-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathLog_Collector.py
More file actions
82 lines (66 loc) · 2.99 KB
/
Copy pathLog_Collector.py
File metadata and controls
82 lines (66 loc) · 2.99 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
import win32evtlog
import csv
from io import StringIO
import pandas as pd
import win32evtlog
import win32evtlogutil
import win32security
import win32con
import winerror
import time
import re
import string
import sys
import traceback
import hashlib
def system():
h = win32evtlog.OpenEventLog(None, "System")
flags = win32evtlog.EVENTLOG_BACKWARDS_READ|win32evtlog.EVENTLOG_SEQUENTIAL_READ
records = win32evtlog.ReadEventLog(h, flags, 0)
print("\n Number of records : ",len(records))
row, header = [None]*len(records), [None]*len(records)
fi = []
header[0] = "Index;Source Name;Time Written;Event ID;Record Number;Event Type;Event Category;Computer Name"
fi.append(header[0].split(';'))
for i in range(len(records)):
a = i + 1
row[i] = str(a) + ";" + records[i].SourceName + ";" + records[i].TimeWritten.Format() + ";" + str(records[i].EventID) + ";" + str(records[i].RecordNumber) + ";" + str(records[i].EventType) + ";" + str(records[i].EventCategory) + ";" + records[i].ComputerName
fi.append(row[i].split(';'))
df = pd.DataFrame(fi)
df.to_csv('System_Log.csv',header=None,index=False)
def security():
h = win32evtlog.OpenEventLog(None, "Security")
flags = win32evtlog.EVENTLOG_BACKWARDS_READ|win32evtlog.EVENTLOG_SEQUENTIAL_READ
records = win32evtlog.ReadEventLog(h, flags, 0)
print("\n Number of records : ",len(records))
row, header = [None]*len(records), [None]*len(records)
fi = []
header[0] = "Index;Source Name;Time Written;Event ID;Record Number;Event Type;Event Category;Computer Name"
fi.append(header[0].split(';'))
for i in range(len(records)):
a = i + 1
row[i] = str(a) + ";" + records[i].SourceName + ";" + records[i].TimeWritten.Format() + ";" + str(records[i].EventID) + ";" + str(records[i].RecordNumber) + ";" + str(records[i].EventType) + ";" + str(records[i].EventCategory) + ";" + records[i].ComputerName
fi.append(row[i].split(';'))
df = pd.DataFrame(fi)
df.to_csv('Security_Log.csv',header=None,index=False)
def application():
h = win32evtlog.OpenEventLog(None, "Application")
flags = win32evtlog.EVENTLOG_BACKWARDS_READ|win32evtlog.EVENTLOG_SEQUENTIAL_READ
records = win32evtlog.ReadEventLog(h, flags, 0)
print("\n Number of records : ",len(records))
row, header = [None]*len(records), [None]*len(records)
fi = []
header[0] = "Index;Source Name;Time Written;Event ID;Record Number;Event Type;Event Category;Computer Name"
fi.append(header[0].split(';'))
for i in range(len(records)):
a = i + 1
row[i] = str(a) + ";" + records[i].SourceName + ";" + records[i].TimeWritten.Format() + ";" + str(records[i].EventID) + ";" + str(records[i].RecordNumber) + ";" + str(records[i].EventType) + ";" + str(records[i].EventCategory) + ";" + records[i].ComputerName
fi.append(row[i].split(';'))
df = pd.DataFrame(fi)
df.to_csv('Application_Log.csv',header=None,index=False)
print("\n System Logs ")
system()
print("\n Security Logs ")
security()
print("\n Application Logs ")
application()