williballenthin/python-evtx

json output

geekscrapy opened this issue · 3 comments

geekscrapy commented

How would you go about getting json output? Just looking to dump the events to json for easy ingest into logstash

williballenthin commented

I'd probably render to the XML format, and then translate to JSON from there. Under the hood, the EVTX format represents XML, so while there may be ways to pull out a JSON document file structure more directly, working with an EVTX file as if it were XML is a better way to think about it.

Its a little bit annoying that the different EVTX event types have all sorts of different schemas. But, I think you can cover the common cases with a small amount of work. This will definitely be sufficient to get data into logstash.

  • 👍1
williballenthin commented

closing this issue due to lack of activity. please re-open if you have further questions!