|A list of event log files to parse.
|list of OSPath (required)
|The accessor to use.
|A Message database from https://github.com/Velocidex/evtx-data.
|If specified we use this many workers to parse the file in parallel (default 1).
Required Permissions: FILESYSTEM_READ
Parses events from an EVTX file.
This plugin parses windows events from the Windows Event log files (EVTX).
A windows event typically contains two columns. The
contains event specific structured data while the
contains common data for all events - including the Event ID.
You should probably almost always filter by one or more event ids
SELECT System.TimeCreated.SystemTime as Timestamp,
System.EventID.Value as EventID,
EventData.ImagePath as ImagePath,
EventData.ServiceName as ServiceName,
EventData.ServiceType as Type,
System.Security.UserID as UserSID,
EventData as _EventData,
System as _System
FROM watch_evtx(filename=systemLogFile) WHERE EventID = 7045