(string_list)
return attributes
Parse logoff events and return a dict with attributes.

    Args:
        string_list: a list of strings extracted from the Event Log.

    Returns:
        Dict with attributes parsed out of the logoff events.
Parse logoff events and return a dict with attributes.
Parse logoff events and return a dict with attributes .
def parse_evtx_logoff_event(string_list):
    """Parse logoff events and return a dict with attributes.

    Args:
        string_list: a list of strings extracted from the Event Log.

    Returns:
        Dict with attributes parsed out of the logoff events.
    """
    if not len(string_list) == 5:
        return {}

    attributes = {}
    attributes['username'] = string_list[1]
    attributes['logon_domain'] = string_list[2]
    attributes['session_id'] = string_list[3]

    logon_type_code = string_list[4]
    attributes['logon_type'] = LOGON_TYPES.get(
        logon_type_code, LOGON_TYPES.get('0'))

    return attributes
def parse_evtx_logoff_event ( string_list ) : if not len ( string_list ) == 5 : return { } attributes = { } attributes [ 'username' ] = string_list [ 1 ] attributes [ 'logon_domain' ] = string_list [ 2 ] attributes [ 'session_id' ] = string_list [ 3 ] logon_type_code = string_list [ 4 ] attributes [ 'logon_type' ] = LOGON_TYPES . get ( logon_type_code , LOGON_TYPES . get ( '0' ) ) return attributes