Parse Windows Event XML

Parses raw Windows Event Log XML into a structured, name-keyed map.

Included Processors

Convert XML Attributes To Elements

Converts XML attributes to elements so attribute values survive simplified parsing.

Insert XML Placeholder For Empty Elements

Inserts a placeholder value into empty Data elements so they survive parsing.

Convert XML Text To Elements

Converts XML text content to dedicated child elements ahead of parsing.

Parse Simplified XML

Parses the normalized XML string into a structured map.

Convert EventData To Map

Reshapes the EventData Data array into a name-keyed map.

Example Telemetry

Log

Name	Before	After
observed_time	2026-06-09T11:14:08Z	2026-06-09T11:14:08Z
time	2026-06-09T11:14:08Z	2026-06-09T11:14:08Z
severity_text	INFO	INFO
severity_number	9	9

Body

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}"/><EventID>4624</EventID><Version>2</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2026-06-09T11:14:08.589536192Z"/><EventRecordID>4</EventRecordID><Channel>Security</Channel><Computer>BLITZ-WEL</Computer></System><EventData><Data Name="SubjectUserSid">S-1-5-18</Data><Data Name="SubjectUserName">BLITZ-WEL$</Data><Data Name="SubjectDomainName">WORKGROUP</Data><Data Name="TargetUserSid">S-1-5-21-0-0-9624</Data><Data Name="TargetUserName">mjohnson</Data><Data Name="TargetDomainName">WORKGROUP</Data><Data Name="LogonType">2</Data><Data Name="IpAddress">10.221.118.25</Data><Data Name="ProcessName">C:\Windows\System32\svchost.exe</Data></EventData><RenderingInfo><Message>An account was successfully logged on.</Message><Level>Information</Level><Task>Logon</Task><Opcode>Info</Opcode><Keywords><Keyword>Audit Success</Keyword></Keywords></RenderingInfo></Event>

Event["EventData"]["IpAddress"]	10.221.118.25
Event["EventData"]["LogonType"]	2
Event["EventData"]["ProcessName"]	C:\Windows\System32\svchost.exe
Event["EventData"]["SubjectDomainName"]	WORKGROUP
Event["EventData"]["SubjectUserName"]	BLITZ-WEL$
Event["EventData"]["SubjectUserSid"]	S-1-5-18
Event["EventData"]["TargetDomainName"]	WORKGROUP
Event["EventData"]["TargetUserName"]	mjohnson
Event["EventData"]["TargetUserSid"]	S-1-5-21-0-0-9624
Event["RenderingInfo"]["Keywords"]["Keyword"]	Audit Success
Event["RenderingInfo"]["Level"]	Information
Event["RenderingInfo"]["Message"]	An account was successfully logged on.
Event["RenderingInfo"]["Opcode"]	Info
Event["RenderingInfo"]["Task"]	Logon
Event["System"]["Channel"]	Security
Event["System"]["Computer"]	BLITZ-WEL
Event["System"]["EventID"]	4624
Event["System"]["EventRecordID"]	4
Event["System"]["Keywords"]	0x8020000000000000
Event["System"]["Level"]	0
Event["System"]["Opcode"]	0
Event["System"]["Provider"]["Guid"]	{54849625-5478-4994-a5ba-3e3b0328c30d}
Event["System"]["Provider"]["Name"]	Microsoft-Windows-Security-Auditing
Event["System"]["Task"]	12544
Event["System"]["TimeCreated"]["SystemTime"]	2026-06-09T11:14:08.589536192Z
Event["System"]["Version"]	2
Event["xmlns"]	http://schemas.microsoft.com/win/2004/08/events/event

Resource

Name	Before	After
host.name	BLITZ-WEL	BLITZ-WEL
os.type	windows	windows

Related Blueprints