From 536a60c040c9ab65aa5cf30948164260470ef9b1 Mon Sep 17 00:00:00 2001
From: 1orenz0 <1orenz0>
Date: Tue, 1 Oct 2019 08:45:35 +0100
Subject: [PATCH] [event log] Expose event keywords and publisher guid

Accessing the publisher guid is useful to setup an ETW trace, and we
need to know event keywords in order to activate the ETW session on the
correct "channels".
---
 windows/winobject/event_log.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/windows/winobject/event_log.py b/windows/winobject/event_log.py
index b588ac3..24a40b7 100644
--- a/windows/winobject/event_log.py
+++ b/windows/winobject/event_log.py
@@ -443,6 +443,10 @@ class ChannelConfig(EvtHandle):
         "TEST"
         return [EvtPublisher(pub) for pub in chaninfo(self, gdef.EvtChannelPublisherList).value]
 
+    @property
+    def keywords(self):
+        return int(chaninfo(self, gdef.EvtChannelPublishingConfigKeywords).value)
+
     @property
     def enabled(self):
         return bool(chaninfo(self, gdef.EvtChannelConfigEnabled).value)
@@ -546,6 +550,15 @@ class PublisherMetadata(EvtHandle):
                 raise
         return sbuff.value
 
+    @property
+    def guid(self):
+        """The GUID associated with this provider
+
+        :type:  [:class:`GUID`] -- the GUID in a XXXXXXXXXX-YYYY-ZZZZ-TTTT-VVVVVVVVVV form
+        """
+        return publishinfo(self, gdef.EvtPublisherMetadataPublisherGuid).value
+
+
     def __repr__(self):
         return '<{0} "{1}">'.format(type(self).__name__, self.name)