Struct EvtxParser 

pub struct EvtxParser<T: ReadSeek> { /* private fields */ }

Wraps a single EvtxFileHeader.

Example usage (single threaded):

let mut parser = EvtxParser::from_path(fp).unwrap();

for record in parser.records() {
    match record {
        Ok(r) => println!("Record {}\n{}", r.event_record_id, r.data),
        Err(e) => eprintln!("{}", e),
    }
}

Example usage (multi-threaded):

let settings = ParserSettings::default().num_threads(0);
let mut parser = EvtxParser::from_path(fp).unwrap().with_configuration(settings);

for record in parser.records() {
    match record {
        Ok(r) => println!("Record {}\n{}", r.event_record_id, r.data),
        Err(e) => eprintln!("{}", e),
    }
}

Implementations

impl EvtxParser<File>

pub fn from_path(path: impl AsRef<Path>) -> Result<Self>

Attempts to load an evtx file from a given path, will fail if the path does not exist, or if evtx header is invalid.

impl EvtxParser<Cursor<Vec<u8>>>

pub fn from_buffer(buffer: Vec<u8>) -> Result<Self>

Attempts to load an evtx file from a given path, will fail the evtx header is invalid.

impl<T: ReadSeek> EvtxParser<T>

pub fn from_read_seek(read_seek: T) -> Result<Self>

pub fn with_configuration(self, configuration: ParserSettings) -> Self

pub fn find_next_chunk( &mut self, chunk_number: u64, ) -> Option<(Result<EvtxChunkData>, u64)>

Find the next chunk, staring at chunk_number (inclusive). If a chunk is found, returns the data of the chunk or the relevant error, and the number of that chunk.

pub fn chunks(&mut self) -> IterChunks<'_, T>

Return an iterator over all the chunks. Each chunk supports iterating over it’s records in their un-serialized state (before they are converted to XML or JSON).

pub fn into_chunks(self) -> IntoIterChunks<T>

Consumes the parser, returning an iterator over all the chunks. Each chunk supports iterating over it’s records in their un-serialized state (before they are converted to XML or JSON).

pub fn serialized_records<'a, U: Send>( &'a mut self, f: impl FnMut(Result<EvtxRecord<'_>>) -> Result<U> + Send + Sync + Clone + 'a, ) -> impl Iterator<Item = Result<U>> + 'a

Return an iterator over all the records. Records will be mapped f, which must produce owned data from the records.

pub fn records( &mut self, ) -> impl Iterator<Item = Result<SerializedEvtxRecord<String>>> + '_

Return an iterator over all the records. Records will be XML-formatted.

pub fn records_json( &mut self, ) -> impl Iterator<Item = Result<SerializedEvtxRecord<String>>> + '_

Return an iterator over all the records. Records will be JSON-formatted.

pub fn records_json_value( &mut self, ) -> impl Iterator<Item = Result<SerializedEvtxRecord<Value>>> + '_

Return an iterator over all the records. Records will have a serde_json::Value data attribute.

Trait Implementations

impl<T: ReadSeek> Debug for EvtxParser<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.