Skip to content

Commit df1f3fd

Browse files
ajread4ajread4
committed
added JSON functionality and new dump file
1 parent 2e8f359 commit df1f3fd

2 files changed

Lines changed: 77 additions & 29 deletions

File tree

‎scripts/evtx_dump.py‎

Lines changed: 27 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
import Evtx.Views as e_views
2222
import os
2323
import xmltodict
24-
from typing import Dict
24+
import json
2525

2626

2727
def main():
@@ -31,39 +31,37 @@ def main():
3131
description="Dump a binary EVTX file into XML.")
3232
parser.add_argument("evtx", type=str,
3333
help="Path to the Windows EVTX event log file")
34-
parser.add_argument("-o","--output",type=str,help="Path to the output file")
34+
parser.add_argument("-o","--output",type=str,help="Path to output JSON file")
3535
args = parser.parse_args()
3636

3737
with evtx.Evtx(args.evtx) as log:
3838

3939
if (args.output):
40-
if(os.path.splitext(args.output)[1]==".json"):
41-
for record in log.records():
42-
data_dict=xmltodict.parse(record.xml()) #convert the xml to a dictionary
43-
'''
44-
for event_system_key,event_system_value in data_dict['Event']['System'].items(): #loop through each key and value pair
45-
if isinstance(data_dict['Event']['System'][str(event_system_key)],Dict): #if the dictionary is nested, enter the dictionary
46-
sublist=[]
47-
for event_system_subkey,event_system_subvalue in data_dict['Event']['System'][str(event_system_key)].items(): #loop through the nested dictionary
48-
print(event_system_key+"_"+event_system_subkey[1:] + ":" + str(event_system_subvalue))
49-
else:
50-
print(event_system_key + ":" + str(event_system_value))
51-
'''
52-
for event_system_key, event_system_value in data_dict['Event']['System'].items(): # loop through each key and value pair
53-
if (event_system_key=="EventRecordID"):
54-
json_subline = {}
55-
firstline={event_system_key:event_system_value}
56-
json_subline.update(firstline)
57-
for event_data_key, event_data_value in data_dict['Event']['EventData'].items(): # loop through each key and value pair
58-
for values in event_data_value:
59-
for event_data_subkey,event_data_subvalue in values.items():
60-
if event_data_subkey=="@Name":
61-
data_name=event_data_subvalue
62-
else:
63-
data_value=event_data_subvalue
64-
json_subline.update({data_name:data_value})
65-
else:
66-
print("Invalid File Type")
40+
final_json=[]
41+
for record in log.records():
42+
data_dict=xmltodict.parse(record.xml()) #convert the xml to a dictionary
43+
for event_system_key, event_system_value in data_dict['Event']['System'].items(): # loop through each key and value pair
44+
if (event_system_key=="EventRecordID"):
45+
json_subline={}
46+
firstline={event_system_key:event_system_value}
47+
json_subline.update(firstline) #add the event ID to JSON subline
48+
for event_data_key, event_data_value in data_dict['Event']['EventData'].items(): # loop through each key and value pair
49+
for values in event_data_value:
50+
for event_data_subkey,event_data_subvalue in values.items(): #loop through each
51+
if event_data_subkey=="@Name": #extract the name from the value
52+
data_name=event_data_subvalue
53+
else:
54+
data_value=event_data_subvalue #extract the true value
55+
json_subline.update({data_name:data_value}) #update the JSON sub line
56+
final_json.append(json_subline) #update the final
57+
58+
# Output the JSON data
59+
if (os.path.splitext(args.output)[1] == ".json"): #if the file extension is correct
60+
json_file=args.output
61+
else: # if the file extension is incorrect
62+
json_file=args.output +".json"
63+
with open(json_file,"w") as outfile: #write to an output file
64+
json.dump(final_json,outfile)
6765
else:
6866
print(e_views.XML_HEADER)
6967
print("<Events>")

‎scripts/evtx_dump_json.py‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Written by AJ Read with help from evtx_dump.py file. Adds functionality to dump EVTX to JSON.
2+
3+
import Evtx.Evtx as evtx
4+
import Evtx.Views as e_views
5+
import os
6+
import xmltodict
7+
import json
8+
9+
def main():
10+
import argparse
11+
12+
parser = argparse.ArgumentParser(
13+
description="Dump a binary EVTX file into XML.")
14+
parser.add_argument("evtx", type=str,
15+
help="Path to the Windows EVTX event log file")
16+
parser.add_argument("-o","--output",type=str,help="Path to output JSON file")
17+
args = parser.parse_args()
18+
19+
with evtx.Evtx(args.evtx) as log:
20+
final_json=[]
21+
for record in log.records():
22+
data_dict=xmltodict.parse(record.xml()) #convert the xml to a dictionary
23+
for event_system_key, event_system_value in data_dict['Event']['System'].items(): # loop through each key and value pair
24+
if (event_system_key=="EventRecordID"):
25+
json_subline={}
26+
firstline={event_system_key:event_system_value}
27+
json_subline.update(firstline) #add the event ID to JSON subline
28+
for event_data_key, event_data_value in data_dict['Event']['EventData'].items(): # loop through each key and value pair
29+
for values in event_data_value:
30+
for event_data_subkey,event_data_subvalue in values.items(): #loop through each
31+
if event_data_subkey=="@Name": #extract the name from the value
32+
data_name=event_data_subvalue
33+
else:
34+
data_value=event_data_subvalue #extract the true value
35+
json_subline.update({data_name:data_value}) #update the JSON sub line
36+
final_json.append(json_subline) #update the final
37+
38+
# If output is desired
39+
if (args.output):
40+
# Output the JSON data
41+
if (os.path.splitext(args.output)[1] == ".json"): #if the file extension is correct
42+
json_file=args.output
43+
else: # if the file extension is incorrect
44+
json_file=args.output +".json"
45+
with open(json_file,"w") as outfile: #write to an output file
46+
json.dump(final_json,outfile)
47+
else:
48+
print(final_json)
49+
if __name__ == "__main__":
50+
main()

0 commit comments

Comments
 (0)