{"id":23419377,"url":"https://github.com/bannsec/winevt","last_synced_at":"2025-04-13T08:33:26.565Z","repository":{"id":53018208,"uuid":"90325082","full_name":"bannsec/winevt","owner":"bannsec","description":"Windows Event Interactions in Python","archived":false,"fork":false,"pushed_at":"2024-11-10T02:02:13.000Z","size":53,"stargazers_count":67,"open_issues_count":10,"forks_count":5,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-03-27T00:12:40.467Z","etag":null,"topics":["event","logs","python","windows"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bannsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-05-05T01:33:29.000Z","updated_at":"2024-11-06T19:32:38.000Z","dependencies_parsed_at":"2025-02-18T22:10:48.675Z","dependency_job_id":"7c2bf18e-401d-4fef-92a3-896ae0c7da2c","html_url":"https://github.com/bannsec/winevt","commit_stats":null,"previous_names":["owlz/winevt"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bannsec%2Fwinevt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bannsec%2Fwinevt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bannsec%2Fwinevt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bannsec%2Fwinevt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bannsec","download_url":"https://codeload.github.com/bannsec/winevt/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248684357,"owners_count":21145061,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["event","logs","python","windows"],"created_at":"2024-12-23T01:17:50.273Z","updated_at":"2025-04-13T08:33:26.544Z","avatar_url":"https://github.com/bannsec.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Overview\nThis is a library to interact with the Windows Event Logging system. The focus is to interact directly with the Windows API, rather than parsing evt files. This will allow you to use python to parse events as well as subscribe to providers.\n\n# Install\n`winevt` can be installed directly as a package from pypi. I recommend you install it into a python virtual environment.\n\n```bash\n$ mkvirtualenv --python=$(which python3) winevt # Optional\n(winevt)$ pip install winevt\n```\n\n# Current Features\nCurrently, this library supports querying and subscribing to event logs or parsing of event log files. Because this library uses the Windows API directly, you can query for any of the reigstered event providers.\n\n# Example\n## Query\nLet's say you want to review the error report alerts that are in your Application event log. To print out all the times you dropped a dump file, you could do the following:\n\n```python\nIn [1]: from winevt import EventLog\n\nIn [2]: query = EventLog.Query(\"Application\",\"Event/System/Provider[@Name='Windows Error Reporting']\")\n\nIn [3]: for event in query:\n   ...:     for item in event.EventData.Data:\n   ...:         if \"dmp\" in item.cdata:\n   ...:             print(item.cdata)\n```\n\nIf you were interested in seeing every time you had an error or critical event from the System, you could do:\n\n```python\nIn [1]: from winevt import EventLog\n\nIn [2]: query = EventLog.Query(\"System\",\"Event/System[Level\u003c=2]\")\n\nIn [3]: for event in query:\n   ...:     print(event.System.Provider['Name'])\n```\n\n## Subscription\nLet's say you want to watch for new Errors and Critial events from the System log, and want to be able to take some form of immediate action. You can acomplish that through a subcription using a python function as your callback.\n\n```python\nIn [1]: from winevt import EventLog\n\nIn [2]: def handle_event(action, pContext, event):\n   ...:     print(\"Got event: \" + str(event))\n   ...:\n\nIn [3]: cb = EventLog.Subscribe(\"System\",\"Event/System[Level\u003c=2]\",handle_event)\n\nIn [4]: Got event: \u003cEvent EventID=10016 Level=Error\u003e\nGot event: \u003cEvent EventID=10016 Level=Error\u003e\nGot event: \u003cEvent EventID=10016 Level=Error\u003e\n```\n\nIf you want to cancel your subscription, simply use the unsubscribe method:\n\n```python\nIn [5]: cb.unsubscribe()\n```\n\n# EventLog.Event\nThe `EventLog.Event` class abstracts the concept of a Windows Event Log. There are likely two primary ways you would use this:\n\n## Event.xml\nEvery `Event` object has an `xml` property to it. That property is the same XML you would find looking through the Windows Event Viewer. It is returned as a string and you can parse it however you wish.