Windows 10 Event Log Parsing
up vote
0
down vote
favorite
Is it possible to parse exported or saved .evtx files and get relevant information (Xml details)of Windows 10 Event Logs using System.Diagnostics.EventLog class in visual studio.
I need to develop a tool which can extract forensically relevant eventlog information.
If Not, what are the alternatives?
c# windows-10 eventlog-source
edited Nov 10 at 15:02
Daniel A. White
146k35289370
asked Nov 10 at 12:13
Sharika R Nair
11
New contributor
Sharika R Nair is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
up vote
0
down vote
favorite
Is it possible to parse exported or saved .evtx files and get relevant information (Xml details)of Windows 10 Event Logs using System.Diagnostics.EventLog class in visual studio.
I need to develop a tool which can extract forensically relevant eventlog information.
If Not, what are the alternatives?
c# windows-10 eventlog-source
edited Nov 10 at 15:02
Daniel A. White
146k35289370
asked Nov 10 at 12:13
Sharika R Nair
11
New contributor
Sharika R Nair is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Welcome to stack overflow. Wonder if the developing that tool is a requirement. There seems to be tools that externally can open that file format. That being said, I dont see how this is related to any specific IDE
– bradbury9
Nov 10 at 12:18
Yes, developing that tool is a requirement.I need to extract certain relevant event id's and display on my tool. But I doubt whether is it possible to give an exported or saved event log as input file and use System.Diagnostics.EventLog class in C#. Kindly help me clear my doubt.
– Sharika R Nair
Nov 10 at 12:26
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
Is it possible to parse exported or saved .evtx files and get relevant information (Xml details)of Windows 10 Event Logs using System.Diagnostics.EventLog class in visual studio.
I need to develop a tool which can extract forensically relevant eventlog information.
If Not, what are the alternatives?
c# windows-10 eventlog-source
edited Nov 10 at 15:02
Daniel A. White
146k35289370
asked Nov 10 at 12:13
Sharika R Nair
11
New contributor
Sharika R Nair is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Is it possible to parse exported or saved .evtx files and get relevant information (Xml details)of Windows 10 Event Logs using System.Diagnostics.EventLog class in visual studio.
I need to develop a tool which can extract forensically relevant eventlog information.
If Not, what are the alternatives?
c# windows-10 eventlog-source
c# windows-10 eventlog-source
edited Nov 10 at 15:02
Daniel A. White
146k35289370
asked Nov 10 at 12:13
Sharika R Nair
11
New contributor
Sharika R Nair is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited Nov 10 at 15:02
Daniel A. White
146k35289370
asked Nov 10 at 12:13
Sharika R Nair
11
New contributor
Sharika R Nair is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited Nov 10 at 15:02
Daniel A. White
146k35289370
edited Nov 10 at 15:02
Daniel A. White
146k35289370
edited Nov 10 at 15:02
Daniel A. White
146k35289370
146k35289370
asked Nov 10 at 12:13
Sharika R Nair
11
New contributor
Sharika R Nair is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Nov 10 at 12:13
Sharika R Nair
11
asked Nov 10 at 12:13
Sharika R Nair
11
11
New contributor
Sharika R Nair is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Sharika R Nair is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Sharika R Nair is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Welcome to stack overflow. Wonder if the developing that tool is a requirement. There seems to be tools that externally can open that file format. That being said, I dont see how this is related to any specific IDE
– bradbury9
Nov 10 at 12:18
Yes, developing that tool is a requirement.I need to extract certain relevant event id's and display on my tool. But I doubt whether is it possible to give an exported or saved event log as input file and use System.Diagnostics.EventLog class in C#. Kindly help me clear my doubt.
– Sharika R Nair
Nov 10 at 12:26
add a comment |
Welcome to stack overflow. Wonder if the developing that tool is a requirement. There seems to be tools that externally can open that file format. That being said, I dont see how this is related to any specific IDE
– bradbury9
Nov 10 at 12:18
Yes, developing that tool is a requirement.I need to extract certain relevant event id's and display on my tool. But I doubt whether is it possible to give an exported or saved event log as input file and use System.Diagnostics.EventLog class in C#. Kindly help me clear my doubt.
