EventLens-Public/backend/tests/fixtures/README.md

EVTX integration fixture provenance

The binary fixture is intentionally not copied into this text-managed repository.

CI downloads samples/Security_short_selected.evtx from the upstream omerbenamram/evtx release tag v0.12.2 and exposes it through EVENTLENS_EVTX_FIXTURE.

Expected contract:

• EVTX ElfFile\0 header;
• 7 records;
• event IDs 5152, 4611, 4776, 4625, 5152, 5157, 4673;
• provider Microsoft-Windows-Security-Auditing;
• channel Security.

The upstream EVTX project is dual-licensed MIT / Apache-2.0 and distributes this file as test data. The release tag v0.12.2 corresponds to release commit 99a6def (June 13, 2026). Keeping the fetch pinned to that release makes the integration contract reproducible while avoiding a binary-only write path in this repository.