Parse Startup Info XML Artifact

parse_startupinfo_xml.py

import os
import pandas as pd
from lxml import etree
pd.set_option('max_colwidth',200)

def parse_startup_info(xml_path):
    with open(xml_path,'rb') as f:
        root = etree.fromstring(f.read())
        
    recorded_boot_time = (int(root.get('IntervalEndMs')) - int(root.get('IntervalStartMs'))) / 1000
    print('Recorded boot time: {}'.format(recorded_boot_time))
    result = []

    for p in root.iterchildren():
        if p.tag == 'Process':
            entry = {'process_name': p.get('Name'),
                'pid': p.get('PID'),
                'started_trace_in_sec': p.get('StartedInTraceSec')}
            entry.update({ x.tag: x.text for x in p.getchildren()})
            entry['DiskUsage'] = int(entry['DiskUsage'])
            entry['CpuUsage'] = int(entry['CpuUsage'])
            result.append(entry)
        else:
            print(p.tag,p.text)
    return result
  
# Parse a Startup Info XML artifact and get back a data frame:
xml = 'S-1-5-21-3553886025-3664455354-4024410332-1110_StartupInfo5.xml'    
pd.DataFrame.from_dict(parse_startup_info(xml))