igevtx

Documentation

Overview

Parse the contents of the EVTX files. Reference: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-even6/c73573ae-1c90-43a2-a65f-ad7501155956 (c) 2019, igosha (2igosha@gmail.com)

Index

• func ParseEvtx(fname string, hnd EventHandler) error
• type EventHandler

Functions

func ParseEvtx

func ParseEvtx(fname string, hnd EventHandler) error

Completely parse the EVTX file, use hnd as callback for every record found

Types

type EventHandler

type EventHandler func(when time.Time, num uint64, variable map[string]string)

Callback type for ParseEvtx, gets the timestamp, record number and values for each event log record