Windows Events appear with escaping xml characters

#1 RAZR 4 years ago

Hello for, windows events proceed in JSON but some fields like "CommandLine", "TaskContent", "EventData" e.t.c arrives with XML escaping character, like < is < > is > & is & " is "

Is it possible to disable escaping globally? Or the only option to solve the problem is using unescape_xml function for every field like:

$CommandLine = unescape_xml($CommandLine); $TaskContent = unescape_xml($TaskContent);

Permalink

#2 MisazivDeactivated Nxlog ✓ 3 years ago

#1 RAZR

Hello for, windows events proceed in JSON but some fields like "CommandLine", "TaskContent", "EventData" e.t.c arrives with XML escaping character, like < is < > is > & is & " is " Is it possible to disable escaping globally? Or the only option to solve the problem is using unescape_xml function for every field like: $CommandLine = unescape_xml($CommandLine); $TaskContent = unescape_xml($TaskContent);

Hi,

Could you please paste your config here, it will help with answering your question.

~MisaZ