windows

type Buffer struct {
	// contains filtered or unexported fields
}

type Config struct {
	helper.InputConfig `mapstructure:",squash"`
	Channel            string        `mapstructure:"channel"`
	MaxReads           int           `mapstructure:"max_reads,omitempty"`
	StartAt            string        `mapstructure:"start_at,omitempty"`
	PollInterval       time.Duration `mapstructure:"poll_interval,omitempty"`
	Raw                bool          `mapstructure:"raw,omitempty"`
	ExcludeProviders   []string      `mapstructure:"exclude_providers,omitempty"`
}

type Data struct {
	// https://learn.microsoft.com/en-us/windows/win32/wes/eventschema-datafieldtype-complextype
	Name  string `xml:"Name,attr"`
	Value string `xml:",chardata"`
}

type EventData struct {
	// https://learn.microsoft.com/en-us/windows/win32/wes/eventschema-eventdatatype-complextype
	// ComplexData is not supported.
	Name   string `xml:"Name,attr"`
	Data   []Data `xml:"Data"`
	Binary string `xml:"Binary"`
}

type EventID struct {
	Qualifiers uint16 `xml:"Qualifiers,attr"`
	ID         uint32 `xml:",chardata"`
}

type EventRaw struct {
	TimeCreated   TimeCreated `xml:"System>TimeCreated"`
	RenderedLevel string      `xml:"RenderingInfo>Level"`
	Level         string      `xml:"System>Level"`
	Body          string      `xml:"-"`
}

type EventXML struct {
	EventID          EventID     `xml:"System>EventID"`
	Provider         Provider    `xml:"System>Provider"`
	Computer         string      `xml:"System>Computer"`
	Channel          string      `xml:"System>Channel"`
	RecordID         uint64      `xml:"System>EventRecordID"`
	TimeCreated      TimeCreated `xml:"System>TimeCreated"`
	Message          string      `xml:"RenderingInfo>Message"`
	RenderedLevel    string      `xml:"RenderingInfo>Level"`
	Level            string      `xml:"System>Level"`
	RenderedTask     string      `xml:"RenderingInfo>Task"`
	Task             string      `xml:"System>Task"`
	RenderedOpcode   string      `xml:"RenderingInfo>Opcode"`
	Opcode           string      `xml:"System>Opcode"`
	RenderedKeywords []string    `xml:"RenderingInfo>Keywords>Keyword"`
	Keywords         []string    `xml:"System>Keywords"`
	Security         *Security   `xml:"System>Security"`
	Execution        *Execution  `xml:"System>Execution"`
	EventData        EventData   `xml:"EventData"`
}

type Execution struct {
	// ProcessID and ThreadID are required on execution info
	ProcessID uint `xml:"ProcessID,attr"`
	ThreadID  uint `xml:"ThreadID,attr"`
	// These remaining fields are all optional for execution info
	ProcessorID   *uint `xml:"ProcessorID,attr"`
	SessionID     *uint `xml:"SessionID,attr"`
	KernelTime    *uint `xml:"KernelTime,attr"`
	UserTime      *uint `xml:"UserTime,attr"`
	ProcessorTime *uint `xml:"ProcessorTime,attr"`
}

type Provider struct {
	Name            string `xml:"Name,attr"`
	GUID            string `xml:"Guid,attr"`
	EventSourceName string `xml:"EventSourceName,attr"`
}

type Security struct {
	UserID string `xml:"UserID,attr"`
}

type TimeCreated struct {
	SystemTime string `xml:"SystemTime,attr"`
}