– Sharika R Nair
Nov 10 at 12:26
Welcome to stack overflow. Wonder if the developing that tool is a requirement. There seems to be tools that externally can open that file format. That being said, I dont see how this is related to any specific IDE
– bradbury9
Nov 10 at 12:18
Welcome to stack overflow. Wonder if the developing that tool is a requirement. There seems to be tools that externally can open that file format. That being said, I dont see how this is related to any specific IDE
– bradbury9
Nov 10 at 12:18
Yes, developing that tool is a requirement.I need to extract certain relevant event id's and display on my tool. But I doubt whether is it possible to give an exported or saved event log as input file and use System.Diagnostics.EventLog class in C#. Kindly help me clear my doubt.
– Sharika R Nair
Nov 10 at 12:26
Yes, developing that tool is a requirement.I need to extract certain relevant event id's and display on my tool. But I doubt whether is it possible to give an exported or saved event log as input file and use System.Diagnostics.EventLog class in C#. Kindly help me clear my doubt.
– Sharika R Nair
Nov 10 at 12:26
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
You could use the powershell cmdlet Get-WinEvent to extract information from an evtx file. This can be called also from a C# program using System.Management.Automation.
answered Nov 10 at 14:59
Klaus Gütter
25118
is System.Management.Automation used to use cmdlet via c#??? I am a newbie so dont have much idea about programming. By using powershell cmdlet via C# we can extract info from .evtx and is it possible to display that in my GUI using C#?
– Sharika R Nair
Nov 10 at 15:55
Yes. See this question stackoverflow.com/questions/41680833/…
– Klaus Gütter
Nov 10 at 16:08
one last doubt friend, is database required to store the extracted information to display it in my GUI?
– Sharika R Nair
Nov 10 at 16:43
Required? No. Why should it? Depends on your application, though.
– Klaus Gütter
Nov 10 at 16:56
@SharikaRNair If you want to store the information in a database, you would require a database. You could store the information whenever you want (text files, xml, database, a custom file format) it depends on how you design your application.
– bradbury9
yesterday
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
You could use the powershell cmdlet Get-WinEvent to extract information from an evtx file. This can be called also from a C# program using System.Management.Automation.
answered Nov 10 at 14:59
Klaus Gütter
25118
is System.Management.Automation used to use cmdlet via c#??? I am a newbie so dont have much idea about programming. By using powershell cmdlet via C# we can extract info from .evtx and is it possible to display that in my GUI using C#?
– Sharika R Nair
Nov 10 at 15:55
Yes. See this question stackoverflow.com/questions/41680833/…
– Klaus Gütter
Nov 10 at 16:08
one last doubt friend, is database required to store the extracted information to display it in my GUI?
– Sharika R Nair
Nov 10 at 16:43
Required? No. Why should it? Depends on your application, though.
– Klaus Gütter
Nov 10 at 16:56
@SharikaRNair If you want to store the information in a database, you would require a database. You could store the information whenever you want (text files, xml, database, a custom file format) it depends on how you design your application.
– bradbury9
yesterday
add a comment |
up vote
0
down vote
You could use the powershell cmdlet Get-WinEvent to extract information from an evtx file. This can be called also from a C# program using System.Management.Automation.
answered Nov 10 at 14:59
Klaus Gütter
25118
is System.Management.Automation used to use cmdlet via c#??? I am a newbie so dont have much idea about programming. By using powershell cmdlet via C# we can extract info from .evtx and is it possible to display that in my GUI using C#?
– Sharika R Nair
Nov 10 at 15:55
Yes. See this question stackoverflow.com/questions/41680833/…
– Klaus Gütter
Nov 10 at 16:08
one last doubt friend, is database required to store the extracted information to display it in my GUI?
– Sharika R Nair
Nov 10 at 16:43
Required? No. Why should it? Depends on your application, though.
– Klaus Gütter
Nov 10 at 16:56
@SharikaRNair If you want to store the information in a database, you would require a database. You could store the information whenever you want (text files, xml, database, a custom file format) it depends on how you design your application.
– bradbury9
yesterday
add a comment |
up vote
0
down vote
up vote
0
down vote
You could use the powershell cmdlet Get-WinEvent to extract information from an evtx file. This can be called also from a C# program using System.Management.Automation.
answered Nov 10 at 14:59
Klaus Gütter
25118
You could use the powershell cmdlet Get-WinEvent to extract information from an evtx file. This can be called also from a C# program using System.Management.Automation.
answered Nov 10 at 14:59
Klaus Gütter
25118
answered Nov 10 at 14:59
Klaus Gütter
25118
answered Nov 10 at 14:59
Klaus Gütter
25118
answered Nov 10 at 14:59
Klaus Gütter
25118
25118
is System.Management.Automation used to use cmdlet via c#??? I am a newbie so dont have much idea about programming. By using powershell cmdlet via C# we can extract info from .evtx and is it possible to display that in my GUI using C#?
