Event Log

Active Directory auditing and reporting solution that monitors AD changes

Recover event log entries from an image by heuristically looking for record structures.

A tool for fixing acquired .evt Windows Event Log files in digital forensics.

Powerful tool for searching and hunting through Windows forensic artefacts with support for Sigma detection rules and custom Chainsaw detection rules.

A repository providing guidance on collecting security-relevant Windows event logs using Windows Event Forwarding (WEF).

Windows Event Log Analyzer with logon timeline generator and noise reduction for fast forensics.

A pure Python parser for Windows Event Log (.evtx) files that enables cross-platform forensic analysis of Windows system events.

Windows event log fast forensics timeline generator and threat hunting tool.

Event Log Explorer is a software solution for viewing, analyzing, and monitoring events recorded in Microsoft Windows event logs, offering advanced features and efficient filtering capabilities.

GrokEVT is a tool for reading Windows event log files and converting them to a human-readable format.

Investigate malicious logons by visualizing and analyzing Windows Active Directory event logs with LogonTracer.

ProcFilter is a process filtering system for Windows with built-in YARA integration, designed for malware analysts to create YARA signatures for Windows environments.

A library to access and parse Windows XML Event Log (EVTX) format, useful for digital forensics and incident response.

Container of 200 Windows EVTX samples for testing detection scripts and training on DFIR.

libevt is a library to access and parse Windows Event Log (EVT) files.