EventLogConverter

1.0.3

EventLogConverter.psm1

[CmdletBinding()]
Param()
Function ConvertTo-EvtObject  {
    [CmdletBinding()]
    Param (
    [parameter(ValueFromPipelineByPropertyName,ValueFromPipeline,Mandatory=$true)]
    [Object[]]$InputObject
    )
    Process {
        [System.Collections.ArrayList]$Objects = @()
        $InputObject | ForEach-Object { 
            $xdoc =  [xml]$_.ToXML()
            $obj = New-Object PSObject
            #create NoteProperty for each System node - check for attributes and create
            #a new property using a <node><attribute> syntax
            $xdoc.Event.System.ChildNodes | ForEach-Object {
                if ($_.HasAttributes) {
                    $parentName  = $_.LocalName
                    $_.Attributes | ForEach-Object {
                        $obj | Add-Member -MemberType NoteProperty -Name "$($parentName)$($_.Name)" -Value $_.'#text'
                    }
                }
                if ($_.'#text') {
                    #add the Text node if present
                    $obj | Add-Member -MemberType NoteProperty -Name $_.LocalName -Value $_.InnerText 
                }
            }
            #check for named EventData node(s)
            $xdoc.Event.EventData  | ForEach-Object {
                if ($_.Name -ne $_.LocalName) {
                    $PropertyName = "EventDataName"
                    $PropertyValue = $_.Name
                    $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue
                }
            }
            #create NoteProperty for each EventData.Data node
            $DataCounter = 0
            if ($xdoc.Event.EventData) {        
                $xdoc.Event.EventData.Data | ForEach-Object {
                    if ($_.Name) {
                        $PropertyName = $_.Name
                        if ($obj.$PropertyName) {
                            $PropertyName = "$($_.Name)01"
                        }
                        $PropertyValue = $_.innerText
                    }
                    else {
                        #for unnamed Data nodes, use a numeric counter
                        $PropertyName = "Data$($DataCounter.toString('00'))"
                        $PropertyValue =  $_.toString()
                        $DataCounter += 1
                    }
                    $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue
                }
            }
            #if there is a Userdata node, try to handle that
            if ($xdoc.Event.UserData) {        
                $xdoc.Event.UserData | ForEach-Object { 
                    $PropertyName = 'UserData'
                    if ($_.ChildNodes) {
                        $ParentName =  $_.LocalName
                        $_.ChildNodes | ForEach-Object {
                            $PropertyName = "$ParentName$($_.localName)"
                            if ($_.ChildNodes) {
                                $ParentName = $_.LocalName
                                $_.ChildNodes | ForEach-Object {
                                    $PropertyName = "$ParentName$($_.localName)"
                                    $PropertyValue = $_.InnerXML
                                    $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue 
                                }   
                            } else {
                                $PropertyValue = $_.InnerXML
                                $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue 
                            }
                        }
                    } 
                    else {
                        $PropertyValue = $_.InnerXML
                        $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue 
                    }
                }
            }
            #if there is a Binary node, try to handle that
            if ($xdoc.Event.EventData.Binary) { 
                $PropertyName = "Binary"
                $PropertyValue =  $xdoc.Event.EventData.Binary.toString()
                $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue
            }
            [Void]$Objects.Add($obj)
        }
        $Objects
    }
}