evtx

https://docs.rs/evtx/
Admin
evtx is a Rust library and parser for reading and parsing Windows XML Event Log (.evtx) files into...
Tokens:507,934
Snippets:2,438
Trust Score:9.1
Update:1 month ago
Show doc for...
Tokens:
Raw
### Placeholder resolution example (text)

Source: https://docs.rs/evtx/latest/src/evtx/binxml/ir.rs.html?search=

Conceptual example in the doc comment for resolve_placeholder_into. Shows how a placeholder resolves to an array value and how the containing element is later repeated.

```text
Template: <Data>%{0}</Data>
Placeholder(0) resolves to Value(StringArrayType(["a","b"]))
=> out += [ Value(StringArrayType(["a","b"])) ]
=> Data element is then repeated into two <Data> nodes.
```

--------------------------------

### and_then example function

Source: https://docs.rs/evtx/latest/evtx/err/type.Result.html?search=

Example function for and_then, showing control flow based on Result values.

```rust
fn sq_then_to_string(x: u32) -> Result<String, &'static str> {
    x.checked_mul(x).map(|sq| sq.to_string()).ok_or("overflowed")
}
```

--------------------------------

### Timestamp::as_millisecond() example

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Use to verify the whole milliseconds since the Unix epoch. The fractional milliseconds are truncated. The example covers positive and negative timestamps.

```rust
use jiff::Timestamp;

let ts = Timestamp::new(5, 123_456_789)?;
assert_eq!(ts.as_millisecond(), 5_123);
let ts = Timestamp::new(5, 999_999_999)?;
assert_eq!(ts.as_millisecond(), 5_999);

let ts = Timestamp::new(-5, -123_456_789)?;
assert_eq!(ts.as_millisecond(), -5_123);
let ts = Timestamp::new(-5, -999_999_999)?;
assert_eq!(ts.as_millisecond(), -5_999);

```

--------------------------------

### Timestamp::as_microsecond() example

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Use to verify the whole microseconds since the Unix epoch. The fractional microseconds are truncated. The example covers positive and negative timestamps.

```rust
use jiff::Timestamp;

let ts = Timestamp::new(5, 123_456_789)?;
assert_eq!(ts.as_microsecond(), 5_123_456);
let ts = Timestamp::new(5, 999_999_999)?;
assert_eq!(ts.as_microsecond(), 5_999_999);

let ts = Timestamp::new(-5, -123_456_789)?;
assert_eq!(ts.as_microsecond(), -5_123_456);
let ts = Timestamp::new(-5, -999_999_999)?;
assert_eq!(ts.as_microsecond(), -5_999_999);

```

--------------------------------

### Template value conversion example

Source: https://docs.rs/evtx/latest/src/evtx/binxml/ir.rs.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Illustrates the conversion of raw template substitution values into TemplateValue variants, showing how BinXmlType fragments become BinXmlElement references. This is a conceptual example from the documentation.

```text
values_raw = [ StringType("x"), BinXmlType(<C>y</C>) ]
values     = [ Value(StringType("x")), BinXmlElement(id_of_C) ]
```

--------------------------------

### Timestamp::new example

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Constructs a Timestamp from seconds and nanoseconds. The example shows the instant 123,456,789 seconds after the Unix epoch. Requires the `?` operator in a function returning `Result`.

```rust
use jiff::Timestamp;

assert_eq!(
    Timestamp::new(123_456_789, 0)?.to_string(),
    "1973-11-29T21:33:09Z",
);

```

--------------------------------

### FromIterator success example

Source: https://docs.rs/evtx/latest/evtx/err/type.Result.html?search=

Example of collecting a vector of Results into a Result containing a vector, checking for overflow.

```rust
let v = vec![1, 2];
let res: Result<Vec<u32>, &'static str> = v.iter().map(|x: &u32|
    x.checked_add(1).ok_or("Overflow!")
).collect();
assert_eq!(res, Ok(vec![2, 3]));
```

