"Description" column placeholders are not being replaced with relevant data in Excel output files. about evtxhussar HOT 2 CLOSED

The Description column is no further processed. This is just copy from yaml definition.

In definition for event 7040 there is:

and by design it's only copied without further processing - providing only generic message. I don't consider this a bug.

My mistake here is that I put those X, A to B so it may be confusing, I will remove all "placeholders" from next version.

The message you are looking for e.g. like: The start type of the %1 service was changed from %2 to %3
with substituted fields like %1 => Windows Update

are related to more complex topic which requires:

• asking Windows to perform this via API or
• keep extracted data from all Windows version since 7, 2008 with event messages templates included within program
• proper application of templates like: in this place should be put int or hex?
• support for different Versions of events e.g. 4624 had 3 different versions = 0,1,2

Example of messages database (SQLite format) : https://github.com/Velocidex/evtx-data/blob/master/welm/welm_combined.db

from evtxhussar.

Initial changes in commit: d19f4d5

from evtxhussar.