16 lines
801 B
Markdown
16 lines
801 B
Markdown
# EVTX integration fixture provenance
|
|
|
|
The binary fixture is intentionally not copied into this text-managed repository.
|
|
|
|
CI downloads `samples/Security_short_selected.evtx` from the upstream `omerbenamram/evtx` release tag `v0.12.2` and exposes it through `EVENTLENS_EVTX_FIXTURE`.
|
|
|
|
Expected contract:
|
|
|
|
- EVTX `ElfFile\0` header;
|
|
- 7 records;
|
|
- event IDs `5152, 4611, 4776, 4625, 5152, 5157, 4673`;
|
|
- provider `Microsoft-Windows-Security-Auditing`;
|
|
- channel `Security`.
|
|
|
|
The upstream EVTX project is dual-licensed MIT / Apache-2.0 and distributes this file as test data. The release tag `v0.12.2` corresponds to release commit `99a6def` (June 13, 2026). Keeping the fetch pinned to that release makes the integration contract reproducible while avoiding a binary-only write path in this repository.
|