--------------------------------

### map example

Source: https://docs.rs/evtx/latest/evtx/err/type.Result.html?search=

Shows mapping the Ok value of a Result using map, leaving Err untouched. The example parses lines and prints doubled numbers.

```rust
let line = "1\n2\n3\n4\n";

for num in line.lines() {
    match num.parse::<i32>().map(|i| i * 2) {
        Ok(n) => println!("{n}"),
        Err(..) => {}
    }
}
```

--------------------------------

### Timestamp::from_duration example

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Shows how to construct a Timestamp from a SignedDuration obtained from a SystemTime. The example computes the duration from the Unix epoch to the current time and asserts the resulting timestamp is after the Unix epoch.

```rust
use std::time::SystemTime;
use jiff::{SignedDuration, Timestamp};

let unix_epoch = SystemTime::UNIX_EPOCH;
let now = SystemTime::now();
let duration = SignedDuration::system_until(unix_epoch, now)?;
let ts = Timestamp::from_duration(duration)?;
assert!(ts > Timestamp::UNIX_EPOCH);

```

--------------------------------

### Timestamp::as_nanosecond() example

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Use to verify the total nanoseconds since the Unix epoch. The result is lossless and can be used with Timestamp::from_nanosecond to recreate the timestamp. The example covers positive and negative timestamps.

```rust
use jiff::Timestamp;

let ts = Timestamp::new(5, 123_456_789)?;
assert_eq!(ts.as_nanosecond(), 5_123_456_789);
let ts = Timestamp::new(5, 999_999_999)?;
assert_eq!(ts.as_nanosecond(), 5_999_999_999);

let ts = Timestamp::new(-5, -123_456_789)?;
assert_eq!(ts.as_nanosecond(), -5_123_456_789);
let ts = Timestamp::new(-5, -999_999_999)?;
assert_eq!(ts.as_nanosecond(), -5_999_999_999);

```

--------------------------------

### Timestamp::subsec_millisecond() example

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Use to verify the fractional second component in milliseconds. The value is guaranteed to be within -1 to 1 second. The example covers positive and negative timestamps.

```rust
use jiff::Timestamp;

let ts = Timestamp::new(5, 123_456_789)?;
assert_eq!(ts.subsec_millisecond(), 123);
let ts = Timestamp::new(5, 999_999_999)?;
assert_eq!(ts.subsec_millisecond(), 999);

let ts = Timestamp::new(-5, -123_456_789)?;
assert_eq!(ts.subsec_millisecond(), -123);
let ts = Timestamp::new(-5, -999_999_999)?;
assert_eq!(ts.subsec_millisecond(), -999);

```

--------------------------------

### ok example

Source: https://docs.rs/evtx/latest/evtx/err/type.Result.html?search=

Demonstrates converting a Result to an Option, returning Some(value) for Ok and None for Err.

```rust
let x: Result<u32, &str> = Ok(2);
assert_eq!(x.ok(), Some(2));

let x: Result<u32, &str> = Err("Nothing here");
assert_eq!(x.ok(), None);
```

--------------------------------

### Timestamp::subsec_nanosecond() example

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=std%3A%3Avec

Use to get the fractional second component in nanoseconds. Never returns a value greater than 1 second or less than -1 second.

```rust
use jiff::Timestamp;

let ts = Timestamp::new(5, 123_456_789)?;
assert_eq!(ts.subsec_nanosecond(), 123_456_789);
let ts = Timestamp::new(5, 999_999_999)?;
assert_eq!(ts.subsec_nanosecond(), 999_999_999);

let ts = Timestamp::new(-5, -123_456_789)?;
assert_eq!(ts.subsec_nanosecond(), -123_456_789);
let ts = Timestamp::new(-5, -999_999_999)?;
assert_eq!(ts.subsec_nanosecond(), -999_999_999);