\n\n## Event structure\nEvery `Event` object also has a structure to it. The structure is effectively the output of `untangle`. That said, it starts at the Event level so it makes Windows Events easier to traverse. Here's an example of XML:\n\n```xml\n\u003cEvent xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"\u003e\n  \u003cSystem\u003e\n    \u003cProvider EventSourceName=\"Software Protection Platform Service\" Guid=\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\" Name=\"Microsoft-Windows-Security-SPP\"/\u003e\n    \u003cEventID Qualifiers=\"16384\"\u003e903\u003c/EventID\u003e\n    \u003cVersion\u003e0\u003c/Version\u003e\n    \u003cLevel\u003e0\u003c/Level\u003e\n    \u003cTask\u003e0\u003c/Task\u003e\n    \u003cOpcode\u003e0\u003c/Opcode\u003e\n    \u003cKeywords\u003e0x80000000000000\u003c/Keywords\u003e\n    \u003cTimeCreated SystemTime=\"2017-05-05T16:11:37.282412200Z\"/\u003e\n    \u003cEventRecordID\u003e12126\u003c/EventRecordID\u003e\n    \u003cCorrelation/\u003e\n    \u003cExecution ProcessID=\"0\" ThreadID=\"0\"/\u003e\n    \u003cChannel\u003eApplication\u003c/Channel\u003e\n    \u003cComputer\u003ePhoenix\u003c/Computer\u003e\n    \u003cSecurity/\u003e\n  \u003c/System\u003e\n  \u003cEventData/\u003e\n\u003c/Event\u003e\n```\n\nIf this were the XML for our `Event` object, and we wanted to find out the TimeCreated, we could do the following:\n\n```python\nevent.System.TimeCreated['SystemTime']\n```\n\n# Authenticate Local and Remote\nYou can authenticate locally and remotely. If you provide no extra details, you will by default authenticate locally as your current user. However, for both `Query` and `Subscribe`, you can provide the following optional arguments:\n\n - username\n - password\n - domain\n - server\n - auth (default, negotiate, kerberos, ntlm)\n\nFor example, if you wished to connect to a server using username \"administrator\", it would be:\n\n```python\nquery = EventLog.Query(\"Security\",\"*\",username=\"administrator\", server=\"myserver\", domain=\"mydomain\")\n```\n\nYou would then be prompted for the password interactively.\n\n# Bookmarks\nIf you want to ensure you're not losing your place, you can use bookmarks. The Bookmark class abstracts the fundamental Windows construct of a bookmark. Use of bookmarks can be done by:\n\n1. Instantiate a new bookmark\n\n```python\nbookmark = EventLog.Bookmark()\n```\n\n1b. If you already have a bookmark, just feed in the xml\n\n```python\nbookmark = EventLog.Bookmark(xml)\n```\n\n2. Give the bookmark parameter to `Query` or `Subscribe`\n\n```python\ncb = EventLog.Subscribe(\"System\",\"*\",handle_event,bookmark=bookmark)\n```\n\n3. Save your bookmark by saving your xml however you wish\n\n```python\nbookmark.xml\n```\n\nThe updating of the bookmark will occur behind the scenes for you.\n\n# Multiple Subscription Support\nThis library supports subscribing to as many channels as you want. The caveat is that you should not allow your `Subscription` objects to be garbage collected. In practice, this just means don't overwrite your class variables. Even if you're not using them, keep them around so that python doesn't try to garbage collect them on you.\n\n# Tested On\nI have only tested this on my Windows 10 x64 system with python 3.6 x64. It should work across most Windows systems given a Python x64 version \u003e=3.2 (cffi changes).\n\nIt will very likely NOT work on python 2.\n\nIt might work on python 3.2+ x86. Let me know your experience.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbannsec%2Fwinevt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbannsec%2Fwinevt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbannsec%2Fwinevt/lists"}