Support ETW?

[YamatoSecurity]

There is a good looking rust crate that supports reading ETW so it might be interesting to support ETW for real time detection. Not to be meant to use as a host IDS but more for checking if rules work in real time:

https://github.com/n4r1b/ferrisetw

https://docs.rs/ferrisetw/latest/ferrisetw/

For now I would like to see how easy/hard it would be to implement.

[YamatoSecurity]

After consideration and talking it over with people doing ETW detection, it is a much more complex issue than I first thought so I am going to leave this as out of scope for the project.