Skip to content

Instantly share code, notes, and snippets.

@truekonrads
Created July 20, 2017 19:59
Show Gist options
  • Save truekonrads/f04ff0409622876d5e6912d78e9f2c5a to your computer and use it in GitHub Desktop.
Save truekonrads/f04ff0409622876d5e6912d78e9f2c5a to your computer and use it in GitHub Desktop.
Convert evtx to json
#!/usr/bin/env python
# Convert evtx to json
import Evtx.Evtx as evtx
import sys
import json
def recursive_dict(element):
# https://stackoverflow.com/questions/42925074/python-lxml-etree-element-to-json-or-dict
t = element.tag
if t.index('}') > 0:
t = t[t.index('}') + 1:]
return t, \
dict(map(recursive_dict, element)) or element.text
for f in sys.argv:
with evtx.Evtx(f) as log:
for record in log.records():
print json.dumps(recursive_dict(record.lxml()))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment