Skip to content

Instantly share code, notes, and snippets.

Last active March 24, 2023 08:06
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
Star You must be signed in to star a gist
What would you like to do?
Parse Startup Info XML Artifact
import os
import pandas as pd
from lxml import etree
def parse_startup_info(xml_path):
with open(xml_path,'rb') as f:
root = etree.fromstring(
recorded_boot_time = (int(root.get('IntervalEndMs')) - int(root.get('IntervalStartMs'))) / 1000
print('Recorded boot time: {}'.format(recorded_boot_time))
result = []
for p in root.iterchildren():
if p.tag == 'Process':
entry = {'process_name': p.get('Name'),
'pid': p.get('PID'),
'started_trace_in_sec': p.get('StartedInTraceSec')}
entry.update({ x.tag: x.text for x in p.getchildren()})
entry['DiskUsage'] = int(entry['DiskUsage'])
entry['CpuUsage'] = int(entry['CpuUsage'])
return result
# Parse a Startup Info XML artifact and get back a data frame:
xml = 'S-1-5-21-3553886025-3664455354-4024410332-1110_StartupInfo5.xml'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment