Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Integer as string #99

Open
forensenellanebbia opened this issue Jan 14, 2021 · 3 comments
Open

Integer as string #99

forensenellanebbia opened this issue Jan 14, 2021 · 3 comments
Assignees
Labels
enhancement New feature or request

Comments

@forensenellanebbia
Copy link
Contributor

Is there a way to consider a value as integer instead of string? My goal is to write a map that shows the remaining battery percentage (RemainingCapacity/FullChargeCapacity)*100 based on the following event:

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="331c3b3a-2005-44c2-ac5e-77220c37d6b4" />
    <EventID>105</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>100</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000404</Keywords>
    <TimeCreated SystemTime="2020-09-22 16:23:18.0478843" />
    <EventRecordID>5495</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="17436" />
    <Channel>System</Channel>
    <Computer>MYPC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="AcOnline">False</Data>
    <Data Name="RemainingCapacity">56293</Data>
    <Data Name="FullChargeCapacity">62654</Data>
  </EventData>
</Event>
@AndrewRathbun
Copy link
Collaborator

Appears to be a duplicate issue. Assuming #98 was a typo?

@forensenellanebbia
Copy link
Contributor Author

Appears to be a duplicate issue. Assuming #98 was a typo?

Sorry, I didn't notice I sent it twice.

@EricZimmerman EricZimmerman added the enhancement New feature or request label Jan 16, 2021
@AndrewRathbun
Copy link
Collaborator

Honestly, you could prob still make a Map for this and make the data in PayloadData1, for instance, something that's turnkey to copy/paste into Google or any other search engine. That way, the Map is made, and the visibility is given to the examiner about the artifacts available. It's better than nothing IMO!

@AndrewRathbun AndrewRathbun self-assigned this Sep 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants