Automation?

[brandonstephens922]

We are trying to get this process automated so this tool will always show yesterday's user activity. Is there a tested and proven method for retrieving event logs in XML. Anything we have tried results in an XML file that can't be read or parsed by LogonTracer.

[shu-tom]

We use Event viewer or PowerShell.

[brandonstephens922]

We are trying to as well but can't seem to get the format of the xml correct? Logontracer is unable to recognize the file as xml and will not load the file. Could you please post the powers shell method in detail? Thank you.

On Tue, Nov 12, 2019, 5:23 PM shusei tomonaga notifications@github.com wrote:

We use Event viewer or PowerShell.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/JPCERTCC/LogonTracer/issues/63?email_source=notifications&email_token=AI4UYJWJD7DLKF3EIVLZL4LQTMUE7A5CNFSM4JMEZSCKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOED4FBYA#issuecomment-553144544, or unsubscribe https://github.com/notifications/unsubscribe-auth/AI4UYJRA7A43F3WSOWVTCRDQTMUE7ANCNFSM4JMEZSCA .

[shu-tom]

Please show a block example of your xml.

[shu-tom]

You can easily export using the wevtutil command.

> wevtutil qe Security /f:XML

[brandonstephens922]

This is the error we continue to receive:

[] Script start. 2019/11/14 07:49:32 [] Time zone is -4. [!] This file is not XML format testing5.xml.

Here are the various methods I have tried:

wevtutil qe Security > test6.xml (Format error on upload)

wevtutil qe Security /f:XML > testing6.xml (Format error on upload)

wevtutil qe Security /f:RenderedXML > testing5.xml (Format error on upload)

wevtutil epl Security C:\Users\testing3.evtx (This method works but there is no option for XML)

[brandonstephens922]

So in trying to upload via web ui one of the XML files retrieved this way, we receive the error EVTX parse Failed! Could you provide what version of Windows you may be successfully running the wevtutil command on? Very interested in how to successfully automate the XML export process successfully.

[denncraft]

I also ran into errors when trying to load XML files. I will not describe my torment and search for a long time, but will immediately move on to the key points:

1. The XML file must start with the string <?xml . This is strictly checked in the code.
2. Technically, the XML file should have one main root element, and inside it there are already many of its descendants, for example: <Events><Event></Event><Event></Event></Events>, but this is not in the code checked.
3. I don't know why, but the line of code:if xml.startswith("<System>"): didn't work as expected. and if so: if (xml.strip()).startswith('<System>'): then it works.