– Sharika R Nair
Nov 10 at 15:55
Yes. See this question stackoverflow.com/questions/41680833/…
– Klaus Gütter
Nov 10 at 16:08
one last doubt friend, is database required to store the extracted information to display it in my GUI?
– Sharika R Nair
Nov 10 at 16:43
Required? No. Why should it? Depends on your application, though.
– Klaus Gütter
Nov 10 at 16:56
@SharikaRNair If you want to store the information in a database, you would require a database. You could store the information whenever you want (text files, xml, database, a custom file format) it depends on how you design your application.
– bradbury9
yesterday
add a comment |
is System.Management.Automation used to use cmdlet via c#??? I am a newbie so dont have much idea about programming. By using powershell cmdlet via C# we can extract info from .evtx and is it possible to display that in my GUI using C#?
– Sharika R Nair
Nov 10 at 15:55
Yes. See this question stackoverflow.com/questions/41680833/…
– Klaus Gütter
Nov 10 at 16:08
one last doubt friend, is database required to store the extracted information to display it in my GUI?
– Sharika R Nair
Nov 10 at 16:43
Required? No. Why should it? Depends on your application, though.
– Klaus Gütter
Nov 10 at 16:56
@SharikaRNair If you want to store the information in a database, you would require a database. You could store the information whenever you want (text files, xml, database, a custom file format) it depends on how you design your application.
– bradbury9
yesterday
is System.Management.Automation used to use cmdlet via c#??? I am a newbie so dont have much idea about programming. By using powershell cmdlet via C# we can extract info from .evtx and is it possible to display that in my GUI using C#?
– Sharika R Nair
Nov 10 at 15:55
is System.Management.Automation used to use cmdlet via c#??? I am a newbie so dont have much idea about programming. By using powershell cmdlet via C# we can extract info from .evtx and is it possible to display that in my GUI using C#?
– Sharika R Nair
Nov 10 at 15:55
Yes. See this question stackoverflow.com/questions/41680833/…
– Klaus Gütter
Nov 10 at 16:08
Yes. See this question stackoverflow.com/questions/41680833/…
– Klaus Gütter
Nov 10 at 16:08
one last doubt friend, is database required to store the extracted information to display it in my GUI?
– Sharika R Nair
Nov 10 at 16:43
one last doubt friend, is database required to store the extracted information to display it in my GUI?
– Sharika R Nair
Nov 10 at 16:43
Required? No. Why should it? Depends on your application, though.
– Klaus Gütter
Nov 10 at 16:56
Required? No. Why should it? Depends on your application, though.
– Klaus Gütter
Nov 10 at 16:56
@SharikaRNair If you want to store the information in a database, you would require a database. You could store the information whenever you want (text files, xml, database, a custom file format) it depends on how you design your application.
– bradbury9
yesterday
@SharikaRNair If you want to store the information in a database, you would require a database. You could store the information whenever you want (text files, xml, database, a custom file format) it depends on how you design your application.
– bradbury9
yesterday
add a comment |
Sharika R Nair is a new contributor. Be nice, and check out our Code of Conduct.
draft saved
draft discarded
Sharika R Nair is a new contributor. Be nice, and check out our Code of Conduct.
Sharika R Nair is a new contributor. Be nice, and check out our Code of Conduct.
Sharika R Nair is a new contributor. Be nice, and check out our Code of Conduct.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53238833%2fwindows-10-event-log-parsing%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Welcome to stack overflow. Wonder if the developing that tool is a requirement. There seems to be tools that externally can open that file format. That being said, I dont see how this is related to any specific IDE
– bradbury9
Nov 10 at 12:18
Yes, developing that tool is a requirement.I need to extract certain relevant event id's and display on my tool. But I doubt whether is it possible to give an exported or saved event log as input file and use System.Diagnostics.EventLog class in C#. Kindly help me clear my doubt.
– Sharika R Nair
Nov 10 at 12:26