Autogenerate scripts (WIP)

[mavam]

This PR is still work in progress. The idea is to parse the sysmon XML file and convert it to JSON, which can then be used to create Zeek and Broker Python scripts as needed.

Please don't merge yet, I'll remove the WIP tag in the title when it's ready for review.

[salesforce-cla]

Thanks for the contribution! Before we can merge this, we need @mavam to sign the Salesforce.com Contributor License Agreement.

[mavam]

For example, the script generates the following output:

{
  "1": {
    "name": "ProcessCreate",
    "desc": "PROCESS CREATION",
    "args": [
      "UtcTime",
      "ProcessGuid",
      "ProcessID",
      "Image",
      "FileVersion",
      "Description",
      "Product",
      "Company",
      "CommandLine",
      "CurrentDirectory",
      "User",
      "LogonGuid",
      "LogonId",
      "TerminalSessionId",
      "IntegrityLevel",
      "Hashes",
      "ParentProcessGuid",
      "ParentProcessId",
      "ParentImage",
      "ParentCommandLine"
    ]
  },
  "2": {
    "name": "FileCreateTime",
    "desc": "FILE CREATION TIME RETROACTIVELY CHANGED IN THE FILESYSTEM",
    "...": "..."
  }
}

For testing, I've been using https://github.com/SwiftOnSecurity/sysmon-config, which has a complete annotation of SYSMON EVENT comments (e.g., including the crucial DATA section).