I have XML based Win Event data that has a number of elements with different name attributes. I'd like to have the name values be fieldnames with the associate data value as the value of the field. Sample event below:
<Event>
<EventData>
<Data Name='SubjectUserSid'>S-1-5-18</Data>
<Data Name='SubjectUserName'>WIN-46NNHCR6B08$</Data>
<Data Name='SubjectDomainName'>WORKGROUP</Data>
<Data Name='SubjectLogonId'>0x3e7</Data>
<Data Name='TargetUserSid'>S-1-5-18</Data>
<Data Name='TargetUserName'>SYSTEM</Data>
<Data Name='TargetDomainName'>NT AUTHORITY</Data>
<Data Name='TargetLogonId'>0x3e7</Data>
<Data Name='LogonType'>5</Data><Data Name='LogonProcessName'>Advapi </Data>
<Data Name='AuthenticationPackageName'>Negotiate</Data>
<Data Name='WorkstationName'></Data>
<Data Name='LogonGuid'>{00000000-0000-0000-0000-000000000000}</Data>
<Data Name='TransmittedServices'>-</Data>
<Data Name='LmPackageName'>-</Data>
<Data Name='KeyLength'>0</Data>
<Data Name='ProcessId'>0x298</Data>
<Data Name='ProcessName'>C:\Windows\System32\services.exe</Data>
<Data Name='IpAddress'>-</Data>
<Data Name='IpPort'>-</Data>
</EventData>
</Event>
For example, I would like SubjectUserSid to be the name of a field and "S-1-5-18" to be the value of that field.
I am using KV_MODE = xml which works great to parse out the fields until I get to this one. Two fields are parsed, Event.EventData.Data and Event.EventData.Data{@Name}. I need to some how combine them to associate the appropriate name/value pair.