Feature Request - Parsing event log xml file

[dfirhoze]

Wondering if there is a way to parse an XML file of event logs that may have been extracted from memory with volatility or
Willi Ballenthin's evtxtract. Not able to find a method to extract the individual logs from the xml, but if this feature could be added to the tool, that'd be awesome! Thanks!

[alexkornitzer]

We would need to add in an xml parser in order to do this. I am not sure how flexible the current design of the code is to enable that though. Also I think this idea might have been shot down in the past. But i'll have a look to see how viable it is.

[alexkornitzer]

Okay so an XML parser is now in for v2.0.0-alpha.3. I have not thoroughly tested it but it should work. Please not that a new mapping file would need to be written to hunt on this data as the field names and format will be different to that of the evtx parser.