{"id":13843651,"url":"https://github.com/Clayeee/Win-Logs-Parse-tool","last_synced_at":"2025-07-11T19:32:51.604Z","repository":{"id":113213226,"uuid":"172630688","full_name":"Clayeee/Win-Logs-Parse-tool","owner":"Clayeee","description":null,"archived":false,"fork":false,"pushed_at":"2019-03-04T06:03:29.000Z","size":919,"stargazers_count":21,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-08-05T17:38:32.895Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Clayeee.png","metadata":{"files":{"readme":"README.MD","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2019-02-26T03:25:10.000Z","updated_at":"2024-07-28T13:40:40.000Z","dependencies_parsed_at":null,"dependency_job_id":"cac795a7-78fa-4237-bbda-ea60c216fa84","html_url":"https://github.com/Clayeee/Win-Logs-Parse-tool","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Clayeee%2FWin-Logs-Parse-tool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Clayeee%2FWin-Logs-Parse-tool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Clayeee%2FWin-Logs-Parse-tool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Clayeee%2FWin-Logs-Parse-tool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Clayeee","download_url":"https://codeload.github.com/Clayeee/Win-Logs-Parse-tool/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225755076,"owners_count":17519195,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:02:22.068Z","updated_at":"2024-11-21T15:31:19.669Z","avatar_url":"https://github.com/Clayeee.png","language":"Python","funding_links":[],"categories":["Python (1887)","Python"],"sub_categories":[],"readme":"---\nTool Name : Windows Safe Logs Parse Tool\nVersion   : v 1.0.0\nDeveloper : Xu Chao\nE-mail    : 1269575798@qq.com\nDate      : 19/02/26\n---\n\n# Windows安全日志解析工具\n\n可解析windows系统目录下的安全日志文件 ( 需获取管理员权限 )，也可采用手动添加文件的方式进行解析，解析后的文件为XML，HTML两种格式，HTML已采用Bootstrap框架进行界面可视化优化，可直接查看重点日志数据，解析后的HTML数据文件保存在执行文件下的`logs/`文件夹下 ( 自动创建 )，XML数据文件保存在执行文件下的`logs/xml/`文件夹下，本工具采用Python语言开发。\n\n\n\n### 功能特点\n\n- 日志文件可视化解析\n- 原始数据保存为XML文件\n- 管理员运行可直接解析系统日志\n- 可采用手动添加文件或目录方式进行解析\n\n\n\n### 参数解析\n\n```shell\noptional arguments:\n  -h, --help            show this help message and exit\n  -s, --system          读取并解析指定的windows日志\n  -f FILE, --file FILE  指定一个evtx文件进行解析\n  -d DIR, --dir DIR     指定一个目录，解析目录下所有evtx文件(默认为系统日志文件夹)\n```\n\n\n\n### 源码结构\n\n```\n├─import              # 引用模块\n├─argparse            # 参数解析模块\n├─parse_logs          # evtx日志文件解析模块\n├─XML_parse           # XML数据解析模块\n├─save_data           # 数据保存模块\n└─__main__            # 主模块\n```\n\n\n\n### 功能详情\n\n- ##### `argparse `——参数解析模块\n\n  - 所需模块：`argparse`\n\n  - 功能： `-h  --help` :  显示参数帮助文档\n\n    ​             `-s --system` : 读取并解析系统日志，需手动选择解析文件\n\n    ​\t     `-f  --file` : 指定日志文件进行解析，如执行：`python tool.py -f D:/Application.evtx`\n\n    ​\t     `-d --dir` : 指定目录，解析目录下所有日志文件，如执行：`python tool.py -f D:/log/`\n\n- ##### `parse_logs`——`evtx`日志文件解析模块\n\n  - 所需模块：`Evtx,contextlib,mmap`\n  - 功能：利用`python-evtx`模块解析`.evtx`文件数据，遍历事件，将事件解析为`XML`数据格式，单个事件顶级标签为\u003cevent\u003e，返回单个文件解析的所有`XML`数据。\n\n- ##### `XML_parse`——`XML`数据解析模块\n\n  - 所需模块：`xml.dom.minidom`\n  - 功能：将 XML 数据在内存中解析成一个树，通过对树的操作来操作 XML。返回一个字典列表，列表长度为文件内事件数，字典内保存获取的数据。\n\n- ##### `save_data`—— 数据保存模块\n\n  - 所需模块：`os,codecs,string.Template`\n  - 功能：通过传入的`mod`参数判断保存数据格式\n    - XML下：\n      1. 判断是否存在`log/xml/`文件夹，不存在则创建\n      2. 写入与`evtx`文件同名的`XML`文件\n      3. 为XML文件添加顶级标签\u003cdata\u003e \u003c!--不添加则无法解析XML文件--\u003e\n      4. 写入`parse_logs`返回的`XML`数据\n    - HTML下：\n      1. 利用字符串模板，将提前定义好的`html`文件模板字符串的变量进行替换\n      2. 循环遍历`XML_parse`返回的列表，将变量绑定至`HTML`文件\n      3. 单个列表绑定一个`table`表格\n      4. 写入数据\n\n- ##### `__main__`——程序入口\n\n  1. 判断参数\n  2. 遍历目录（如解析单个文件则没有此功能）\n  3. 将.evtx文件解析为XML数据\n  4. 将XML数据保存为XML文件\n  5. 将XML文件数据解析为DOM树，获取数据并返回一个字典列表\n  6. 将字典列表数据通过字符串模板写入HTML文件内\n\n\n\n### 程序演示\n\n##### 执行`--help`参数：\n\n![--help](./src/--help.png)\n\n##### 执行`--system`参数：\n\n###### ​文件选择界面：\n\n![-s 1](./src/-s1.png)\n\n![-s 2](./src/-s2.png)\n\n##### 执行`--file`参数：\n\n![-f](./src/-f.png)\n\n##### 自动创建文件夹及文件：\n\n![dir2](./src/dir2.png)\n\n##### `XML`文档内容：\n\n![xml](./src/xml.png)\n\n##### `HTML`文档内容：\n\n![html](./src/html.png)\n\n##### 执行`--dir`参数：\n\n![-d](./src/-d.png )\n\n\n\n### 已知缺陷\n\n- 采用阻塞式I/O开发，在解析大文件或目录下多个文件时程序运行较慢。\n\n\n\n### 联系我\n\n------\n\n\u003cimg src=\"src/qq.jpg\" tittle=\"XuChao\" style=\"width:300px\" /\u003e","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FClayeee%2FWin-Logs-Parse-tool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FClayeee%2FWin-Logs-Parse-tool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FClayeee%2FWin-Logs-Parse-tool/lists"}