Convert evtx to json

evtx_to_json.py

#!/usr/bin/env python
# Convert evtx to json
import Evtx.Evtx as evtx
import sys
import json


def recursive_dict(element):
    # https://stackoverflow.com/questions/42925074/python-lxml-etree-element-to-json-or-dict
    t = element.tag
    if t.index('}') > 0:
        t = t[t.index('}') + 1:]
    return t, \
        dict(map(recursive_dict, element)) or element.text

for f in sys.argv:
    with evtx.Evtx(f) as log:
        for record in log.records():
            print json.dumps(recursive_dict(record.lxml()))