Create a project on log analyzer which displays time spent on each application and create graphs later

56 Views Asked by At

I'm a complete rookie in Python except for some basics. This is the code I've made from various answers from stackoverflow itself and some youtube.

import csv
from dateutil.parser import isoparse
import matplotlib.pyplot as plt
import seaborn as sns
import win32evtlog
import xml.etree.ElementTree as ET
import ctypes
import sys
import pandas as pd
import pprint

from pandas import DataFrame


def is_admin():
    try:
        return ctypes.windll.shell32.IsUserAnAdmin()
    except:
        return False


if is_admin():

    # open event file
    query_handle = win32evtlog.EvtQuery(
        'C:\Windows\System32\winevt\Logs\Application.evtx',
        win32evtlog.EvtQueryFilePath)

    read_count = 0
    sources = []
    events_id = []
    times = []

    while True:
        # read 1 record(s)
        events = win32evtlog.EvtNext(query_handle, 10)
        read_count += len(events)
        # if there is no record break the loop
        if len(events) == 0:
            break
        for event in events:
            xml_content = win32evtlog.EvtRender(event, win32evtlog.EvtRenderEventXml)
            # parse xml content
            xml = ET.fromstring(xml_content)

            # xml namespace, root element has a xmlns definition, so we have to use the namespace
            ns = '{http://schemas.microsoft.com/win/2004/08/events/event}'
            if len(xml) > 1 and len(xml[1]) > 9:
                substatus = xml[1][9].text
            else:
                substatus = 'N/A'
            provider = xml.find(f'.//{ns}Provider')
            source = provider.get('Name')
            event_record_id = xml.find(f'.//{ns}EventRecordID').text
            event_id = xml.find(f'.//{ns}EventID').text
            computer = xml.find(f'.//{ns}Computer').text
            execution = xml.find(f'.//{ns}Execution')
            process_id = execution.get('ProcessID')
            thread_id = execution.get('ThreadID')
            time_created = xml.find(f'.//{ns}TimeCreated').get('SystemTime')
            # event_name = lookup_event_name(event_record_id)
            # data_name = xml.findall('.//EventData')
            # substatus = data_name.get('Data')
            # print(substatus)
            # print(source.group())

            sources.append(source)
            events_id.append(event_id)
            times.append(time_created)

            event_data = f'Source:{source},EventRecordID: {event_record_id}, Time: {time_created}, Computer: {computer}, Substatus: {substatus}, Event Id: {event_id}, Process Id: {process_id}, Thread Id: {thread_id}'
            df: DataFrame = pd.DataFrame({'Source': sources, 'Event ID': events_id, 'Time Created': times})
            # print(df)
            # print(event_data)
            df.to_csv("application.csv", index=False)
            # pprint.pprint(df)
            user_data = xml.find(f'.//{ns}UserData')

            # user_data has possible any data
            csv_path = 'application.csv'
            df1 = pd.read_csv('application.csv')
            # df=pd.DataFrame({'Time Created'})
            # df['Time Created']=pd.to_datetime(df['Time Created'])
            # time_spent = df.groupby(' Source')['TimeStamp'].agg(['min'], ['max'])
            # time_spent['time_spent'] = time_spent['max'] - time_spent['min']
            # data = ['time_spent', 120]

            # with open('application.csv', 'a') as f:
            #   writer = csv.writer(f)
            #  writer.writerows(data)
            # print(df)
else:
    ctypes.windll.shell32.ShellExecuteW(None, "runas", sys.executable, " ".join(sys.argv), None, 1)

Help me with the application time and creating graph part. Till now I can parse the evtx file and store it as an csv.I have seen about creating XML file and adding source application and then link it with API of windows but idk how to do it so if you know how it works help me. Thank you in advance

0

There are 0 best solutions below