puffyCid / artemis

A cross platform forensic parser written in Rust!
MIT License
65 stars 8 forks source link

Eventlog parsing enhancements #182

Closed puffyCid closed 1 week ago

puffyCid commented 1 week ago

This large PR adds support for including template strings when parsing eventlogs. This allows artemis to include the entire eventlog message when parsing evtx files (on Windows systems)

codecov[bot] commented 1 week ago

Codecov Report

Attention: Patch coverage is 88.35961% with 347 lines in your changes missing coverage. Please review.

Project coverage is 84.96%. Comparing base (30af4bc) to head (e704956). Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
core/src/artifacts/os/windows/eventlogs/parser.rs 68.31% 77 Missing :warning:
core/src/artifacts/os/windows/eventlogs/combine.rs 93.53% 64 Missing :warning:
...re/src/artifacts/os/windows/eventlogs/formaters.rs 82.29% 51 Missing :warning:
...cts/os/windows/eventlogs/resources/manifest/xml.rs 87.35% 43 Missing :warning:
core/src/artifacts/os/windows/pe/resources.rs 69.81% 32 Missing :warning:
core/src/artifacts/os/windows/eventlogs/strings.rs 89.55% 26 Missing :warning:
...s/os/windows/eventlogs/resources/manifest/table.rs 81.66% 11 Missing :warning:
.../windows/eventlogs/resources/manifest/defintion.rs 89.15% 9 Missing :warning:
core/src/artifacts/os/windows/eventlogs/error.rs 14.28% 6 Missing :warning:
...rc/artifacts/os/windows/eventlogs/resources/mui.rs 92.10% 6 Missing :warning:
... and 8 more
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #182 +/- ## ========================================== + Coverage 84.79% 84.96% +0.16% ========================================== Files 510 525 +15 Lines 62420 65363 +2943 ========================================== + Hits 52930 55534 +2604 - Misses 9490 9829 +339 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.