[NIFI-1975] Processor to Parse .evtx files

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.0.0, 1.0.0-Beta
• Assignee: Unassigned
• Reporter: Bryan Rosander
• Created: 06/Jun/16 17:19
• Updated: 04/Aug/16 21:23
• Resolved: 16/Jun/16 10:58

Description

Windows event logs are stored in .evtx format as-of Windows Vista. If we port the pure python implementation of an evtx parser at https://github.com/williballenthin/python-evtx to Java, we should be able to ingest those files in NiFi on any operating system

These files are located in C:\Windows\System32\winevt\Logs unless exported elsewhere.

Issue Links

• links to: GitHub Pull Request #492