[receiver/windowseventlog]: Parse UserData tag

[BinaryFissionGames]

Description:
Parses the UserData tag into a recursive structure like this:

{
  tag: string
  attributes: map[string]string
  charData: string
  children: []AnyXML 
}: AnyXML

Link to tracking Issue: #27810

Testing:
Unit testing.
Manually tested with clearing audit logs (generates an event with UserData filled in)

[pjanotti]

Hi @BinaryFissionGames - this is looking good, I made a suggestion for a change on the type so it matches the event schema correctly.

One question that I have in my mind is that we added the EventData because if the publisher manifest is missing there wasn't any useful information on the log. For events with UserData can you check what happens if the publisher manifest is broken/missing?

The example used in the tests seems made up from events with EventData using the attribute Name. In my Windows 10 box I found the following sources with actual UserData, they will provide a better example:

$ Get-WinEvent Application | Where { $xml = [xml]$_.ToXml(); $xml.event.userdata -ne $null } | Group ProviderName, Id, Level | Select Count, Name

Count Name
----- ----
 1856 Microsoft-Windows-RestartManager, 10000, 4
 1792 Microsoft-Windows-RestartManager, 10001, 4
    3 Microsoft-Windows-RestartManager, 10005, 4
   10 Microsoft-Windows-RestartManager, 10010, 3
    2 Microsoft-Windows-Winsrv, 10002, 4
   12 Microsoft-Windows-WMI, 63, 3

cc @djaglowski

[pjanotti]

I think here we want something like:

Suggested change

	UserData *AnyXML `xml:"UserData"`
	UserData *UserData `xml:"UserData"`

and UserData to be something like:

	Elements	[]AnyXML
	Attributes	map[string]string

This is matches the event schema.

[pjanotti]

The type looks good - I'm not sure about the naming and visibility of the fields.

[github-actions]

This PR was marked stale due to lack of activity. It will be closed in 14 days.

[github-actions]

Closed as inactive. Feel free to reopen if this PR is still being worked on.

[pjanotti]

Hi @BinaryFissionGames - do you think you will have a chance to work on this PR?