semvec/pypi-packages huggingface dataset:
pyPASreporter-EVDparser 0.3.0
EVD (Export Vault Data) parser for CyberArk PAM - part of pyPASreporter ecosystem
License: MIT
Requires Python: >=3.10
Keywords: cyberark, duckdb, evd, pam, parser, security, vault

# pyPASreporter-EVDparser

High-performance EVD (Export Vault Data) parser for CyberArk PAM - loads CSV exports into DuckDB for analysis.

[![PyPI](https://img.shields.io/pypi/v/pyPASreporter-EVDparser)](https://pypi.org/project/pyPASreporter-EVDparser/)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)

## Installation

```bash
pip install pyPASreporter-EVDparser
```

## Quick Start

### CLI Usage

```bash
# Load all EVD exports into DuckDB
evdparser load-all /path/to/evd/exports ./cyberark.duckdb

# Load specific tables
evdparser load-all /path/to/exports ./cyberark.duckdb -t users -t safes -t files

# Query the data
evdparser query ./cyberark.duckdb "SELECT user_name, disabled FROM cyberark_evd.users LIMIT 5"

# List available tables
evdparser list-tables
```

### Python API

```python
from pypasreporter_evdparser import load_all_tables
import duckdb
from pathlib import Path

con = duckdb.connect("cyberark.duckdb")
results = load_all_tables(con, Path("/path/to/evd/exports"))

for r in results:
    print(f"{r.table_name}: {r.rows_loaded} rows in {r.duration_seconds:.2f}s")
```

## Performance

Uses DuckDB's native CSV reader (C++ engine) for blazing fast performance:

- **98 million rows loaded in ~47 seconds**
- No Python CSV iteration overhead
- Parallel CSV reading enabled by default

## Supported Tables

| Table | CSV File | Description |
|-------|----------|-------------|
| `users` | UsersList.csv | Vault users |
| `safes` | SafesList.csv | Safe definitions |
| `files` | FilesList.csv | Objects/accounts |
| `owners` | OwnersList.csv | Safe permissions |
| `groups` | GroupsList.csv | User groups |
| `object_properties` | ObjectProperties.csv | Account properties |
| `events` | EventsList.csv | Safe events |
| `activity_log` | LogList.csv | User activity audit |
| `system_log` | Italogfile.csv | Vault system log |
| ... | ... | [14 tables total](https://itpamltd.github.io/pyPASreporter/evdparser/) |

## Features

- **Automatic column normalization**: `UserName` → `user_name`
- **NULL handling**: Converts `''`, `'NULL'`, `'null'`, `'None'` to SQL NULL
- **Datetime parsing**: Supports EVD format (`DD-MM-YYYY HH:MM:SS`) and Italog format
- **Metadata columns**: Adds `_loaded_at`, `_source_file_modified_at`, `_source_file`

## Documentation

Full documentation: [itpamltd.github.io/pyPASreporter/evdparser](https://itpamltd.github.io/pyPASreporter/evdparser/)

## Part of pyPASreporter Ecosystem

- [pyPASreporter](https://pypi.org/project/pyPASreporter/) - Main reporting package
- [pyPASreporter-EVDparser](https://pypi.org/project/pyPASreporter-EVDparser/) - EVD parser (this package)
- [pyPASreporter-PACLIparser](https://pypi.org/project/pyPASreporter-PACLIparser/) - PACLI config parser

## License

MIT