```

--------------------------------

### Using `Timestamp::as_second` to get whole seconds

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=std%3A%3Avec

This example demonstrates how to use `as_second` to get the whole number of seconds since the negative values are handled correctly, truncating any fractional seconds. It shows that both positive and negative fractional seconds are truncated toward zero.

```let ts = Timestamp::new(5, 10)?
let ts = Timestamp::new(5, 10)?
```

```assert_eq!(ts.as_original(), 5);
assert_eq!(ts.as_original(), 5);
```

```let ts = Tim
let ts = Tim
```

--------------------------------

### as_ref example

Source: https://docs.rs/evtx/latest/evtx/err/type.Result.html?search=

Shows converting a Result to a Result with references, leaving the original in place.

```rust
let x: Result<u32, &str> = Ok(2);
assert_eq!(x.as_ref(), Ok(&2));

let x: Result<u32, &str> = Err("Error");
assert_eq!(x.as_ref(), Err(&"Error"));
```

--------------------------------

### Get offset signum with Offset::signum

Source: https://docs.rs/evtx/latest/evtx/struct.Offset.html?search=u32+-%3E+bool

Returns the signum of a time zone offset: `1` for positive, `0` for zero, and `-1` for negative. The example asserts the signum for offsets `5`, `0`, and `-5`.

```rust
use jiff::tz;

assert_eq!(tz::offset(5).signum(), 1);
assert_eq!(tz::offset(0).signum(), 0);
assert_eq!(tz::offset(-5).signum(), -1);

```

--------------------------------

### expect method usage and recommendations

Source: https://docs.rs/evtx/latest/evtx/err/type.Result.html?search=

Demonstrates the use of expect to retrieve a value or panic, along with recommended message styles.

```rust
let x: Result<u32, &str> = Err("emergency failure");
x.expect("Testing expect"); // panics with `Testing expect: emergency failure`
```

```rust
let path = std::env::var("IMPORTANT_PATH")
    .expect("env variable `IMPORTANT_PATH` should be set by `wrapper_script.sh`");
```

--------------------------------

### slice_r: get sub-slice or return Truncated

Source: https://docs.rs/evtx/latest/src/evtx/utils/bytes.rs.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Returns a sub-slice of length len starting at offset, or DeserializationError::Truncated if the range is out of bounds. Use for fixed-size struct parsing; it performs a single up-front bounds check.

```rust
pub(crate) fn slice_r<'a>(
    buf: &'a [u8],
    offset: usize,
    len: usize,
    what: &'static str,
) -> Result<&'a [u8], DeserializationError> {
    let end = offset
        .checked_add(len)
        .ok_or_else(|| truncated(what, offset, len, buf.len()))?;
    buf.get(offset..end)
        .ok_or_else(|| truncated(what, offset, len, buf.len()))
}
```

--------------------------------

### Generate periodic timestamps with series(5.hours())

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Generates a series of timestamps every 5 hours over a 48-hour period using the series method. The example lists glucose monitor scan times for 2 days after installation.

```rust
use jiff::{Timestamp, ToSpan};

let start: Timestamp = "2023-07-15 16:30:00-04".parse()?;
let end = start.checked_add(48.hours())?;
let mut scan_times = vec![];
for ts in start.series(5.hours()).take_while(|&ts| ts <= end) {
    scan_times.push(ts);
}
assert_eq!(scan_times, vec![
    "2023-07-15 16:30:00-04:00".parse::<Timestamp>()?,
    "2023-07-15 21:30:00-04:00".parse::<Timestamp>()?,
    "2023-07-16 02:30:00-04:00".parse::<Timestamp>()?,
    "2023-07-16 07:30:00-04:00".parse::<Timestamp>()?,
    "2023-07-16 12:30:00-04:00".parse::<Timestamp>()?,
    "2023-07-16 17:30:00-04:00".parse::<Timestamp>()?,
    "2023-07-16 22:30:00-04:00".parse::<Timestamp>()?,
    "2023-07-17 03:30:00-04:00".parse::<Timestamp>()?,
    "2023-07-17 08:30:00-04:00".parse::<Timestamp>()?,
    "2023-07-17 13:30:00-04:00".parse::<Timestamp>()?,
]);

