# EVTX integration fixture provenance

The binary fixture is intentionally not copied into this text-managed repository.

CI downloads `samples/Security_short_selected.evtx` from the upstream `omerbenamram/evtx` release tag `v0.12.2` and exposes it through `EVENTLENS_EVTX_FIXTURE`.

Expected contract:

- EVTX `ElfFile\0` header;
- 7 records;
- event IDs `5152, 4611, 4776, 4625, 5152, 5157, 4673`;
- provider `Microsoft-Windows-Security-Auditing`;
- channel `Security`.

The upstream EVTX project is dual-licensed MIT / Apache-2.0 and distributes this file as test data. The release tag `v0.12.2` corresponds to release commit `99a6def` (June 13, 2026). Keeping the fetch pinned to that release makes the integration contract reproducible while avoiding a binary-only write path in this repository.