[GH-ISSUE #3766] [Feature] Inspect offline Procmon XML/CSV exports as capture Evidence #1462

New issue

Open

opened 2026-10-16 21:05:40 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:05:40 +00:00

Owner

Originally created by @Kizuno18 on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3766

Outcome

Analysts often already have a Process Monitor capture exported by someone else (File → Save → XML or CSV). REA cannot currently turn that recorded export into Evidence. Add a read-only inspect_procmon_export tool (CLI inspect-procmon-export) that parses a caller-supplied Procmon XML or CSV export and projects its events into common capture Evidence.

Scope

Input: one absolute local path to an existing XML or CSV export; format: auto | xml | csv; event paging (event_offset, event_limit, null = all remaining).
Columns: Time of Day, Process Name, PID, Operation, Path, Result (Detail retained when present). Missing columns are reported as explicit unknowns, not empty values.
Preserve source identity: path, SHA-256, byte length, detected format, header/column order.
Bounded, deterministic parsing; malformed and truncated exports fail clearly or report partial coverage, never silently.
Effects: reads the selected file only. No Procmon launch, no driver, no live tracing, no PML decoding, no bundled Procmon binaries. Execution authority: N/A (recorded capture).

Non-goals

Live ETW collection — see #2689 (complementary: live vs offline).
Proprietary PML parsing.
Behavioural interpretation of events.

Acceptance

Spec under docs/specs/.
Hand-built tiny XML/CSV fixtures; tests for malformed, truncated, missing-column and paging cases; CLI and MCP parity through the shared service.

Originally created by @Kizuno18 on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3766 ## Outcome Analysts often already have a Process Monitor capture exported by someone else (File → Save → XML or CSV). REA cannot currently turn that recorded export into Evidence. Add a read-only `inspect_procmon_export` tool (CLI `inspect-procmon-export`) that parses a caller-supplied Procmon **XML or CSV export** and projects its events into common capture Evidence. ## Scope - Input: one absolute local path to an existing XML or CSV export; `format: auto | xml | csv`; event paging (`event_offset`, `event_limit`, `null` = all remaining). - Columns: Time of Day, Process Name, PID, Operation, Path, Result (Detail retained when present). Missing columns are reported as explicit unknowns, not empty values. - Preserve source identity: path, SHA-256, byte length, detected format, header/column order. - Bounded, deterministic parsing; malformed and truncated exports fail clearly or report partial coverage, never silently. - Effects: reads the selected file only. No Procmon launch, no driver, no live tracing, no PML decoding, no bundled Procmon binaries. Execution authority: N/A (recorded capture). ## Non-goals - Live ETW collection — see #2689 (complementary: live vs offline). - Proprietary PML parsing. - Behavioural interpretation of events. ## Acceptance - Spec under `docs/specs/`. - Hand-built tiny XML/CSV fixtures; tests for malformed, truncated, missing-column and paging cases; CLI and MCP parity through the shared service.

bsakaguchi commented

2026-10-16 21:05:42 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 15, 2026):

Good scoping — an offline-only, read-only reader for exports analysts already have fills a real gap without pulling in live tracing or PML decoding, and it complements #2689 nicely (offline vs live). The explicit-unknowns rule for missing columns and the fail-clear/partial-coverage contract for malformed files are the right defaults for untrusted input. Two things worth pinning down early: CSV parsing edge cases (quoted fields, escaped quotes, variable column order across locale variants) and XML column-name variability between Procmon versions, since both are common sources of silent misparse. Deterministic paging plus source identity (path/SHA-256) should make the Evidence projection trustworthy.

@XinwangTao commented on GitHub (Oct 15, 2026): Good scoping — an offline-only, read-only reader for exports analysts already have fills a real gap without pulling in live tracing or PML decoding, and it complements #2689 nicely (offline vs live). The explicit-unknowns rule for missing columns and the fail-clear/partial-coverage contract for malformed files are the right defaults for untrusted input. Two things worth pinning down early: CSV parsing edge cases (quoted fields, escaped quotes, variable column order across locale variants) and XML column-name variability between Procmon versions, since both are common sources of silent misparse. Deterministic paging plus source identity (path/SHA-256) should make the Evidence projection trustworthy.

bsakaguchi referenced this issue

2026-10-17 21:01:31 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:12:04 +00:00

[PR #1525] [MERGED] fix(javascript): yield during per-file projection and graph construction #2940

bsakaguchi referenced this issue

2026-10-17 21:12:05 +00:00

[PR #1526] [MERGED] test(javascript): verify escaped receivers through CLI and MCP #2943

bsakaguchi referenced this issue

2026-10-17 21:12:14 +00:00

[PR #1539] [MERGED] fix(javascript): avoid argument limits when expanding escaped receivers #2955