```

--------------------------------

### Read GUID variant

Source: https://docs.rs/evtx/latest/src/evtx/binxml/value_variant.rs.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Reads a 16-byte GUID from the cursor and wraps it in `BinXmlValue::GuidType`.

```rust
(BinXmlValueType::GuidType, _) => BinXmlValue::GuidType(cursor.array::<16>("guid")?),
```

--------------------------------

### FromIterator error example

Source: https://docs.rs/evtx/latest/evtx/err/type.Result.html?search=

Example of collecting a vector of Results where an underflow occurs, resulting in an Err.

```rust
let v = vec![1, 2, 0];
let res: Result<Vec<u32>, &'static str> = v.iter().map(|x: &u32|
    x.checked_sub(1).ok_or("Underflow!")
).collect();
assert_eq!(res, Err("Underflow!"));
```

--------------------------------

### Array substitution expansion example

Source: https://docs.rs/evtx/latest/src/evtx/binxml/ir.rs.html?search=std%3A%3Avec

Illustrates how an array substitution expands into repeated elements in the IR tree. Shows a template with a placeholder and a StringArrayType value, resulting in multiple Data elements under the parent.

```text
Template: <Data>%{0}</Data>
Values[0]: StringArrayType(["a", "b"])

Result under parent:
  children += [ Element(Data{ "a" }), Element(Data{ "b" }) ]
```

--------------------------------

### normalize_guid

Source: https://docs.rs/evtx/latest/evtx/wevt_templates/fn.normalize_guid.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Normalizes a GUID string. This function takes a string slice and returns a normalized GUID as a String.

```APIDOC
## normalize_guid

### Description
Normalizes a GUID string. This function takes a string slice and returns a normalized GUID as a String.

### Function Signature
```rust
pub fn normalize_guid(s: &str) -> String
```

### Parameters
- **s** (&str) - Required - The input GUID string to normalize.

### Returns
- **String** - The normalized GUID string.
```

--------------------------------

### as_mut example

Source: https://docs.rs/evtx/latest/evtx/err/type.Result.html?search=

Demonstrates mutating the contained values of a Result using as_mut and a helper function.

```rust
fn mutate(r: &mut Result<i32, i32>) {
    match r.as_mut() {
        Ok(v) => *v = 42,
        Err(e) => *e = 0,
    }
}

let mut x: Result<i32, i32> = Ok(2);
mutate(&mut x);
assert_eq!(x.unwrap(), 42);

let mut x: Result<i32, i32> = Err(13);
mutate(&mut x);
assert_eq!(x.unwrap_err(), 0);
```

--------------------------------

### to_datetime() example

Source: https://docs.rs/evtx/latest/evtx/struct.Offset.html?search=u32+-%3E+bool

Converts a timestamp to a civil datetime using this offset. The example shows the result for the UNIX epoch with an offset of -8.

```rust
use jiff::{civil::date, tz, Timestamp};

assert_eq!(
    tz::offset(-8).to_datetime(Timestamp::UNIX_EPOCH),
    date(1969, 12, 31).at(16, 0, 0, 0),
);
```

--------------------------------

### in_tz() example

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Converts a timestamp to a zoned datetime using a time zone name. The example shows the resulting string for a specific instant.

```rust
use jiff::Timestamp;

let ts = Timestamp::new(123_456_789, 0).unwrap();
let zdt = ts.in_tz("America/New_York")?;
assert_eq!(zdt.to_string(), "1973-11-29T16:33:09-05:00[America/New_York]");

