windows-event-logs

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

Cross-Platform, Agent-Native Universal Log Viewer.

Automation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.

Lateral movement tracker for anything: Windows, Linux and macOS logs, forensic images (E01, VMDK, VHDX; no mounting) and triage packages into one timeline, with a statistical hunt and a graph viewer. One Rust binary for Windows, Linux and macOS.

Open source HIDS tailored for Microsoft Windows and Active Directory

A PS forensics tool for Scraping, Filtering and Exporting Windows Event Logs

A Python tool that parses EVTX files and converts them into JSON formatted logs mimicking Wazuh agent behavior in version 4.x. wazuhevtx is designed as a helper for wazuh-logtest tool.

LogLens is a universal log explorer that runs entirely in your browser. Drop any log file in, query it with KQL, visualize it on a timeline, and analyze it with a local AI - all without a single byte of your data touching the internet.

Convert Windows Event Log .evtx files to other formats.

SOC Authentication Monitoring Dashboard using Splunk Enterprise with Brute Force Detection, Windows Security Event Monitoring, Alerting, and Interactive Dashboard.

Search Windows event log and output results to a text file

Fast, self-hosted DFIR triage for Windows Event Logs (.evtx): Sigma + YARA + heuristic detections, MITRE ATT&CK, attack chains, and one-click PDF/DOCX reports.

A Python script that parses CPER-formatted raw data contained in error event log provided by WHEA-Logger

Справочник событий Windows/Linux для SOC-аналитиков, threat hunters и IR-инженеров. 144 Event ID, Sysmon, Linux, MITRE ATT&CK, storylines, инструменты — на русском, с интерактивным поиском.

Python 3-based multithreaded Windows Event monitoring program

Implement the Yamato Security Windows event logging baselines with native PowerShell: tiered enable, read-only verification, rollback, and WELA-based independent checking. No agents, no modules.

Hands-on enterprise SIEM lab built with Splunk Enterprise, Windows Server AD, and VirtualBox. Covers log ingestion, Windows Event ID analysis, SPL queries, and security dashboarding.

Single-file, fully offline Windows event log decoder — paste an event, get a plain-English verdict. No install, no AI, no network calls.

Hands-on SOC Analyst L1 labs, security investigations, incident response, and cybersecurity analysis.

Targeted parsing of Windows triage collections for quick answers without waiting for a full timeline. Work in progress: currently EVTX only (EvtxECmd with per-log event ID filters: logons, RDP, services, tasks, PowerShell; one CSV per log), more parsers under way.