https://github.com/marirs/windows-eventlog-transform

Transform the windows event log xml into json
https://github.com/marirs/windows-eventlog-transform

cef events json logs rust windows

Last synced: about 2 months ago
JSON representation

Transform the windows event log xml into json

• Host: GitHub
• URL: https://github.com/marirs/windows-eventlog-transform
• Owner: marirs
• License: mit
• Created: 2021-01-31T04:46:27.000Z (over 5 years ago)
• Default Branch: main
• Last Pushed: 2021-03-06T11:30:26.000Z (over 5 years ago)
• Last Synced: 2025-08-24T21:30:16.988Z (11 months ago)
• Topics: cef, events, json, logs, rust, windows
• Language: Rust
• Homepage:
• Size: 85.9 KB
• Stars: 1
• Watchers: 1
• Forks: 1
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
Transform Windows Event Log XML

--------------------------------

[![Build Status](https://travis-ci.com/marirs/windows-eventlog-transform.svg?branch=main)](https://travis-ci.com/marirs/windows-eventlog-transform)

Transform Windows Event Log XML files or strings into JSON and or Common Event Format (CEF)

## Requirements

- Rust

### Compile

- Build Release

```bash

cargo b --release

```

- Test

```bash

cargo t

```

## Run Examples

```bash

cargo run --example eg1

```

## Example Transformed Json

```json

{

  "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event",

  "System": {

    "Provider": {

      "Name": "BTHUSB",

      "Guid": null

    },

    "EventRecordID": 5662,

    "Event": {

      "EventID": 18,

      "EventName": "EventID-18"

    },

    "Level": "Information",

    "Task": "None",

    "Opcode": "Info",

    "Keywords": "Classic",

    "TimeCreated": "2021-01-29T12:37:19.5374683Z",

    "Correlation": {

      "ActivityID": null

    },

    "Execution": {

      "ProcessID": 4,

      "ThreadID": 1240

    },

    "Channel": "System",

    "Computer": "DESKTOP-G089JUF",

    "Security": {

      "UserID": null

    },

    "Version": 0

  },

  "EventData": {

    "Data": [

      null

    ],

    "Binary": "00000800010000000000000012000540000000000000000000000000000000000000000000000000E000000000000000"

  }

}

```

---