Skip to main content

Python bindings for https://github.com/omerbenamram/evtx

Project description

pyevtx-rs

Python bindings for https://github.com/omerbenamram/evtx/.

Installation

Available on PyPi - https://pypi.org/project/evtx/.

To install from PyPi - pip install evtx

Wheels

Wheels are currently automatically built for python 3.6,3.7,3.8,3.9 for all 64-bit platforms (Windows, macOS, and manylinux).

Installation from sources

Installation is possible for other platforms by installing from sources, this requires a rust compiler and setuptools-rust.

Run python setup.py install

Usage

The API surface is currently fairly limited (only yields events as XML/JSON documents), but is planned to be expanded in the future.

This will print each record as an XML string.

from evtx import PyEvtxParser


def main():
    parser = PyEvtxParser("./samples/Security_short_selected.evtx")
    for record in parser.records():
        print(f'Event Record ID: {record["event_record_id"]}')
        print(f'Event Timestamp: {record["timestamp"]}')
        print(record['data'])
        print(f'------------------------------------------')

And this will print each record as a JSON string.

from evtx.parser import PyEvtxParser


def main():
    parser = PyEvtxParser("./samples/Security_short_selected.evtx")
    for record in parser.records_json():
        print(f'Event Record ID: {record["event_record_id"]}')
        print(f'Event Timestamp: {record["timestamp"]}')
        print(record['data'])
        print(f'------------------------------------------')

File-like objects are also supported.

from evtx.parser import PyEvtxParser


def main():
    a = open("./samples/Security_short_selected.evtx", 'rb')

    # io.BytesIO is also supported.
    parser = PyEvtxParser(a)
    for record in parser.records_json():
        print(f'Event Record ID: {record["event_record_id"]}')
        print(f'Event Timestamp: {record["timestamp"]}')
        print(record['data'])
        print(f'------------------------------------------')

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for evtx, version 0.7.2
Filename, size File type Python version Upload date Hashes
Filename, size evtx-0.7.2-cp39-none-win_amd64.whl (672.7 kB) File type Wheel Python version cp39 Upload date Hashes View
Filename, size evtx-0.7.2-cp39-cp39-manylinux_2_24_x86_64.whl (756.6 kB) File type Wheel Python version cp39 Upload date Hashes View
Filename, size evtx-0.7.2-cp39-cp39-macosx_10_7_x86_64.whl (711.0 kB) File type Wheel Python version cp39 Upload date Hashes View
Filename, size evtx-0.7.2-cp38-none-win_amd64.whl (672.7 kB) File type Wheel Python version cp38 Upload date Hashes View
Filename, size evtx-0.7.2-cp38-cp38-manylinux_2_24_x86_64.whl (754.5 kB) File type Wheel Python version cp38 Upload date Hashes View
Filename, size evtx-0.7.2-cp38-cp38-macosx_10_7_x86_64.whl (711.0 kB) File type Wheel Python version cp38 Upload date Hashes View
Filename, size evtx-0.7.2-cp37-none-win_amd64.whl (672.7 kB) File type Wheel Python version cp37 Upload date Hashes View
Filename, size evtx-0.7.2-cp37-cp37m-manylinux_2_24_x86_64.whl (754.5 kB) File type Wheel Python version cp37 Upload date Hashes View
Filename, size evtx-0.7.2-cp37-cp37m-macosx_10_7_x86_64.whl (711.1 kB) File type Wheel Python version cp37 Upload date Hashes View
Filename, size evtx-0.7.2-cp36-none-win_amd64.whl (672.7 kB) File type Wheel Python version cp36 Upload date Hashes View
Filename, size evtx-0.7.2-cp36-cp36m-manylinux_2_24_x86_64.whl (756.8 kB) File type Wheel Python version cp36 Upload date Hashes View
Filename, size evtx-0.7.2-cp36-cp36m-macosx_10_7_x86_64.whl (711.1 kB) File type Wheel Python version cp36 Upload date Hashes View

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Huawei Huawei PSF Sponsor Microsoft Microsoft PSF Sponsor NVIDIA NVIDIA PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page