Provenance Graph Tool Kit (pgtk)

pgtk is a C++20 toolkit for parsing and analyzing system provenance data. It supports input from sources like Sysmon EVTX logs and PCAP files, and generates graph representations for visualization, Prolog-based reasoning, and semantic graph analysis.

Features

• Parse Windows Sysmon EVTX files
• Parse PCAP files using PcapPlusPlus
• Generate:
  • Graphviz .gv files
  • Prolog .pl facts
  • RDF-like .tsv triples
• Identify malicious activity using logic rules via SWI-Prolog

Requirements

• C++20 compiler (GCC 10+, Clang 11+, MSVC 2019+)
• CMake ≥ 3.16
• SWI-Prolog installed system-wide (used at runtime)
• PcapPlusPlus and its dependencies:
  • libpcap / WinPcap / npcap
  • libpthread, libssl, libcrypto if required
• Git (for cloning submodules)

Cloning the Repository

git clone --recurse-submodules https://github.com/yourusername/pgtk.git

If you already cloned the repo without --recurse-submodules, run:

git submodule update --init --recursive

Building

mkdir build
cd build
cmake ..
make

Running

After building, run the tool and follow the interactive prompts:

./pgtk-app

PGTK Directory Format

A PGTK directory is a folder containing provenance-related input files (EVTX logs and PCAP files) grouped by instance name. Each file's name should begin with an instance identifier (e.g., Target, APT37, router) to allow proper grouping and processing.

Example structure:

PGTK/
├── APT37.pcap
├── router.pcap
├── Target.evtx
└── Target.pcap

In this example:

• The tool detects three instances: APT37, router, and Target.

• Files with the same prefix (Target.evtx, Target.pcap) are combined into a single graph before analysis.

• Each instance produces:

  • instance.gv — Graphviz output
  • instance.pl — Prolog facts
  • instance.tsv — Triples
  • instance.malicious.* — Files representing malicious subgraphs

The instance name is automatically extracted from the filename by repeatedly stripping extensions (.evtx, .pcap, etc.) from the basename. For example, the instance name related to the file TestServer.abc.123.evtx is TestServer.

---

License

This project is licensed under the MIT License.

---

Acknowledgments

• PcapPlusPlus for packet parsing
• SWI-Prolog for the reasoning engine