Function driver_framework_events 

pub fn driver_framework_events<I>(records: I) -> Vec<DriverFrameworkEvent>
where
    I: IntoIterator<Item = Value>,

Extract USB DriverFrameworks arrival/removal events from an iterator of evtx record JSON values (each the {"Event": {…}} object). Keeps only Microsoft-Windows-DriverFrameworks-UserMode records with EID 2003 or 2102 whose instance is a USB\ / USBSTOR\ device (root hubs and internal devices dropped).