Post cover image

July 28, 2026

Basic Sysmon Parser project using Claude

Python command-line tool that reads Windows/Sysmon XML logs, extracts important security fields, and outputs clean JSON for threat…

By The Commoness

3 min read

Python command-line tool that reads Windows/Sysmon XML logs, extracts important security fields, and outputs clean JSON for threat detection and analysis.

Step 1 —Always Create and enter the project folder

In Git Bash, run:

mkdir sysmon-xml-parser && cd sysmon-xml-parser
claude

When the safety check appears, select:
1. Yes, I trust this folder
None

Ask Claude to create the project files

Paste this into Claude:

Create these empty files in the current project folder:
1. parser.py
2. sample_event.xml
3. README.md
4. requirements.txt
Do not add any code yet.
None 
Rename parser.y to parser.py

Add sample Sysmon XML

Paste this into Claude:

Add a valid Sysmon Event ID 1 process-creation XML example into sample_event.xml.
Include these fields:
- EventID
- TimeCreated
- Computer
- ProcessGuid
- ProcessId
- Image
- CommandLine
- CurrentDirectory
- User
- LogonGuid
- LogonId
- TerminalSessionId
- IntegrityLevel
- Hashes
- ParentProcessGuid
- ParentProcessId
- ParentImage
- ParentCommandLine
- ParentUser
Use whoami.exe as the executed process and cmd.exe as the parent process.
Do not modify any other file.

It creates a fake Sysmon log showing whoami.exe launched by cmd.exe, so we can test whether our parser correctly extracts the important security fields.

None

Build the parser

Paste this into Claude:

Write parser.py to read sample_event.xml and extract these fields:
EventID
TimeCreated
Computer
Image
CommandLine
ParentImage
User
IntegrityLevel
Print the extracted information as formatted JSON.
Use only Python built-in libraries and add clear comments.
Do not modify any other file.

previously we created the sample XML log; now we are creating parser.py, which will read that log and extract the important fields into JSON.

None

Make the parser accept any XML file

Paste this into Claude:

Update parser.py so the XML filename is provided through the command line instead of being fixed as sample_event.xml.
Example:
py parser.py sample_event.xml
Keep the same JSON output and add a clear error message if the file do

Support multiple Sysmon events

Paste this into Claude:

Update parser.py so it can parse both:

1. A single <Event> XML
2. Multiple <Event> entries inside an <Events> root

For multiple events, output a JSON list containing one object per event.

Keep support for:
py parser.py sample_event.xml

Do not modify other files. Test the single-event case after updating.
None

Create the README

Paste this into Claude:

Update README.md with:
- Project name
- What the project does
- Why Sysmon XML parsing is useful
- Fields extracted
- Project files
- How to run:
  py parser.py sample_event.xml
  py parser.py multiple_events.xml
- Example JSON output
- Error handling
- Python requirements
Do not modify any other file.

Run the final project test

Paste this into Claude:

Run these commands and show whether both succeed:
py parser.py sample_event.xml
py parser.py multiple_events.xml
Then show the complete project file list. Do not modify any files.
None

Create .gitignore

Paste into Claude:

Create a .gitignore file containing:

__pycache__/
*.pyc
.venv/
.vscode/

Initialize Git

Paste this into Claude:

Initialize a Git repository in the current project folder using git init,

Add all project files to Git

Paste this into Claude and then commit to github

Run:
git add .
Then run:
git status

Also I am advancing this project a step higher by adding this below features so you can check it and advance further if needed Support for more Sysmon Event IDs such as network connections, file creation, registry changes, and DNS queries. Detection rules that flag suspicious commands like PowerShell download commands or encoded scripts. Output options for JSON, JSONL, and CSV files. Filters for user, process name, Event ID, computer, or time range. A summary showing total events, top processes, users, and suspicious activity. Automated tests using different valid, missing-field, and broken XML samples. Command-line options such as: py parser.py events.xml — event-id 1 — output results.json GitHub Actions to automatically test the parser whenever code is uploaded

Also you can connect me on Linkedin :https://www.linkedin.com/in/roshini-m-lakshmana-b51ab3243/