```

--------------------------------

### EvtxParser from_path constructor

Source: https://docs.rs/evtx/latest/src/evtx/evtx_parser.rs.html

Loads an evtx file from a path, canonicalizing it and failing if the path does not exist or the evtx header is invalid.

```rust
impl EvtxParser<File> {
    /// Attempts to load an evtx file from a given path, will fail if the path does not exist,
    /// or if evtx header is invalid.
    pub fn from_path(path: impl AsRef<Path>) -> Result<Self> {
        let path = path
            .as_ref()
            .canonicalize()
            .map_err(|e| InputError::failed_to_open_file(e, &path))?;

        let f = File::open(&path).map_err(|e| InputError::failed_to_open_file(e, &path))?;

        let cursor = f;
        Self::from_read_seek(cursor)
    }
}
```

--------------------------------

### Timestamp::as_duration() example

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Use to verify the SignedDuration since the Unix epoch. The example covers the UNIX_EPOCH, a positive timestamp, and a negative timestamp.

```rust
use jiff::{SignedDuration, Timestamp};

assert_eq!(
    Timestamp::UNIX_EPOCH.as_duration(),
    SignedDuration::ZERO,
);
assert_eq!(
    Timestamp::new(5, 123_456_789)?.as_duration(),
    SignedDuration::new(5, 123_456_789),
);
assert_eq!(
    Timestamp::new(-5, -123_456_789)?.as_duration(),
    SignedDuration::new(-5, -123_456_789),
);

```

--------------------------------

### err example

Source: https://docs.rs/evtx/latest/evtx/err/type.Result.html?search=

Demonstrates converting a Result to an Option, returning Some(error) for Err and None for Ok.

```rust
let x: Result<u32, &str> = Ok(2);
assert_eq!(x.err(), None);

let x: Result<u32, &str> = Err("Nothing here");
assert_eq!(x.err(), Some("Nothing here"));
```

--------------------------------

### Render TEMP entry to XML with placeholders

Source: https://docs.rs/evtx/latest/src/evtx/wevt_templates/render.rs.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Renders a raw TEMP blob to an XML string with {sub:N} placeholders for substitutions. Requires the TEMP blob to be at least 40 bytes to contain the BinXML fragment header.

```rust
pub fn render_temp_to_xml(temp_bytes: &[u8], ansi_codec: EncodingRef) -> Result<String> {
    let binxml = temp_binxml_fragment(temp_bytes)?;
    let bump = Bump::new();
    let template = build_wevt_template_definition_ir(binxml, ansi_codec, &bump)?;
    let values = placeholder_values(&template, None, &bump);
    let instantiated = instantiate_template_definition_ir(&template, &values, &bump)?;
    render_ir_xml(&instantiated, ansi_codec)
}
```

--------------------------------

### Using `Timestamp::from_naming` to create instants around the Unix epoch

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html?search=std%3A%3Avec

This example demonstrates how to create a `Timestamp` with `from_note: `from_naming` nanoseconds since the positive and negative values.positive values represent times after the function returns an error if the input is out of `Timestamp::error boundaries (less than `Timestamp::uses;gt;` or greater than `Timestamp::uses;gt;`).

```use jiff::Timestamp;
use jiff::Timestamp;


assert_eq!(
    Tim snippet: .from_naming(1)?.to_string(),
    
```

--------------------------------

### Timestamp::duration_until example

Source: https://docs.rs/evtx/latest/evtx/struct.Timestamp.html

Shows how to compute the signed duration between two timestamps with `Timestamp::duration_until`. The first example demonstrates the basic usage and negative results when the order is flipped. The second example shows conversion between `SignedDuration` and `Span`, which is guaranteed to succeed because the duration is always expressed in uniform units (hours or smaller).

```rust
use jiff::{Timestamp, SignedDuration};

let earlier: Timestamp = "2006-08-24T22:30:00Z".parse()?;
let later: Timestamp = "2019-01-31 21:00:00Z".parse()?;
assert_eq!(
    earlier.duration_until(later),
    SignedDuration::from_secs(392509800),
);

// Flipping the timestamps is fine, but you'll get a negative span.
assert_eq!(
    later.duration_until(earlier),
    SignedDuration::from_secs(-392509800),
);

