Building Bulletproof Sentinel Queries: The Universal EventData XML Parser Pattern

Why the Usual Way of Parsing EventData Fails

Traditionally, analysts parse XML like this:

extend ThreatName = parse_xml(EventData).DataItem.EventData.Data[7]['#text']

Problems with this approach:

• Fragile – If Microsoft adds or reorders <Data> fields, everything breaks.
• Event-specific – Works only for one Event ID or one schema.
• Hard to maintain – Counting indexes destroys readability.
• Not scalable – You must rewrite the parser for each event type.

🔥 The Universal EventData XML Parser (KQL)

// Universal EventData XML parser for the Event table
Event
| where TimeGenerated >= ago(24h)
| extend ParsedEventData = parse_xml(EventData).DataItem.EventData.Data
| mv-expand ParsedEventData
| extend
    FieldName  = tostring(ParsedEventData['@Name']),
    FieldValue = tostring(ParsedEventData['#text'])
| evaluate pivot(FieldName, any(FieldValue), TimeGenerated, Computer, EventID)

This query extracts every field inside EventData, automatically names columns using <Data Name="...">, works across all event IDs, and requires zero editing when the XML structure changes.

Optional: Wrap Into a Reusable Function

let parse_eventdata = (input:(TimeGenerated:datetime, Computer:string, EventID:int, EventData:string)) {
    input
    | extend ParsedEventData = parse_xml(EventData).DataItem.EventData.Data
    | mv-expand ParsedEventData
    | extend
        FieldName  = tostring(ParsedEventData['@Name']),
        FieldValue = tostring(ParsedEventData['#text'])
    | evaluate pivot(FieldName, any(FieldValue), TimeGenerated, Computer, EventID)
};
// Usage
parse_eventdata(Event | where TimeGenerated >= ago(1d))

Performance Tips

• Always use a time filter (e.g., ago(24h) or smaller).
• Filter by EventLog or EventID before parsing where possible.
• Avoid parsing months of raw EventData at once unless absolutely required.

Final Thoughts

This universal parser is one of the most powerful ways to work with Windows Event Logs in Microsoft Sentinel. It simplifies analysis, enhances detection engineering, and eliminates the brittle, outdated practice of index-based XML parsing.

If you work with Sentinel long enough, this quickly becomes one of your core KQL tools — something you reuse across detections, hunting queries, and incident investigations.