evtx 0.11.2

A Fast (and safe) parser for the Windows XML Event Log (EVTX) format
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

mod fixtures;

use evtx::{EvtxParser, ParserSettings};
use fixtures::ensure_env_logger_initialized;
use serde_json::Value;

/// Regression test for aggregated `<EventData><Data>...</Data>...</EventData>`
/// handling in the JSON renderer.
///
/// When there are multiple unnamed `<Data>` elements, we expect
/// `Event.EventData.Data.#text` to be an array.
#[test]
fn test_json_multiple_data_elements_are_aggregated() {
    ensure_env_logger_initialized();

    let evtx_file = include_bytes!("../samples/MSExchange_Management_wec.evtx");

    let mut parser = EvtxParser::from_buffer(evtx_file.to_vec())
        .unwrap()
        .with_configuration(ParserSettings::new().num_threads(1));

    let record = parser
        .records_json()
        .next()
        .expect("to have records")
        .expect("record to parse correctly");

    let value: Value = serde_json::from_str(&record.data).expect("JSON should be valid");
    let text = &value["Event"]["EventData"]["Data"]["#text"];
    assert!(
        text.is_array(),
        "expected Event.EventData.Data.#text to be an array when multiple unnamed <Data> elements exist"
    );
    assert!(
        text.as_array().is_some_and(|a| a.len() > 1),
        "expected multiple aggregated Data items"
    );
}