xml_event_xtractor

export windows evtx events from xmlcli export files

XML Event Extractor

Version: 0.1beta

Overview

The XML Event Extractor is a Python script designed to parse security-related XML event logs and extract meaningful data into a structured format. It focuses on extracting relevant security event IDs from Windows Event Logs (such as login attempts, logoffs, process creation, etc.).

Features

• Parses XML files with UTF-8 or UTF-16 encoding.
• Supports extraction of various security event IDs.
• Outputs relevant event data into a CSV file.

Supported Event IDs

The script handles the following event IDs:

• Successful Logon
• Failed Logon
• Logoff
• Process Creation
• Service Installation
• Directory Service Modifications, and more...

Installation

1. Clone the repository:

   git clone https://github.com/suuhm/xml_event_xtractor.git

2. Navigate to the project directory:

   cd xml_event_xtractor.py

3. Install required dependencies:

   pip install -r requirements.txt

Usage

To use the XML Event Extractor, simply run the script with the XML file as an argument:

python xml_event_xtractor.py /PATH/TO/FILE(*.xml, *.evtx)

Output

The script will generate a CSV file (ExtractedEvents.csv) containing the extracted events with their details.

License

This project is licensed under the MIT License.