(self)
| 298 | return {k:v for k,v in zip(event_data_name, self.event_values())} |
| 299 | |
| 300 | def xml_data(self): |
| 301 | xmlevt = xml.dom.minidom.parseString(self.render_xml()) |
| 302 | res = {} |
| 303 | |
| 304 | eventdata = xmlevt.getElementsByTagName("EventData") |
| 305 | if eventdata: |
| 306 | # <Data Name='FIELD_NAME'>FIELD_VALUE</Data> |
| 307 | for i, datanode in enumerate(xmlevt.getElementsByTagName("Data")): |
| 308 | name = datanode.getAttribute("Name") |
| 309 | if not name: |
| 310 | # Some Data in old EVTX have no name (Windows Powershell) |
| 311 | # Do the best we can by using the position of the event |
| 312 | name = str(i) |
| 313 | |
| 314 | if datanode.hasChildNodes(): |
| 315 | value = datanode.firstChild.nodeValue |
| 316 | else: |
| 317 | value = "" |
| 318 | if not (name not in res): |
| 319 | import pdb;pdb.set_trace() |
| 320 | res[name] = value |
| 321 | userdata = xmlevt.getElementsByTagName("UserData") |
| 322 | if userdata: |
| 323 | # <UserData> |
| 324 | # <EventXML xmlns="Event_NS"> |
| 325 | # <FIELD_NAME>FIELD_VALUE</FIELD_NAME> |
| 326 | # </EventXML> |
| 327 | # </UserData> |
| 328 | for datanode in userdata[0].firstChild.childNodes: |
| 329 | name = datanode.tagName |
| 330 | if datanode.hasChildNodes(): |
| 331 | value = datanode.firstChild.nodeValue |
| 332 | else: |
| 333 | value = "" |
| 334 | assert name not in res |
| 335 | res[name] = value |
| 336 | return res |
| 337 | |
| 338 | |
| 339 | @property |
nothing calls this directly
no test coverage detected