EventLogConverter

1.0.3

EventLogConverter.psm1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
 [CmdletBinding()]
Param()
Function ConvertTo-EvtObject  {
    [CmdletBinding()]
    Param (
    [parameter(ValueFromPipelineByPropertyName,ValueFromPipeline,Mandatory=$true)]
    [Object[]]$InputObject
    )
    Process {
        [System.Collections.ArrayList]$Objects = @()
        $InputObject | ForEach-Object { 
            $xdoc =  [xml]$_.ToXML()
            $obj = New-Object PSObject
            #create NoteProperty for each System node - check for attributes and create
            #a new property using a <node><attribute> syntax
            $xdoc.Event.System.ChildNodes | ForEach-Object {
                if ($_.HasAttributes) {
                    $parentName  = $_.LocalName
                    $_.Attributes | ForEach-Object {
                        $obj | Add-Member -MemberType NoteProperty -Name "$($parentName)$($_.Name)" -Value $_.'#text'
                    }
                }
                if ($_.'#text') {
                    #add the Text node if present
                    $obj | Add-Member -MemberType NoteProperty -Name $_.LocalName -Value $_.InnerText 
                }
            }
            #check for named EventData node(s)
            $xdoc.Event.EventData  | ForEach-Object {
                if ($_.Name -ne $_.LocalName) {
                    $PropertyName = "EventDataName"
                    $PropertyValue = $_.Name
                    $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue
                }
            }
            #create NoteProperty for each EventData.Data node
            $DataCounter = 0
            if ($xdoc.Event.EventData) {        
                $xdoc.Event.EventData.Data | ForEach-Object {
                    if ($_.Name) {
                        $PropertyName = $_.Name
                        if ($obj.$PropertyName) {
                            $PropertyName = "$($_.Name)01"
                        }
                        $PropertyValue = $_.innerText
                    }
                    else {
                        #for unnamed Data nodes, use a numeric counter
                        $PropertyName = "Data$($DataCounter.toString('00'))"
                        $PropertyValue =  $_.toString()
                        $DataCounter += 1
                    }
                    $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue
                }
            }
            #if there is a Userdata node, try to handle that
            if ($xdoc.Event.UserData) {        
                $xdoc.Event.UserData | ForEach-Object { 
                    $PropertyName = 'UserData'
                    if ($_.ChildNodes) {
                        $ParentName =  $_.LocalName
                        $_.ChildNodes | ForEach-Object {
                            $PropertyName = "$ParentName$($_.localName)"
                            if ($_.ChildNodes) {
                                $ParentName = $_.LocalName
                                $_.ChildNodes | ForEach-Object {
                                    $PropertyName = "$ParentName$($_.localName)"
                                    $PropertyValue = $_.InnerXML
                                    $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue 
                                }   
                            } else {
                                $PropertyValue = $_.InnerXML
                                $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue 
                            }
                        }
                    } 
                    else {
                        $PropertyValue = $_.InnerXML
                        $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue 
                    }
                }
            }
            #if there is a Binary node, try to handle that
            if ($xdoc.Event.EventData.Binary) { 
                $PropertyName = "Binary"
                $PropertyValue =  $xdoc.Event.EventData.Binary.toString()
                $obj | Add-Member -MemberType NoteProperty -Name $PropertyName -Value $PropertyValue
            }
            [Void]$Objects.Add($obj)
        }
        $Objects
    }
}