2026.10.0

evtx 2026.10.0 / EvtxECmd 2026.10.0

• New BinXml parser written to MS-EVEN6. Forwarded events (Windows Event Forwarding) are read (#15). Record counts match the Rust evtx parser over 1,039 test logs: about 331,000 more records than before (1,283,606 -> 1,614,510).
• New RenderingInfo column (last CSV column) and EventRecord.RenderingInfo: the message and level/task/opcode/keyword names from forwarded events (from #262, thanks @randomaccess3).
• &, < and > are no longer double escaped in Payload and the map columns. Left-to-right marks are kept instead of becoming ", ".
• Character and entity references, CDATA and processing instructions (#208). Fixes for Real64 arrays, size_t, SIDs and invalid timestamps.
• Damaged records and chunks are reported and skipped. ErrorRecords is keyed by record number.
• Fix the duplicate map key crash (#241). New OpenSSH/Admin 1 and 2 maps (#253).
• About 2x faster overall (large logs 2.4-4x), and maps load in parallel.
• EventRecord.PayloadAsJson()/EventAsJson(). Tests, CI, and trusted publishing to NuGet.

What's Changed

• Update 1 and add 2 MSSQLSERVER Maps by @AndrewRathbun in #245
• Update Microsoft-Windows-Storage-Storport-Operational_Microsoft-Windo… by @AndrewRathbun in #247
• New Cisco AnyConnect VPN log by @esecrpm in #249
• Remove ephemeral port from RemoteHost to simplify grouping by initiating system by @scriptedstatement in #248
• Update Varonis_VrnsCifsQueueReport_5120.map - fix spelling error by @AndrewRathbun in #250
• Create Microsoft-Windows-Win32k-Operational_Microsoft-Windows-Win32k_… by @AndrewRathbun in #251
• Add Issue Template for New EvtxECmd Map Requests by @AndrewRathbun in #254
• Update NewMapRequest.yml based on feedback by @AndrewRathbun in #256
• Create Maps for Microsoft-Windows-WinRM/Operational/Microsoft-Windows-WinRM:6/91 by @AndrewRathbun in #257
• Map for Defender ASR audit by @stark4n6 in #258
• Noticed Missing EID 9,4 & 10 for Microsoft-Windows-Ntfs by @vikas891 in #259
• Fix minor description typo --met and set dedupe to true by @reece394 in #260
• add map skill by @randomaccess3 in #261

New Contributors

• @scriptedstatement made their first contribution in #248
• @stark4n6 made their first contribution in #258
• @vikas891 made their first contribution in #259

Full Changelog: 1.5.2...2026.10.0