def main():
import argparse
parser = argparse.ArgumentParser(
description="Print the record numbers of EVTX log entries " "that match the given EID."
)
parser.add_argument("evtx", type=str, help="Path to the Windows EVTX file")
parser.add_argument("eid", type=int, help="The EID of records to extract")
args = parser.parse_args()
with Evtx(args.evtx) as evtx:
for xml, record in evtx_file_xml_view(evtx.get_file_header()):
try:
node = to_lxml(xml)
except XMLSyntaxError:
continue
if args.eid != int(get_child(get_child(node, "System"), "EventID").text):
continue
print(record.record_num())
def main():
import argparse
parser = argparse.ArgumentParser(
description="Print the record numbers of EVTX log entries "
"that match the given EID.")
parser.add_argument("evtx", type=str, help="Path to the Windows EVTX file")
parser.add_argument("eid", type=int, help="The EID of records to extract")
args = parser.parse_args()
with evtx.Evtx(args.evtx) as log:
for record in log.records():
try:
node = record.lxml()
except lxml.etree.XMLSyntaxError:
continue
if args.eid != int(
get_child(get_child(node, "System"), "EventID").text):
continue
print(record.record_num())