Description:

This processor is used to parse Windows event logs in the binary evtx format. The input flow files' content should be evtx files. The processor has 4 outputs:

• The original unmodified FlowFile
• The XML resulting from parsing at the configured granularity
• Failed parsing with partial output
• Malformed chunk in binary form

Output XML Example:

<?xml version="1.0"?>
<Events>
  <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
      <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" Ev
entSourceName="Service Control Manager"/>
      <EventID Qualifiers="16384">7036</EventID>
      <Version>0</Version>
      <Level>4</Level>
      <Task>0</Task>
      <Opcode>0</Opcode>
      <Keywords>0x8080000000000000</Keywords>
      <TimeCreated SystemTime="2016-01-08 16:49:47.518"/>
      <EventRecordID>780</EventRecordID>
      <Correlation ActivityID="" RelatedActivityID=""/>
      <Execution ProcessID="480" ThreadID="596"/>
      <Channel>System</Channel>
      <Computer>win7-pro-vm</Computer>
      <Security UserID=""/>
    </System>
    <EventData>
      <Data Name="param1">Workstation</Data>
      <Data Name="param2">running</Data>
      <Binary>TABhAG4AbQBhAG4AVwBvAHIAawBzAHQAYQB0AGkAbwBuAC8ANAAAAA==</Binary>
    </EventData>
  </Event>
  <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
      <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager"/>
      <EventID Qualifiers="16384">7036</EventID>
      <Version>0</Version>
      <Level>4</Level>
      <Task>0</Task>
      <Opcode>0</Opcode>
      <Keywords>0x8080000000000000</Keywords>
      <TimeCreated SystemTime="2016-01-08 16:49:47.535"/>
      <EventRecordID>781</EventRecordID>
      <Correlation ActivityID="" RelatedActivityID=""/>
      <Execution ProcessID="480" ThreadID="576"/>
      <Channel>System</Channel>
      <Computer>win7-pro-vm</Computer>
      <Security UserID=""/>
    </System>
    <EventData>
      <Data Name="param1">Cryptographic Services</Data>
      <Data Name="param2">running</Data>
      <Binary>QwByAHkAcAB0AFMAdgBjAC8ANAAAAA==</Binary>
    </EventData>
  </Event>
</Events>