Integer as string
forensenellanebbia opened this issue · 3 comments
forensenellanebbia commented
Is there a way to consider a value as integer instead of string? My goal is to write a map that shows the remaining battery percentage (RemainingCapacity/FullChargeCapacity)*100 based on the following event:
<Event>
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="331c3b3a-2005-44c2-ac5e-77220c37d6b4" />
<EventID>105</EventID>
<Version>1</Version>
<Level>4</Level>
<Task>100</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000404</Keywords>
<TimeCreated SystemTime="2020-09-22 16:23:18.0478843" />
<EventRecordID>5495</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="17436" />
<Channel>System</Channel>
<Computer>MYPC</Computer>
<Security />
</System>
<EventData>
<Data Name="AcOnline">False</Data>
<Data Name="RemainingCapacity">56293</Data>
<Data Name="FullChargeCapacity">62654</Data>
</EventData>
</Event>
AndrewRathbun commented
Appears to be a duplicate issue. Assuming #98 was a typo?
forensenellanebbia commented
Appears to be a duplicate issue. Assuming #98 was a typo?
Sorry, I didn't notice I sent it twice.
AndrewRathbun commented
Honestly, you could prob still make a Map for this and make the data in PayloadData1, for instance, something that's turnkey to copy/paste into Google or any other search engine. That way, the Map is made, and the visibility is given to the examiner about the artifacts available. It's better than nothing IMO!