Skip to content

Instantly share code, notes, and snippets.

@mkorman90
Last active March 24, 2023 08:06
Embed
What would you like to do?
Parse Startup Info XML Artifact
import os
import pandas as pd
from lxml import etree
pd.set_option('max_colwidth',200)
def parse_startup_info(xml_path):
with open(xml_path,'rb') as f:
root = etree.fromstring(f.read())
recorded_boot_time = (int(root.get('IntervalEndMs')) - int(root.get('IntervalStartMs'))) / 1000
print('Recorded boot time: {}'.format(recorded_boot_time))
result = []
for p in root.iterchildren():
if p.tag == 'Process':
entry = {'process_name': p.get('Name'),
'pid': p.get('PID'),
'started_trace_in_sec': p.get('StartedInTraceSec')}
entry.update({ x.tag: x.text for x in p.getchildren()})
entry['DiskUsage'] = int(entry['DiskUsage'])
entry['CpuUsage'] = int(entry['CpuUsage'])
result.append(entry)
else:
print(p.tag,p.text)
return result
# Parse a Startup Info XML artifact and get back a data frame:
xml = 'S-1-5-21-3553886025-3664455354-4024410332-1110_StartupInfo5.xml'
pd.DataFrame.from_dict(parse_startup_info(xml))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment