{"repo":"eronnen/procmon-parser","free":true,"listed":false,"github":"https://github.com/eronnen/procmon-parser","clone":"git clone https://github.com/eronnen/procmon-parser.git","description":"Parser to process monitor file formats","language":"Python","stars":166,"topics":["windows","python","procmon","monitoring","monitoring-tool","process-monitor"],"license":"MIT","category":"analytics","readme_excerpt":"Parsing Procmon files with Python Procmon (https://docs.microsoft.com/en-us/sysinternals/downloads/procmon) is a very powerful monitoring tool for Windows, capable of capturing file system, registry, process/thread and network activity. Procmon uses internal file formats for configuration ( PMC ) and logs ( PML ). Prior to procmon-parser , PMC files could only be parsed and generated by the Procmon GUI, and PML files could be read only using the Procmon GUI, or by converting them to CSV or XML using Procmon command line. The goals of procmon-parser are: Parsing & Building PMC files - making it possible to dynamically add/remove filter rules, which can significantly reduce the size of the log file over time as Procmon captures millions of events. Parsing PML files - making it possible to directly load the raw PML file into convenient python objects instead of having to convert the file to CSV/XML formats prior to loading. PMC (Process Monitor Configuration) Parser Usage Loading configuration of a pre-exported Procmon configuration: Adding some new rules Dropping filtered events Dumping the new configuration to a file File Format For the raw binary format of PMC files you can refer to the docs, or take a look at the source code in configuration format.py. PML (Process Monitor Log) Parser Usage procmon-parser exports a ProcmonLogsReader class for reading logs directly from a PML file: File Format For the raw binary format of PML files you can refer to the docs, or take a look at","default_branch":null,"files":null,"tree":[],"storefront":"/r/eronnen","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/eronnen/procmon-parser/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}