```

```rust
use jiff::{SignedDuration, Span, Timestamp};

let ts1: Timestamp = "2024-02-28T00:00:00Z".parse()?;
let ts2: Timestamp = "2024-03-01T00:00:00Z".parse()?;
let dur = ts1.duration_until(ts2);
// Guaranteed to never fail because the duration
// between two civil times never exceeds the limits
// of a `Span`.
let span = Span::try_from(dur).unwrap();
assert_eq!(format!("{span:#}"), "172800s");
// Guaranteed to succeed and always return the original
// duration because the units are always hours or smaller,
// and thus uniform. This means a relative datetime is
// never required to do this conversion.
let dur = SignedDuration::try_from(span).unwrap();
assert_eq!(dur, SignedDuration::from_secs(172_800));

```

--------------------------------

### is_err_and example

Source: https://docs.rs/evtx/latest/evtx/err/type.Result.html?search=

Shows how to use is_err_and to check if a Result is Err and the error value matches a predicate. Includes cases with different error kinds and ownership.

```rust
use std::io::{Error, ErrorKind};

let x: Result<u32, Error> = Err(Error::new(ErrorKind::NotFound, "!"));
assert_eq!(x.is_err_and(|x| x.kind() == ErrorKind::NotFound), true);

let x: Result<u32, Error> = Err(Error::new(ErrorKind::PermissionDenied, "!"));
assert_eq!(x.is_err_and(|x| x.kind() == ErrorKind::NotFound), false);

let x: Result<u32, Error> = Ok(123);
assert_eq!(x.is_err_and(|x| x.kind() == ErrorKind::NotFound), false);

let x: Result<u32, String> = Err("ownership".to_string());
assert_eq!(x.as_ref().is_err_and(|x| x.len() > 1), true);
println!("still alive {:?}", x);
```

--------------------------------

### Single-threaded EVTX parsing with EvtxParser::from_path and records()

Source: https://docs.rs/evtx/latest/evtx/struct.EvtxParser.html?search=

Shows how to create a parser from a file path and iterate over records, printing each record's ID and XML data. Errors are printed to stderr.

```rust
let mut parser = EvtxParser::from_path(fp).unwrap();

for record in parser.records() {
    match record {
        Ok(r) => println!("Record {}\n{}", r.event_record_id, r.data),
        Err(e) => eprintln!("{}", e),
    }
}
```

--------------------------------

### Read template definition header

Source: https://docs.rs/evtx/latest/src/evtx/binxml/tokens.rs.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Reads the next template offset, GUID, and data size from a cursor. Returns a BinXmlTemplateDefinitionHeader. Fails with an IO error if the GUID is invalid.

```rust
fn read_template_definition_header_cursor(
    cursor: &mut ByteCursor<'_>,
) -> Result<BinXmlTemplateDefinitionHeader> {
    // If any of these fail we cannot reliably report the template information in error.
    let next_template_offset = cursor.u32_named("next_template_offset")?;
    let guid_bytes = cursor.take_bytes(16, "template_guid")?;
    let template_guid = Guid::from_buffer(guid_bytes).map_err(|_| {
        DeserializationError::Io(std::io::Error::new(
            std::io::ErrorKind::InvalidData,
            "invalid GUID",
        ))
    })?;
    // Data size includes the fragment header, element and end of file token;
    // except for the first 33 bytes of the template definition (above)
    let data_size = cursor.u32_named("template_data_size")?;

    Ok(BinXmlTemplateDefinitionHeader {
        next_template_offset,
        guid: template_guid,
        data_size,
    })
}
```
Tokens:
Raw