event log, but filter it only for a specific source. (Otherwise the log contains too much unnecessary information.)

So, just as an example, say, I need to export all records that contain MSSQL$SQLSRVR2012:

I do this:

...

ANSWER

Answered 2020-Jan-05 at 02:23

The internal name used to identify the Source may be different from what is presented in the Computer Management UI.
For example, the Source Winlogon, internally is referenced as Microsoft-Windows-Winlogon.

Also, there's a problem with the Sources parameter, since it's an array.

This modified method uses Win32_NTLogEvent instead of Win32_NTEventLogFile.
I think it goes more directly to the target.
The query uses LIKE '%parameter%' to filter the Source, for the reason I mentioned. It's however possible to extract all the sources names using your original method with the LogFileName filter and analyse the content of the Sources { } array.

The values extracted from the Log Source File are store in a List.
You can use it's properties to create a report that looks like the one you see in Event Viewer.

Note: The TimeGenerated and TimeLogged properties can be converted to DateTime using the ManagementDateTimeConverter .ToDateTime Method

Source https://stackoverflow.com/questions/48972882

QUESTION

Creating a progress bar for BASH script exporting system log files

Asked 2020-Jan-03 at 23:09

Essentially for a set number of systems logs pulled and exported I need to indicate the scripts progress by printing a character "#". This should eventually create a progress bar with a width of 60. Something like what's presented below: ############################################# ,additionally I need the characters to build from left to right indicating the progression of the script.

The Question/Problem that this code was based off of goes as follows: "Use a separate invocation of wevtutil el to get the count of the number of logs and scale this to,say, a width of 60."

...

ANSWER

Answered 2020-Jan-03 at 23:09

For the sake of this answer I'm going to assume the desired output is a 2-liner that looks something like:

Source https://stackoverflow.com/questions/59548651

QUESTION

Returning matched regex & Select-object properties of file where expression matched

Asked 2019-May-13 at 08:16

I'm attempting to match regex and return both the matched expression and the file's object properties where the regex is true.

...

ANSWER

Answered 2019-May-13 at 08:16

You are not saying what issues you are having. You are not showing errors and explaining you issue with your code.

If you are trying to do this on anything other than text only files, this will never work.

Why are you calling an exe at all, when you can just use Select-String in both cases?
Why are you mixing aliases?

What is the expectation of this...

Source https://stackoverflow.com/questions/56103358

QUESTION

Saving and reading a file into a data table - C#

Asked 2019-Apr-18 at 22:39

I am new to this so bear with me. I am trying to create an application that can open a file, load it and then populate the data into a table. I have managed to hardcode it to the test file I wanted but now need to be able to open any file of the same extension.

The code I have so far is included. Appreciate if someone could point me in the right direction :) Thanks, Jo

...

ANSWER

Answered 2019-Apr-18 at 22:39

If I understand what your issue is, you are prompting for a file in Button3_Click() with...

Source https://stackoverflow.com/questions/55754187

QUESTION

Parsing Windows Event Logs stored in syslog-ng system with multi-lines and tabs

Asked 2019-Feb-15 at 09:05

I am trying to parse through a couple hundred gigs of Windows event logs that have not been formatted using SNARE, NXlog, or Adiscon (I am not sure how they shipped them to the syslog server).

The problem I am running into is determining the best/most efficient way to parse through a multi-line, multi-tabbed Windows event file. I don't have the corresponding EVTX file (it is just a log file).

My goal is to get each event onto one line, with no tabs so that I can parse through it easier using grep and awk.

tr -d "\n\r" < windows.log gets all of the content on one line (removes newlines) and now I would need to strip tabs (tabs less important than new lines) and figure out a way to add a new line every time BEFORE "Jan 14" is seen.

There is probably be a better way to do this with Python, Perl, or Powershell, but I am limited in experience there.

Example log file:

...

ANSWER

Answered 2019-Feb-15 at 09:05

First, we remove all control characters. Then we search for "Jan 14" and add a newline before it. Finally, we call tr with the -s flag which replaces instances of repeated characters with a single character. I am not quite sure how efficient this is but it might get you started.

Source https://stackoverflow.com/questions/54700223

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install evtx

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: