Skip to content

Commit df24946

Browse files
committed
finished with updates to dump_json
1 parent 7ac40e8 commit df24946

2 files changed

Lines changed: 3 additions & 2 deletions

File tree

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ python-evtx operates on event log files from Windows operating systems newer tha
2929

3030
Examples
3131
--------
32-
Provided with the parsing module `Evtx` are four scripts that mimic the tools distributed with Parse-Evtx. `evtx_info.py` prints metadata about the event log and verifies the checksums of each chunk. `evtx_templates.py` builds and prints the templates used throughout the event log. `evtx_dump.py` parses the event log and transforms the binary XML into a human readable ASCII XML format. Finally, `evtx_dump_json.py` parses event logs, similar to `evtx_dump.py` and transforms the binary XML into JSON with the added capability to output new line delimited JSON to a file.
32+
Provided with the parsing module `Evtx` are four scripts that mimic the tools distributed with Parse-Evtx. `evtx_info.py` prints metadata about the event log and verifies the checksums of each chunk. `evtx_templates.py` builds and prints the templates used throughout the event log. `evtx_dump.py` parses the event log and transforms the binary XML into a human readable ASCII XML format. Finally, `evtx_dump_json.py` parses event logs, similar to `evtx_dump.py` and transforms the binary XML into JSON with the added capability to output the JSON array to a file.
3333

3434
Note the length of the `evtx_dump.py` script: its only 20 lines. Now, review the contents and notice the complete implementation of the logic:
3535

scripts/evtx_dump_json.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
# This file is part of python-evtx.
33
# Written by AJ Read with help from evtx_dump.py file written by Willi Ballenthin.
44
#
5-
# Purpose: User can dump evtx data into JSON format to either the command line or a JSON file in new line delimited format.
5+
# Purpose: User can dump evtx data into JSON format to either the command line or a JSON file in new line delimited format/JSON array.
6+
# Details: The JSON object is created with only the EventRecordID from the System section of the evtx XML and all of the information within the EventData section.
67

78
import Evtx.Evtx as evtx
89
import Evtx.Views as e_views

0 commit comments

Comments
 (0)