xpath parsing error
See original GitHub issueAuthor: Hyun Yi @hyuunnn
Description: A program was installed.
EventId: 1033
Channel: "Application"
Provider: "MsiInstaller"
Maps:
-
Property: PayloadData1
PropertyValue: "Name: %Name%"
Values:
-
Name: Name
Value: "/Event/EventData/Data[1]"
-
Property: PayloadData2
PropertyValue: "Version: %Version%"
Values:
-
Name: Version
Value: "/Event/EventData/Data[2]"
-
Property: PayloadData3
PropertyValue: "Lang: %Lang%"
Values:
-
Name: Lang
Value: "/Event/EventData/Data[3]"
-
Property: PayloadData4
PropertyValue: "Status: %Status%"
Values:
-
Name: Status
Value: "/Event/EventData/Data[4]"
-
Property: PayloadData5
PropertyValue: "Manufacturer: %Manufacturer%"
Values:
-
Name: Manufacturer
Value: "/Event/EventData/Data[5]"
# Valid properties include:
# <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
# <System>
# <Provider Name="MsiInstaller" />
# <EventID Qualifiers="0">1033</EventID>
# <Version>0</Version>
# <Level>4</Level>
# <Task>0</Task>
# <Opcode>0</Opcode>
# <Keywords>0x80000000000000</Keywords>
# <TimeCreated SystemTime="2020-11-29T19:30:51.7375522Z" />
# <EventRecordID>18388</EventRecordID>
# <Correlation />
# <Execution ProcessID="0" ThreadID="0" />
# <Channel>Application</Channel>
# <Computer>ComputerName</Computer>
# <Security UserID="{UserID}" />
# </System>
# <EventData>
# <Data>Python 3.9.0 Utility Scripts (64-bit)</Data>
# <Data>3.9.150.0</Data>
# <Data>1033</Data>
# <Data>0</Data>
# <Data>Python Software Foundation</Data>
# <Data>(NULL)</Data>
# <Data />
# <Binary>{Binary}</Binary>
# </EventData>
# </Event>
This is my map file.
but all data were saved in PayloadData1.
Issue Analytics
- State:
- Created 3 years ago
- Comments:9 (9 by maintainers)
Top Results From Across the Web
Error with XPath in a parsed XML document ...
I'm creating a Firefox for Android extension and I have a problem with a XML document retrieved from a XMLHttpRequest : I can't...
Read more >Error parsing legal xpath · Issue #104 · goto100/xpath
It seems like adding a constraint to the parent selector causes a parsing error. This xpath does not throw and error: //text()[parent::*[true()]] ...
Read more >"Unable to parse the if-then expression" with error "javax. ...
Cause. The reason for this error message is that the variable will hold an empty string and when performing the if-condition, the XPATH...
Read more >google sheets - Formula Parse Error - unable to work out why
I assumed that I could just copy the XPath and add it to my URL, but it doesn't appear to be working. Any...
Read more >Trying to parse xml with xpath - Power Platform Community
Solved: Hi, I'm fairly new to flow and I'm trying to parse the value ... language function 'xpath' failed to parse the provided...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
There is not a single example of data in that evtx file that has more than 1 data element.
There is nothing wrong with the map you are using. its telling you the elements you are trying to reference are not there, and its 100% correct.
do this EvtxECmd.exe -f C:\Temp\A2.evtx --xml .
then look at the XML.
it cannot find elements in the xml that arent there.
there is nothing else i can do here, so closing for now. if you do find an issue, please comment again
here is the data, regexed out to just show the eventdata stuff
oh… Thank you so much 👍