Initial curated EventLens source from 0d80d3b38dfb817285481665b9e71e4b8a0656a0
This commit is contained in:
commit
663ea8c829
85 files changed
+12395
No files matched your search
Vendored
+15
@@ -0,0 +1,15 @@
|
||||
# EVTX integration fixture provenance
|
||||
|
||||
The binary fixture is intentionally not copied into this text-managed repository.
|
||||
|
||||
CI downloads `samples/Security_short_selected.evtx` from the upstream `omerbenamram/evtx` release tag `v0.12.2` and exposes it through `EVENTLENS_EVTX_FIXTURE`.
|
||||
|
||||
Expected contract:
|
||||
|
||||
- EVTX `ElfFile\0` header;
|
||||
- 7 records;
|
||||
- event IDs `5152, 4611, 4776, 4625, 5152, 5157, 4673`;
|
||||
- provider `Microsoft-Windows-Security-Auditing`;
|
||||
- channel `Security`.
|
||||
|
||||
The upstream EVTX project is dual-licensed MIT / Apache-2.0 and distributes this file as test data. The release tag `v0.12.2` corresponds to release commit `99a6def` (June 13, 2026). Keeping the fetch pinned to that release makes the integration contract reproducible while avoiding a binary-only write path in this repository.
|
||||
Reference in new issue
Block a user