Struct EvtxRecord 

pub struct EvtxRecord<'a> {
    pub chunk: &'a EvtxChunk<'a>,
    pub event_record_id: RecordId,
    pub timestamp: Timestamp,
    pub tree: IrTree<'a>,
    pub binxml_offset: u64,
    pub binxml_size: u32,
    pub settings: Arc<ParserSettings>,
}

Fields

chunk: &'a EvtxChunk<'a>

event_record_id: RecordId

timestamp: Timestamp

tree: IrTree<'a>

binxml_offset: u64

binxml_size: u32

settings: Arc<ParserSettings>

Implementations

impl<'a> EvtxRecord<'a>

pub fn into_json_value(self) -> Result<SerializedEvtxRecord<Value>>

Consumes the record and returns the rendered JSON as a serde_json::Value.

pub fn into_json(self) -> Result<SerializedEvtxRecord<String>>

Consumes the record and renders it as compact JSON (streaming IR renderer).

pub fn into_xml(self) -> Result<SerializedEvtxRecord<String>>

Consumes the record and parse it, producing an XML serialized record.

pub fn template_instances(&self) -> Result<Vec<BinXmlTemplateValues<'a>>>

Parse all TemplateInstance substitution arrays from this record.

This is a lightweight scan over the record’s BinXML stream that extracts typed substitution values without building a legacy token vector.

Trait Implementations

impl<'a> Clone for EvtxRecord<'a>

fn clone(&self) -> EvtxRecord<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for EvtxRecord<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.