feat: improve parsing in etw receiver

[schmikei]

Proposed Change

Before the ETW receiver was not capturing "all" information it could from events. There is extended data that can be utilized to capture more from the events and we can use TDH to get more user friendly values on our implementation. For example SID's can be configured to be sent with the event record in the callback.

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Kernel-File" Guid="{{EDD08927-9CC4-4E65-B970-C2560FB5C289}}"/>
    <EventID>12</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>Create</Task>
    <Opcode>Info </Opcode>
    <Keywords>0x80000000000000a0</Keywords>
    <TimeCreated SystemTime="2025-04-30T18:29:44.0253791Z"/>
    <Correlation />
    <Execution ProcessID="3456" ThreadID="2736"/>
    <Channel>Microsoft-Windows-Kernel-File/Analytic</Channel>
    <Computer>instance-20250429-204003</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="CreateAttributes">0x0</Data>
    <Data Name="ShareAccess">0x7</Data>
    <Data Name="FileName">\Device\HarddiskVolume3\Windows\System32\drivers\fileinfo.sys</Data>
    <Data Name="Irp">0xFFFFAD8FC3AC7BF8</Data>
    <Data Name="FileObject">0xFFFFAD8FC310F7B0</Data>
    <Data Name="IssuingThreadId">2736</Data>
    <Data Name="CreateOptions">0x1214040</Data>
  </EventData>
</Event>

{
  "resourceLogs": [
    {
      "resource": {
        "attributes": [
          { "key": "session", "value": { "stringValue": "OtelCollectorETW" } },
          {
            "key": "provider",
            "value": { "stringValue": "Microsoft-Windows-Kernel-File" }
          },
          {
            "key": "provider_guid",
            "value": { "stringValue": "{EDD08927-9CC4-4E65-B970-C2560FB5C289}" }
          },
          {
            "key": "computer",
            "value": { "stringValue": "instance-20250429-204003" }
          },
          {
            "key": "channel",
            "value": { "stringValue": "Microsoft-Windows-Kernel-File/Analytic" }
          }
        ]
      },
      "scopeLogs": [
        {
          "scope": {},
          "logRecords": [
            {
              "timeUnixNano": "1746037628164695300",
              "observedTimeUnixNano": "1746037629178119600",
              "severityNumber": 9,
              "body": {
                "kvlistValue": {
                  "values": [
                    { "key": "opcode", "value": { "stringValue": "Info " } },
                    { "key": "thread_id", "value": { "stringValue": "4700" } },
                    { "key": "task", "value": { "stringValue": "Create" } },
                    {
                      "key": "provider",
                      "value": {
                        "kvlistValue": {
                          "values": [
                            {
                              "key": "name",
                              "value": {
                                "stringValue": "Microsoft-Windows-Kernel-File"
                              }
                            },
                            {
                              "key": "guid",
                              "value": {
                                "stringValue": "{EDD08927-9CC4-4E65-B970-C2560FB5C289}"
                              }
                            }
                          ]
                        }
                      }
                    },
                    {
                      "key": "event_data",
                      "value": {
                        "kvlistValue": {
                          "values": [
                            {
                              "key": "IssuingThreadId",
                              "value": { "stringValue": "4700" }
                            },
                            {
                              "key": "CreateOptions",
                              "value": { "stringValue": "0x1214040" }
                            },
                            {
                              "key": "CreateAttributes",
                              "value": { "stringValue": "0x0" }
                            },
                            {
                              "key": "ShareAccess",
                              "value": { "stringValue": "0x7" }
                            },
                            {
                              "key": "FileName",
                              "value": {
                                "stringValue": "\\Device\\HarddiskVolume3\\Windows\\System32\\drivers\\fileinfo.sys"
                              }
                            },
                            {
                              "key": "Irp",
                              "value": { "stringValue": "0xFFFFAD8FC2513138" }
                            },
                            {
                              "key": "FileObject",
                              "value": { "stringValue": "0xFFFFAD8FC31153E0" }
                            }
                          ]
                        }
                      }
                    },
                    {
                      "key": "keywords",
                      "value": { "stringValue": "9223372036854775968" }
                    },
                    {
                      "key": "event_id",
                      "value": {
                        "kvlistValue": {
                          "values": [
                            { "key": "id", "value": { "stringValue": "12" } }
                          ]
                        }
                      }
                    },
                    {
                      "key": "security",
                      "value": {
                        "kvlistValue": {
                          "values": [
                            {
                              "key": "sid",
                              "value": { "stringValue": "S-1-5-18" }
                            }
                          ]
                        }
                      }
                    },
                    {
                      "key": "execution",
                      "value": {
                        "kvlistValue": {
                          "values": [
                            {
                              "key": "process_id",
                              "value": { "stringValue": "3456" }
                            },
                            {
                              "key": "thread_id",
                              "value": { "stringValue": "4700" }
                            }
                          ]
                        }
                      }
                    }
                  ]
                }
              },
              "traceId": "",
              "spanId": ""
            }
          ]
        }
      ]
    }
  ]
}

List of fixes:

• Add Security Tags and collects them
• Renders the Channel Name (adds as resource attribute on parsed version)
• Assigns the associated Task & OpCode name with its friendly name
• Parsing stuff now doesn't wrap things in brackets when it does not need to.

Checklist

• Changes are tested
• CI has passed

[dpaasman00]

Working well for me