(string_list, string_parsed)
return attributes
Parse logon events and return a count of event processed.

    Args:
        string_list: a list of strings extracted from the Event Log.
        string_parsed: a dict with strings extracted from the Event log.

    Returns:
        Dict with attributes parsed out of the logon events.
Parse logon events and return a count of event processed.
Parse logon events and return a count of event processed .
def parse_evtx_logon_event(string_list, string_parsed):
    """Parse logon events and return a count of event processed.

    Args:
        string_list: a list of strings extracted from the Event Log.
        string_parsed: a dict with strings extracted from the Event log.

    Returns:
        Dict with attributes parsed out of the logon events.
    """
    if len(string_list) < 20:
        return {}

    if not string_parsed:
        string_parsed = {}
        string_parsed['target_user_id'] = string_list[4]
        string_parsed['target_user_name'] = string_list[5]
        string_parsed['hostname'] = string_list[11]
        string_parsed['source_user_name'] = string_list[1]

    attributes = {}
    logon_type_code = string_list[8]
    attributes['logon_type'] = LOGON_TYPES.get(
        logon_type_code, LOGON_TYPES.get('0'))

    win_domain = string_list[2]
    if win_domain:
        attributes['windows_domain'] = win_domain

    username = string_parsed.get('target_user_name')
    if username:
        attributes['username'] = username

    user_id = string_parsed.get('target_user_id')
    if user_id:
        attributes['user_id'] = user_id

    logon_process_name = string_list[9]
    if logon_process_name:
        attributes['logon_process'] = logon_process_name

    workstation_name = string_list[11]
    if workstation_name == '-':
        attributes['workstation'] = 'localhost'
    elif workstation_name:
        attributes['workstation'] = workstation_name

    ip_address = string_list[18]
    if ip_address and ip_address != '-':
        attributes['source_address'] = ip_address

    hostname = string_parsed.get('target_machine_name', 'N/A')
    if hostname:
        attributes['hostname'] = hostname

    session_id = string_list[3]
    if session_id:
        attributes['session_id'] = session_id

    source_username = string_parsed.get('source_user_name')
    if source_username:
        attributes['source_username'] = source_username

    return attributes
def parse_evtx_logon_event ( string_list , string_parsed ) : if len ( string_list ) < 20 : return { } if not string_parsed : string_parsed = { } string_parsed [ 'target_user_id' ] = string_list [ 4 ] string_parsed [ 'target_user_name' ] = string_list [ 5 ] string_parsed [ 'hostname' ] = string_list [ 11 ] string_parsed [ 'source_user_name' ] = string_list [ 1 ] attributes = { } logon_type_code = string_list [ 8 ] attributes [ 'logon_type' ] = LOGON_TYPES . get ( logon_type_code , LOGON_TYPES . get ( '0' ) ) win_domain = string_list [ 2 ] if win_domain : attributes [ 'windows_domain' ] = win_domain username = string_parsed . get ( 'target_user_name' ) if username : attributes [ 'username' ] = username user_id = string_parsed . get ( 'target_user_id' ) if user_id : attributes [ 'user_id' ] = user_id logon_process_name = string_list [ 9 ] if logon_process_name : attributes [ 'logon_process' ] = logon_process_name workstation_name = string_list [ 11 ] if workstation_name == '-' : attributes [ 'workstation' ] = 'localhost' elif workstation_name : attributes [ 'workstation' ] = workstation_name ip_address = string_list [ 18 ] if ip_address and ip_address != '-' : attributes [ 'source_address' ] = ip_address hostname = string_parsed . get ( 'target_machine_name' , 'N/A' ) if hostname : attributes [ 'hostname' ] = hostname session_id = string_list [ 3 ] if session_id : attributes [ 'session_id' ] = session_id source_username = string_parsed . get ( 'source_user_name' ) if source_username : attributes [ 'source_username' ] = source_username return attributes