Log analysis would not be complete without tackling Windows log files.
The important thing to note is that Windows uses a proprietary file format and
logs are stored in EVTX files which have an XML structure.
In order to parse these files, we'll be making use of a specific module.
It's called Python EVTX and it's developed by William Ballenthin.
In the GitHub repo,
there are also standalone scripts available which can be used directly.
The scenarios in which we can add value is for forensics
where the logs are not shipped to log repository or SIEM and
you obtain a copy of the log files.
You can then use Python to automate the analysis on them.
Leveraging Python EVTX,
this function can open EVTX files and extract log entries
similar to the one used for regular text files.
This function will yield an XML object rather than a string so it
can be parsed to extract the individual fields.
On the right, we have the schema of the Windows event.
To extract the System tag, we can use the find function,
and we provide the name of the tag that we want to
identify and the namespace of the object.
To get the metadata of the log event such as the EventID value,
we can run the find function again on the sys_tag object
that we have identified previously.
We can follow a similar procedure to identifying the event data.
The EventData tag contains an array of data objects.
We can extract this using the getchildren function on the
EventData object to access the nested objects.
All data objects have the same data tag,
but they are uniquely identified by the name attribute.
To extract this for each element,
we can use the getattrib function followed by the name attribute.
This will be the key in our dictionary.
And to get the actual value of the object,
the text function is used, and this will be the value in our dictionary.