Skip to main content
Join the official 2020 Python Developers SurveyStart the survey!

Python bindings for https://github.com/omerbenamram/evtx

Project description

Build Status

pyevtx-rs

Python bindings for https://github.com/omerbenamram/evtx/.

Installation

Available on PyPi - https://pypi.org/project/evtx/.

To install from PyPi - pip install evtx

Wheels

Wheels are currently automatically built for python3.6 python3.7 for all 64-bit platforms (Windows, macOS, and manylinux).

Installation from sources

Installation is possible for other platforms by installing from sources, this requires a nightly rust compiler and setuptools-rust.

Run python setup.py install

Usage

The API surface is currently fairly limited (only yields events as XML/JSON documents), but is planned to be expanded in the future.

This will print each record as an XML string.

from evtx import PyEvtxParser


def main():
    parser = PyEvtxParser("./samples/Security_short_selected.evtx")
    for record in parser.records():
        print(f'Event Record ID: {record["event_record_id"]}')
        print(f'Event Timestamp: {record["timestamp"]}')
        print(record['data'])
        print(f'------------------------------------------')

And this will print each record as a JSON string.

from evtx.parser import PyEvtxParser


def main():
    parser = PyEvtxParser("./samples/Security_short_selected.evtx")
    for record in parser.records_json():
        print(f'Event Record ID: {record["event_record_id"]}')
        print(f'Event Timestamp: {record["timestamp"]}')
        print(record['data'])
        print(f'------------------------------------------')

File-like objects are also supported.

from evtx.parser import PyEvtxParser


def main():
    a = open("./samples/Security_short_selected.evtx", 'rb')
    
    # io.BytesIO is also supported.
    parser = PyEvtxParser(a)
    for record in parser.records_json():
        print(f'Event Record ID: {record["event_record_id"]}')
        print(f'Event Timestamp: {record["timestamp"]}')
        print(record['data'])
        print(f'------------------------------------------')

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for evtx, version 0.6.11
Filename, size File type Python version Upload date Hashes
Filename, size evtx-0.6.11-cp35-cp35m-macosx_10_7_x86_64.whl (688.3 kB) File type Wheel Python version cp35 Upload date Hashes View
Filename, size evtx-0.6.11-cp35-cp35m-manylinux1_x86_64.whl (754.5 kB) File type Wheel Python version cp35 Upload date Hashes View
Filename, size evtx-0.6.11-cp35-none-win_amd64.whl (693.0 kB) File type Wheel Python version cp35 Upload date Hashes View
Filename, size evtx-0.6.11-cp36-cp36m-macosx_10_7_x86_64.whl (688.2 kB) File type Wheel Python version cp36 Upload date Hashes View
Filename, size evtx-0.6.11-cp36-cp36m-manylinux1_x86_64.whl (754.3 kB) File type Wheel Python version cp36 Upload date Hashes View
Filename, size evtx-0.6.11-cp36-none-win_amd64.whl (693.0 kB) File type Wheel Python version cp36 Upload date Hashes View
Filename, size evtx-0.6.11-cp37-cp37m-macosx_10_7_x86_64.whl (688.0 kB) File type Wheel Python version cp37 Upload date Hashes View
Filename, size evtx-0.6.11-cp37-cp37m-manylinux1_x86_64.whl (754.1 kB) File type Wheel Python version cp37 Upload date Hashes View
Filename, size evtx-0.6.11-cp37-none-win_amd64.whl (692.8 kB) File type Wheel Python version cp37 Upload date Hashes View
Filename, size evtx-0.6.11-cp38-cp38-macosx_10_7_x86_64.whl (688.0 kB) File type Wheel Python version cp38 Upload date Hashes View
Filename, size evtx-0.6.11-cp38-cp38-manylinux1_x86_64.whl (754.1 kB) File type Wheel Python version cp38 Upload date Hashes View
Filename, size evtx-0.6.11-cp38-none-win_amd64.whl (692.8 kB) File type Wheel Python version cp38 Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page