New subject: Datamining MS Windows eventlogs converted to xml

15 Apr 2021


      Another approach may be to use WinLogBeat and get BaseX to query
ElasticSearch.
Did this, worked ok

On Wed, Apr 14, 2021 at 6:00 PM <basex-talk-request@mailman.uni-konstanz.de>
wrote:
...
Send BaseX-Talk mailing list submissions to
        basex-talk@mailman.uni-konstanz.de
To subscribe or unsubscribe via the World Wide Web, visit
        https://mailman.uni-konstanz.de/mailman/listinfo/basex-talk
or, via email, send a message with subject or body 'help' to
        basex-talk-request@mailman.uni-konstanz.de
You can reach the person managing the list at
        basex-talk-owner@mailman.uni-konstanz.de
When replying, please edit your Subject line so it is more specific
than "Re: Contents of BaseX-Talk digest..."
Today's Topics:
1. Re: Datamining MS Windows eventlogs converted to xml
      (Christian Gr?n)
----------------------------------------------------------------------
Message: 1
Date: Tue, 13 Apr 2021 16:51:06 +0200
From: Christian Gr?n <christian.gruen@gmail.com>
To: commandline-be <commandline@protonmail.com>
Cc: BaseX <basex-talk@mailman.uni-konstanz.de>
Subject: Re: [basex-talk] Datamining MS Windows eventlogs converted to
        xml
Message-ID:
        <CAP94bnPEUXc9biKsC5TNmN6-5bERatSW-uMF6n6cw4G70y=
MQQ@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Hi Joris,
...
The kind of queries I'll need to write may be quite complex. At least to
me at this point, I noticed BaseX to have more under the hood i have yet to
explore.
As XQuery has a much broader scope than SQL, you can write very
sophisticated queries. In our documentation, you can find some simple
use cases; see e.g. [1,2,3].
...
One other thing I'd like to explore is if I can query and/or index .evt
and. evtx files directly by repurposing source code.
As far as I know, these formats are proprietary, but you could include
external converters for that [4]. Such a converter could also be
invoked from XQuery [5], and the result could be further processed.
Hope this helps,
Christian
[1] https://docs.basex.org/wiki/XQuery_3.0
[2] https://docs.basex.org/wiki/XQuery_3.1
[3] https://docs.basex.org/wiki/XQuery
[4]
https://www.vanimpe.eu/2015/07/16/use-evtxparser-convert-windows-event-log-f...
[5] https://docs.basex.org/wiki/Process_Module
...
Typically I expect to query for unique eventid to create a baseline and
for one or more reoccurring field values which may span any or all eventid.
Here i will need to do pattern matching for example for uuid, ip, fqdn etc.
My preliminary super simple tests have shown this to be feasible.
Based on these results and queries I'd the seek to export to json or
other formats. Maybe also to send data to elasticsearch or neo4j.
One other thing I'd like to explore is if I can query and/or index .evt
and. evtx files directly by repurposing source code.
Best Regards,
Joris
-------- Oorspronkelijk bericht --------
Aan 12 apr. 2021 12:51, Christian Gr?n < christian.gruen@gmail.com>
schreef:
Hi Joris,
Have you already exported the MS windows events to XML, and are you
now trying to extract specific information from that files?
Best,
Christian
On Wed, Apr 7, 2021 at 2:13 PM Joris Lambrecht
<commandline@protonmail.com> wrote:
...
Dear,
For the longest time a good tool to datamine ms windows eventlogs
escaped me.
BaseX appears to offer the toolkit which could permit to do so after an
affordable conversion to XML.
Now i seek to build a set of queries to extract information from
multiple converted eventlog files at once.
Are there people on this list who have experience or are open to
building experience on this topic ?
Br,
Joris
End of BaseX-Talk Digest, Vol 136, Issue 7
******************************************

Re: [basex-talk] Datamining MS Windows eventlogs converted to xml

Adam Law

commandline-be

tags

participants (2)