Pkg.EVTX — API for parsing Windows Event Logs

Overview

The Pkg.EVTX module contains the API for parsing Windows Event Log (.evtx) files.

Iterating Events

The following code example demonstrates how to iterate over event records in an EVTX file:

from Pro.Core import *
from Pkg.EVTX import *

def parseEVTX(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    obj = EVTXObject()
    if not obj.Load(c) or not obj.Initialize():
        return
    for i in range(obj.GetEventCount()):
        er = obj.GetEvent(i)
        if er == None:
            continue
        print("record:", er.RecordNumber,
              "time:", er.TimeCreated.ToString("yyyy-MM-dd HH:mm:ss"),
              "event id:", er.EventId,
              "level:", er.Level,
              "provider:", er.Provider,
              "channel:", er.Channel)

Retrieving Event XML

Each event record contains a structured XML payload with the full event data. It can be retrieved either from the record object or directly by index:

from Pro.Core import *
from Pkg.EVTX import *

def printEventXml(fname, index):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    obj = EVTXObject()
    if not obj.Load(c) or not obj.Initialize():
        return
    xml = obj.GetEventXml(index)
    if xml:
        print(xml)

Module API

Pkg.EVTX module API.

Classes:

EVTXObject()

This class represents a Windows Event Log (.evtx) file.

class EVTXObject

Bases: Pro.Core.CFFObject

This class represents a Windows Event Log (.evtx) file.

Methods:

GetEvent(i)	Retrieves an event record by its index.
GetEventCount()	Returns the number of parsed event records.
GetEventXml(i)	Returns the full XML representation of the event at the given index.

GetEvent(i: int) → Any

Retrieves an event record by its index.

The returned object is a .NET evtx.EventRecord with the following properties: RecordNumber, TimeCreated, EventId, Level, Provider, Channel, Computer, ProcessId, ThreadId, UserId, Keywords, Payload, HiddenRecord.

Call ConvertPayloadToXml() on the returned record to obtain the full event XML.

Parameters

i (int) – The zero-based event index.

Returns

Returns the event record if successful; otherwise returns None.

Return type

Any

See also GetEventCount(), GetEventXml().

GetEventCount() → int

Returns

Returns the number of parsed event records.

Return type

int

See also GetEvent().

GetEventXml(i: int) → Optional[str]

Returns the full XML representation of the event at the given index.

Parameters

i (int) – The zero-based event index.

Returns

Returns the event XML string if successful; otherwise returns None.

Return type

Optional[str]

See also GetEvent().