Ambiguity in Windows XML Event Logs

Question

Hi Team,

We are working on extracting keys and values from XML event logs for some data analytics applications. While working on designing the parser we came across a different behavior that is causing an issue defining the rules for the parser.

Consider an example event below:

<Event xmlns='http://xyz.pqr.abc/win/2004/08/events/event'>

<System>

<TimeCreated SystemTime='2021-03-11 10:06:17Z' />

</System>

<EventData>

<Data Name='WorkstationName'></Data>

<Data Name='TransmittedServices'>dummyvalue</Data>

</EventData>

</Event>

I have removed other irrelevant fields from the above event.

So what we expect is

Expected: Event.System.TimeCreated.SystemTime = 2021-03-11 10:06:17Z
Actual: Event.System.TimeCreated.SystemTime = 2021-03-11 10:06:17Z

and for (ambiguity is present here)

Expected: EventData.Data.Name.WorkstationName = <empty value>
Actual: EventData.Data.Name = WorkstationName

and for

Expected: EventData.Data.Name.TransmittedServices = dummyvalue
Actual: EventData.Data.Name.TransmittedServices = dummyvalue (since it has value)

But if we define a specific rule then this would not result in what we want, as you can see above.

Is there any way that can help us resolve this issue or any windows document which can define the rules for the format of the event?

Please suggest if there is some way to move ahead here.

Thank You

Answer 1

Hello,

Thank you for your question..

As far I know you can create custom Query or View using XPath to fetch the event viewer data.

Please have look on below Microsoft article which may help you further.

https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata

https://devblogs.microsoft.com/scripting/data-mine-the-windows-event-log-by-using-powershell-and-xml/

https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/advanced-xml-filtering-in-the-windows-event-viewer/ba-p/399761

If the reply was helpful, please don’t forget to upvote or accept as answer.