daipom
commented
4 months ago I see.
Looks like it is not possible now.
It looks like the library winevt_c does not have the feature:
I'm not sure how to achieve this as a Win32 API in the first place.
It looks like there is no description of how to take the Data Name of the EventData (The result for EvtRenderContextUser).
- https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtrender
- https://learn.microsoft.com/en-us/windows/win32/wes/rendering-events
If we figure out how to use the Win32 API for this, it would be possible to improve the library.
Hi. When parse_description is false, eventdata will be added to message, but only values. Example:
"EventData":["2478079","2023-02-03","200","Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/109.0.0.0+Safari/537.36+Edg/109.0.1518.78"]}But in xml:<EventData><Data Name="EnabledFieldsFlags">2478079</Data><Data Name="date">2023-02-07</Data><Data Name="sc-status">200</Data><Data Name="csUser-Agent">Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/109.0.0.0+Safari/537.36</Data></EventData>Is it possible to add name of attributes to parsed EventData?"EventData":["EnabledFieldsFlags":"2478079","date":"2023-02-03","sc-status":"200","csUser-Agent":"Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/109.0.0.0+Safari/537.36+Edg/109.0.1518.78"]}